diff options
| author | Frank Dinoff <fdinoff@google.com> | 2022-07-26 15:49:01 -0400 |
|---|---|---|
| committer | Nikolaus Rath <Nikolaus@rath.org> | 2022-09-08 10:49:37 +0100 |
| commit | 9e1601add411511c94527f6f7f6f071729b0c52c (patch) | |
| tree | 34d11cbf1dd124b62a09a4a83718401301264702 | |
| parent | 8de32bc3c52da74b82755c8fd6973919997408fe (diff) | |
| download | fuse-9e1601add411511c94527f6f7f6f071729b0c52c.tar.gz | |
Use destroy_req instead of free to destroy fuse_req
If we get the interrupt before the fuse op, the fuse_req is deleted without
decrementing the refcount on the cloned file descriptor. This leads to a
leak of the cloned /dev/fuse file descriptor.
| -rw-r--r-- | lib/fuse_lowlevel.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/fuse_lowlevel.c b/lib/fuse_lowlevel.c index e5de2a5..e82cd9e 100644 --- a/lib/fuse_lowlevel.c +++ b/lib/fuse_lowlevel.c @@ -1762,7 +1762,9 @@ static struct fuse_req *check_interrupt(struct fuse_session *se, if (curr->u.i.unique == req->unique) { req->interrupted = 1; list_del_req(curr); - free(curr); + fuse_chan_put(curr->ch); + curr->ch = NULL; + destroy_req(curr); return NULL; } } |