From 5360edb9c7f60bc8409fa0ae66193a05fc8fd834 Mon Sep 17 00:00:00 2001 From: Matheus Date: Fri, 9 Oct 2026 02:11:50 -0300 Subject: [PATCH] pipe2: properly clean up vnode references on error Currently, pipe2 both closes the fds and releases references to the pipe vnode on failure. However, closing the fds already causes the vnode references to be dropped. Make pipe2 only release the vnode references when the respective file_t were not closed. Found by syzkaller fuzzing. --- kernel-src/sys/syscalls/pipe2.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/kernel-src/sys/syscalls/pipe2.c b/kernel-src/sys/syscalls/pipe2.c index 761063d5..71376aad 100644 --- a/kernel-src/sys/syscalls/pipe2.c +++ b/kernel-src/sys/syscalls/pipe2.c @@ -52,22 +52,18 @@ syscallret_t syscall_pipe2(context_t *, int flags) { ret.ret = (uint64_t)readfd | ((uint64_t)writefd << 32); return ret; - error: - if (readfile) { fd_release(readfile); fd_close(readfd); + } else if (node) { + VOP_RELEASE(node); } if (writefile) { fd_release(writefile); fd_close(writefd); - } - - if (node) { - // released twice because of two holds (one at pipefs_newpipe and the manual hold) - VOP_RELEASE(node); + } if (node) { VOP_RELEASE(node); }