<div dir="ltr">Acked-by: Chenbo Feng <<a href="mailto:fengc@google.com">fengc@google.com</a>><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Dec 26, 2019 at 10:32 PM Cong Wang <<a href="mailto:xiyou.wangcong@gmail.com" target="_blank">xiyou.wangcong@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">dma-buff name can be set via DMA_BUF_SET_NAME ioctl, but once set<br>
it never gets freed.<br>
<br>
Free it in dma_buf_release().<br>
<br>
Fixes: bb2bb9030425 ("dma-buf: add DMA_BUF_SET_NAME ioctls")<br>
Reported-by: <a href="mailto:syzbot%2Bb2098bc44728a4efb3e9@syzkaller.appspotmail.com" target="_blank">syzbot+b2098bc44728a4efb3e9@syzkaller.appspotmail.com</a><br>
Cc: Greg Hackmann <<a href="mailto:ghackmann@google.com" target="_blank">ghackmann@google.com</a>><br>
Cc: Chenbo Feng <<a href="mailto:fengc@google.com" target="_blank">fengc@google.com</a>><br>
Cc: Sumit Semwal <<a href="mailto:sumit.semwal@linaro.org" target="_blank">sumit.semwal@linaro.org</a>><br>
Signed-off-by: Cong Wang <<a href="mailto:xiyou.wangcong@gmail.com" target="_blank">xiyou.wangcong@gmail.com</a>><br>
---<br>
drivers/dma-buf/dma-buf.c | 1 +<br>
1 file changed, 1 insertion(+)<br>
<br>
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c<br>
index ce41cd9b758a..2427398ff22a 100644<br>
--- a/drivers/dma-buf/dma-buf.c<br>
+++ b/drivers/dma-buf/dma-buf.c<br>
@@ -108,6 +108,7 @@ static int dma_buf_release(struct inode *inode, struct file *file)<br>
dma_resv_fini(dmabuf->resv);<br>
<br>
module_put(dmabuf->owner);<br>
+ kfree(dmabuf->name);<br>
kfree(dmabuf);<br>
return 0;<br>
}<br>
-- <br>
2.21.0<br>
<br>
</blockquote></div>