euleros inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I839LV CVE: NA ---------------------------------------------------- When the /proc/pid/idle_page and /proc/pid/swap_page are opened, the try_module_get command is used to add reference counting to prevent the module from being released. However, if the file fails to be opened, the reference count must be correctly released in the abnormal process. Signed-off-by: liubo <liubo254@huawei.com> --- fs/proc/task_mmu.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 502893304027..9182d0c6d22c 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -1911,15 +1911,20 @@ static int mm_idle_open(struct inode *inode, struct file *file) } mm = proc_mem_open(inode, PTRACE_MODE_READ); - if (IS_ERR(mm)) + if (IS_ERR(mm)) { + module_put(module); return PTR_ERR(mm); + } file->private_data = mm; if (proc_page_scan_operations.open) - return proc_page_scan_operations.open(inode, file); + ret = proc_page_scan_operations.open(inode, file); - return 0; + if (ret != 0) + module_put(module); + + return ret; } static int mm_idle_release(struct inode *inode, struct file *file) @@ -2004,15 +2009,20 @@ static int mm_swap_open(struct inode *inode, struct file *file) } mm = proc_mem_open(inode, PTRACE_MODE_READ); - if (IS_ERR(mm)) + if (IS_ERR(mm)) { + module_put(module); return PTR_ERR(mm); + } file->private_data = mm; if (proc_swap_pages_operations.open) - return proc_swap_pages_operations.open(inode, file); + ret = proc_swap_pages_operations.open(inode, file); - return 0; + if (ret != 0) + module_put(module); + + return ret; } static int mm_swap_release(struct inode *inode, struct file *file) -- 2.33.0