mainline inclusion

from mainline-5.10
commit db803036ada7 ("umh: fix memory leak on execve failure")
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8J9MA
CVE: NA

-------------------------------------------------

If a UMH process created by fork_usermode_blob() fails to execute,
a pair of struct file allocated by umh_pipe_setup() will leak.

Under normal conditions, the caller (like bpfilter) needs to manage the
lifetime of the UMH and its two pipes. But when fork_usermode_blob()
fails, the caller doesn't really have a way to know what needs to be
done. It seems better to do the cleanup ourselves in this case.

Fixes: 449325b52b7a ("umh: introduce fork_usermode_blob() helper")
Signed-off-by: Vincent Minet <v.minet@criteo.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Wenyu Huang <huangwenyu5@huawei.com>
---
 kernel/umh.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/kernel/umh.c b/kernel/umh.c
index 53611efb10cb..715b4368f9ed 100644
--- a/kernel/umh.c
+++ b/kernel/umh.c
@@ -495,6 +495,12 @@ static void umh_clean_and_save_pid(struct subprocess_info *info)
 {
 	struct umh_info *umh_info = info->data;
 
+	/* cleanup if umh_pipe_setup() was successful but exec failed */
+	if (info->pid && info->retval) {
+		fput(umh_info->pipe_to_umh);
+		fput(umh_info->pipe_from_umh);
+	}
+
 	argv_free(info->argv);
 	umh_info->pid = info->pid;
 }
-- 
2.34.1

_______________________________________________
Kernel mailing list -- kernel@openeuler.org
To unsubscribe send an email to kernel-leave@openeuler.org