From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751845AbcLERQg (ORCPT <rfc822;w@1wt.eu>);
        Mon, 5 Dec 2016 12:16:36 -0500
Received: from mail-pg0-f47.google.com ([74.125.83.47]:35623 "EHLO
        mail-pg0-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751451AbcLERQd (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 5 Dec 2016 12:16:33 -0500
To: LKML <linux-kernel@vger.kernel.org>
From: Mark Salyzyn <salyzyn@android.com>
Subject: CVE-2016-7097 causes acl leak
Message-ID: <bb7177d2-08dc-d75c-9012-26e3b2888461@android.com>
Date: Mon, 5 Dec 2016 09:16:31 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Thunderbird/45.4.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Commit 073931017b49d9458aa351605b43a7e34598caef has several occurrences 
of an acl leak.

posix_acl_update_mode(inose, &mode, &acl);

. . .

posix_acl_release(acl);


acl is NULLed in posix_acl_update_mode to signal caller to not update 
the acl; but because it is nulled, it is never released.


Sincerely -- Mark Salyzyn