summaryrefslogtreecommitdiffstats
path: root/fs
diff options
context:
space:
mode:
authorEric Biggers <ebiggers@google.com>2019-06-12 14:58:43 -0700
committerJens Axboe <axboe@kernel.dk>2019-06-13 03:00:30 -0600
commit355e8d26f719c207aa2e00e6f3cfab3acf21769b (patch)
tree4c9d87662a31867ec86c74582df7a62e1bc52d2d /fs
parentb9aef63aca772a25ffcfaedf4bd29fb36b919a93 (diff)
downloadlinux-355e8d26f719c207aa2e00e6f3cfab3acf21769b.tar.gz
linux-355e8d26f719c207aa2e00e6f3cfab3acf21769b.tar.bz2
linux-355e8d26f719c207aa2e00e6f3cfab3acf21769b.zip
io_uring: fix memory leak of UNIX domain socket inode
Opening and closing an io_uring instance leaks a UNIX domain socket inode. This is because the ->file of the io_uring instance's internal UNIX domain socket is set to point to the io_uring file, but then sock_release() sees the non-NULL ->file and assumes the inode reference is held by the file so doesn't call iput(). That's not the case here, since the reference is still meant to be held by the socket; the actual inode of the io_uring file is different. Fix this leak by NULL-ing out ->file before releasing the socket. Reported-by: syzbot+111cb28d9f583693aefa@syzkaller.appspotmail.com Fixes: 2b188cc1bb85 ("Add io_uring IO interface") Cc: <stable@vger.kernel.org> # v5.1+ Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs')
-rw-r--r--fs/io_uring.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 0fbb486a320e..86a2bd721900 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2777,8 +2777,10 @@ static void io_ring_ctx_free(struct io_ring_ctx *ctx)
io_eventfd_unregister(ctx);
#if defined(CONFIG_UNIX)
- if (ctx->ring_sock)
+ if (ctx->ring_sock) {
+ ctx->ring_sock->file = NULL; /* so that iput() is called */
sock_release(ctx->ring_sock);
+ }
#endif
io_mem_free(ctx->sq_ring);