Bug 121931

And another one which I am not sure we are vulnerable by it.


From: Chris Wright <chrisw@osdl.org>
To: vendor-sec@lst.de
User-Agent: Mutt/1.5.6i
Subject: [vendor-sec] (no subject)
Errors-To: vendor-sec-admin@lst.de
Date: Fri, 7 Oct 2005 15:46:16 -0700

Another memleak in kernel, this time when CONFIG_AUDITSYSCALL is enabled.
This one is upstream and public.

thanks,
-chris
--

From: Linus Torvalds <torvalds@g5.osdl.org>
Date: Fri, 7 Oct 2005 04:54:21 +0000 (-0700)
Subject:     Avoid 'names_cache' memory leak with CONFIG_AUDITSYSCALL
X-Git-Url:
http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=829841146878e082613a49581ae252c071057c23

Avoid 'names_cache' memory leak with CONFIG_AUDITSYSCALL

The nameidata "last.name" is always allocated with "__getname()", and
should always be free'd with "__putname()".

Using "putname()" without the underscores will leak memory, because the
allocation will have been hidden from the AUDITSYSCALL code.

Arguably the real bug is that the AUDITSYSCALL code is really broken,
but in the meantime this fixes the problem people see.

Reported by Robert Derr, patch by Rick Lindsley.

Acked-by: Al Viro <viro@ftp.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---
---

--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1551,19 +1551,19 @@ do_link:
        if (nd->last_type != LAST_NORM)
                goto exit;
        if (nd->last.name[nd->last.len]) {
-               putname(nd->last.name);
+               __putname(nd->last.name);
                goto exit;
        }
        error = -ELOOP;
        if (count++==32) {
-               putname(nd->last.name);
+               __putname(nd->last.name);
                goto exit;
        }
        dir = nd->dentry;
        down(&dir->d_inode->i_sem);
        path.dentry = __lookup_hash(&nd->last, nd->dentry, nd);
        path.mnt = nd->mnt;
-       putname(nd->last.name);
+       __putname(nd->last.name);
        goto do_last;
 }

_______________________________________________