userfaultfd: add missing mmput() in error path

Orabug: 21685254

This fixes a memleak if anon_inode_getfile() fails in userfaultfd().

Signed-off-by: Eric Biggers <ebiggers3@gmail.com>
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit c03e946fdd653c4a23e242aca83da7e9838f5b00)
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Dhaval Giani <dhaval.giani@oracle.com>
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 15245e595be660a5f3a95e44c60e517ccfa195b1..50311703135bc8c699bcc3d26d0b9aa24b5277f3 100644 (file)
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1287,8 +1287,10 @@ static struct file *userfaultfd_file_create(int flags)
 
        file = anon_inode_getfile("[userfaultfd]", &userfaultfd_fops, ctx,
                                  O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS));
-       if (IS_ERR(file))
+       if (IS_ERR(file)) {
+               mmput(ctx->mm);
                kmem_cache_free(userfaultfd_ctx_cachep, ctx);
+       }
 out:
        return file;
 }