diff options
| author | Miklos Szeredi <miklos@szeredi.hu> | 2015-11-10 10:32:36 +0100 |
|---|---|---|
| committer | Miklos Szeredi <miklos@szeredi.hu> | 2015-11-10 10:32:36 +0100 |
| commit | 2c5816b4beccc8ba709144539f6fdd764f8fa49c (patch) | |
| tree | b75771d8f86aa341ebdb6af7944380eadf3b6973 | |
| parent | 6a13feb9c82803e2b815eca72fa7a9f5561d7861 (diff) | |
| download | lwn-2c5816b4beccc8ba709144539f6fdd764f8fa49c.tar.gz lwn-2c5816b4beccc8ba709144539f6fdd764f8fa49c.zip | |
cuse: fix memory leak
The problem is that fuse_dev_alloc() acquires an extra reference to cc.fc,
and the original ref count is never dropped.
Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Fixes: cc080e9e9be1 ("fuse: introduce per-instance fuse_dev structure")
Cc: <stable@vger.kernel.org> # v4.2+
| -rw-r--r-- | fs/fuse/cuse.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c index eae2c11268bc..8e3ee1936c7e 100644 --- a/fs/fuse/cuse.c +++ b/fs/fuse/cuse.c @@ -549,6 +549,8 @@ static int cuse_channel_release(struct inode *inode, struct file *file) unregister_chrdev_region(cc->cdev->dev, 1); cdev_del(cc->cdev); } + /* Base reference is now owned by "fud" */ + fuse_conn_put(&cc->fc); rc = fuse_dev_release(inode, file); /* puts the base reference */ |