Commit ba719bae authored by Ulrich Drepper's avatar Ulrich Drepper Committed by Linus Torvalds

sys_pipe(): fix file descriptor leaks

Remember to close the files if copy_to_user() failed.

Spotted by dm.n9107@gmail.com.
Signed-off-by: default avatarUlrich Drepper <drepper@redhat.com>
Cc: DM <dm.n9107@gmail.com>
Cc: <stable@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent c1236d31
...@@ -40,8 +40,11 @@ asmlinkage int sys_pipe(unsigned long __user * fildes) ...@@ -40,8 +40,11 @@ asmlinkage int sys_pipe(unsigned long __user * fildes)
error = do_pipe(fd); error = do_pipe(fd);
unlock_kernel(); unlock_kernel();
if (!error) { if (!error) {
if (copy_to_user(fildes, fd, 2*sizeof(int))) if (copy_to_user(fildes, fd, 2*sizeof(int))) {
sys_close(fd[0]);
sys_close(fd[1]);
error = -EFAULT; error = -EFAULT;
}
} }
return error; return error;
} }
......
...@@ -90,8 +90,11 @@ sys_pipe(unsigned long r0, unsigned long r1, unsigned long r2, ...@@ -90,8 +90,11 @@ sys_pipe(unsigned long r0, unsigned long r1, unsigned long r2,
error = do_pipe(fd); error = do_pipe(fd);
if (!error) { if (!error) {
if (copy_to_user((void __user *)r0, fd, 2*sizeof(int))) if (copy_to_user((void __user *)r0, fd, 2*sizeof(int))) {
sys_close(fd[0]);
sys_close(fd[1]);
error = -EFAULT; error = -EFAULT;
}
} }
return error; return error;
} }
......
...@@ -17,6 +17,7 @@ ...@@ -17,6 +17,7 @@
#include <linux/highmem.h> #include <linux/highmem.h>
#include <linux/pagemap.h> #include <linux/pagemap.h>
#include <linux/audit.h> #include <linux/audit.h>
#include <linux/syscalls.h>
#include <asm/uaccess.h> #include <asm/uaccess.h>
#include <asm/ioctls.h> #include <asm/ioctls.h>
...@@ -1086,8 +1087,11 @@ asmlinkage long __weak sys_pipe(int __user *fildes) ...@@ -1086,8 +1087,11 @@ asmlinkage long __weak sys_pipe(int __user *fildes)
error = do_pipe(fd); error = do_pipe(fd);
if (!error) { if (!error) {
if (copy_to_user(fildes, fd, sizeof(fd))) if (copy_to_user(fildes, fd, sizeof(fd))) {
sys_close(fd[0]);
sys_close(fd[1]);
error = -EFAULT; error = -EFAULT;
}
} }
return error; return error;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment