Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
To:     <viro@zeniv.linux.org.uk>
From:   Zhiqiang Liu <liuzhiqiang26@huawei.com>
CC:     <linux-fsdevel@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        <cai@redhat.com>
Subject: [PATCH] pipe: fix potential inode leak in create_pipe_files()
Message-ID: <779f767d-c08b-0c03-198e-06270100d529@huawei.com>
Date:   Wed, 28 Oct 2020 11:03:52 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.2.2
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk


In create_pipe_files(), if alloc_file_clone() fails, we will call
put_pipe_info to release pipe, and call fput() to release f.
However, we donot call iput() to free inode.

Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Signed-off-by: Feilong Lin <linfeilong@huawei.com>
---
 fs/pipe.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/pipe.c b/fs/pipe.c
index 0ac197658a2d..8856607fde65 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -924,6 +924,7 @@ int create_pipe_files(struct file **res, int flags)
 	if (IS_ERR(res[0])) {
 		put_pipe_info(inode, inode->i_pipe);
 		fput(f);
+		iput(inode);
 		return PTR_ERR(res[0]);
 	}
 	res[0]->private_data = inode->i_pipe;
-- 
2.19.1