From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-4127461-1517014171-2-9560221104330805215 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, FREEMAIL_FORGED_FROMDOMAIN 0.19, FREEMAIL_FROM 0.001, HEADER_FROM_DIFFERENT_DOMAINS 0.001, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES en, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='com', MailFrom='org' X-Spam-charsets: X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1517014171; b=MLQ/Rj0RK+Ogk9qCvMJk7M8+Ni34LmxU0NlNLFeHLVC2g1M wKbm4d4cB7hfWk5/IV3MK0gUPqZ31jNDDQvhrxVkXwP0lLUMO2Zxnao8oOUndmTY 5OZbTBS9oDZ9AVMoTnUpLsVTG7NLN1SnwEss1c3Tl/KHjRdg47sHcVtq+MklwrZu 6BlgszIXKIEPv7aXl/gBW7gr6BeD/fvacrdYny+WyC52ypaWy6aRJzClJA37mu+S icDgQ+2t7LwBWKt993ba/lNusv8a1daMj6NxQNt6p5WpErgMENkGtZstSt1B9RpM ic3IpvunV2N8uPh9iAjZUYVkCTP4Yzg2ltZpQcg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:cc:subject:date:message-id :in-reply-to:references:sender:list-id; s=arctest; t=1517014171; bh=1Wx9coXe5SdBvb8mC/R4ob4UW+rpaEK46MAuKMEHtrw=; b=G8Vmnk1KkP5q Ic5u4uCAV2mqEl9T3LiPERphg80V3pfm586sOdWgMXLhO7q9X81z/QH9ayDq7hvV exd9SWGgA9/U/IiPv/Is0OxreezEiWQpvDr8Wf/sEg0DzLoBcE1GZF6aj+MKanrl pU4A70kaJpto2B0jqg8xR8Ae6ZRh9ZRu3G8545E68F2svWBSJWP6TOVFrIYj1XdE k4BTX0waACgNn6yPBhoR+LOAi/ktzVzMwmXU2V2zt+xvTv3L9Uq7uQRbXTbdvbS1 eGDXiPxtOjUFFSgkT+ejMbxET3ou1lHqN79sKZtMITLTIc6TZyy5OUYBtyqzm0M/ h7Ey+ArFCg== ARC-Authentication-Results: i=1; mx2.messagingengine.com; arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=DIraLAgu x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=pass (p=none,has-list-id=yes,d=none) header.from=gmail.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=mtjrhGLr; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=gmail.com header.result=pass header_is_org_domain=yes Authentication-Results: mx2.messagingengine.com; arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=DIraLAgu x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=pass (p=none,has-list-id=yes,d=none) header.from=gmail.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=mtjrhGLr; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=gmail.com header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751946AbeA0AtS (ORCPT ); Fri, 26 Jan 2018 19:49:18 -0500 Received: from mail-it0-f65.google.com ([209.85.214.65]:40483 "EHLO mail-it0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751889AbeA0AtR (ORCPT ); Fri, 26 Jan 2018 19:49:17 -0500 X-Google-Smtp-Source: AH8x227LHkENzZ6M1D/WGC8mlmIgB09Pi43p9lLQ4P5VuzQF3w/vn/XjZV1kix82prYcrWgeBsVLuA== From: Eric Biggers To: linux-kernel@vger.kernel.org, Andrew Morton Cc: Zhouyi Zhou , Jens Axboe , linux-block@vger.kernel.org, syzkaller-bugs@googlegroups.com, Eric Biggers , stable@vger.kernel.org Subject: [PATCH] Revert "kernel/relay.c: fix potential memory leak" Date: Fri, 26 Jan 2018 16:47:59 -0800 Message-Id: <20180127004759.101823-1-ebiggers3@gmail.com> X-Mailer: git-send-email 2.16.0.rc1.238.g530d649a79-goog In-Reply-To: <089e082d01d08b36a6055cd763ca@google.com> References: <089e082d01d08b36a6055cd763ca@google.com> Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: From: Eric Biggers This reverts commit ba62bafe942b159a6109cbec780d36496e06b6c5. This commit introduced a double free bug, because 'chan' is already freed by the line: kref_put(&chan->kref, relay_destroy_channel); This bug was found by syzkaller, using the BLKTRACESETUP ioctl. Fixes: ba62bafe942b ("kernel/relay.c: fix potential memory leak") Reported-by: syzbot Cc: # v4.7+ Signed-off-by: Eric Biggers --- kernel/relay.c | 1 - 1 file changed, 1 deletion(-) diff --git a/kernel/relay.c b/kernel/relay.c index 39a9dfc69486..55da824f4adc 100644 --- a/kernel/relay.c +++ b/kernel/relay.c @@ -611,7 +611,6 @@ struct rchan *relay_open(const char *base_filename, kref_put(&chan->kref, relay_destroy_channel); mutex_unlock(&relay_channels_mutex); - kfree(chan); return NULL; } EXPORT_SYMBOL_GPL(relay_open); -- 2.16.0.rc1.238.g530d649a79-goog