From: Vincent Minet v.minet@criteo.com

mainline inclusion from mainline-v5.10-rc1 commit db803036ada7d61d096783726f9771b3fc540370 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8J9MA CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

-------------------------------------------------

If a UMH process created by fork_usermode_blob() fails to execute, a pair of struct file allocated by umh_pipe_setup() will leak.

Under normal conditions, the caller (like bpfilter) needs to manage the lifetime of the UMH and its two pipes. But when fork_usermode_blob() fails, the caller doesn't really have a way to know what needs to be done. It seems better to do the cleanup ourselves in this case.

Fixes: 449325b52b7a ("umh: introduce fork_usermode_blob() helper") Signed-off-by: Vincent Minet v.minet@criteo.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Wenyu Huang huangwenyu5@huawei.com --- kernel/umh.c | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/kernel/umh.c b/kernel/umh.c index 53611efb10cb..715b4368f9ed 100644 --- a/kernel/umh.c +++ b/kernel/umh.c @@ -495,6 +495,12 @@ static void umh_clean_and_save_pid(struct subprocess_info *info) { struct umh_info *umh_info = info->data;

+ /* cleanup if umh_pipe_setup() was successful but exec failed */ + if (info->pid && info->retval) { + fput(umh_info->pipe_to_umh); + fput(umh_info->pipe_from_umh); + } + argv_free(info->argv); umh_info->pid = info->pid; }