From: Al Viro <viro@zeniv.linux.org.uk>
Date: Tue, 22 Apr 2008 23:51:27 +0000 (-0400)
Subject: [PATCH] double-free of inode on alloc_file() failure exit in create_write_pipe()
X-Git-Tag: v2.6.26-rc1~1097^2~2
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ed1524371716466e9c762808b02601d0d0276a92;p=linux-2.6

[PATCH] double-free of inode on alloc_file() failure exit in create_write_pipe()

Duh...  Fortunately, the bug is quite recent (post-2.6.25) and, embarrassingly,
mine ;-/

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

diff --git a/fs/pipe.c b/fs/pipe.c
index 8be381bbcb..f73492b681 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -988,7 +988,10 @@ struct file *create_write_pipe(void)
 	return f;
 
  err_dentry:
+	free_pipe_info(inode);
 	dput(dentry);
+	return ERR_PTR(err);
+
  err_inode:
 	free_pipe_info(inode);
 	iput(inode);