Commit 2fff78c7 authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Ingo Molnar

futex: fix reference leak

Catalin noticed that (38d47c1b: futex: rely on get_user_pages() for
shared futexes) caused an mm_struct leak.

Some tracing with the function graph tracer quickly pointed out that
futex_wait() has exit paths with unbalanced reference counts.

This regression was discovered by kmemleak.
Reported-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
Tested-by: default avatar"Pallipadi, Venkatesh" <venkatesh.pallipadi@intel.com>
Tested-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
parent 6c6f1f0f
...@@ -1165,6 +1165,7 @@ static int futex_wait(u32 __user *uaddr, int fshared, ...@@ -1165,6 +1165,7 @@ static int futex_wait(u32 __user *uaddr, int fshared,
u32 val, ktime_t *abs_time, u32 bitset, int clockrt) u32 val, ktime_t *abs_time, u32 bitset, int clockrt)
{ {
struct task_struct *curr = current; struct task_struct *curr = current;
struct restart_block *restart;
DECLARE_WAITQUEUE(wait, curr); DECLARE_WAITQUEUE(wait, curr);
struct futex_hash_bucket *hb; struct futex_hash_bucket *hb;
struct futex_q q; struct futex_q q;
...@@ -1216,11 +1217,13 @@ static int futex_wait(u32 __user *uaddr, int fshared, ...@@ -1216,11 +1217,13 @@ static int futex_wait(u32 __user *uaddr, int fshared,
if (!ret) if (!ret)
goto retry; goto retry;
return ret; goto out;
} }
ret = -EWOULDBLOCK; ret = -EWOULDBLOCK;
if (uval != val) if (unlikely(uval != val)) {
goto out_unlock_put_key; queue_unlock(&q, hb);
goto out_put_key;
}
/* Only actually queue if *uaddr contained val. */ /* Only actually queue if *uaddr contained val. */
queue_me(&q, hb); queue_me(&q, hb);
...@@ -1284,19 +1287,21 @@ static int futex_wait(u32 __user *uaddr, int fshared, ...@@ -1284,19 +1287,21 @@ static int futex_wait(u32 __user *uaddr, int fshared,
*/ */
/* If we were woken (and unqueued), we succeeded, whatever. */ /* If we were woken (and unqueued), we succeeded, whatever. */
ret = 0;
if (!unqueue_me(&q)) if (!unqueue_me(&q))
return 0; goto out_put_key;
ret = -ETIMEDOUT;
if (rem) if (rem)
return -ETIMEDOUT; goto out_put_key;
/* /*
* We expect signal_pending(current), but another thread may * We expect signal_pending(current), but another thread may
* have handled it for us already. * have handled it for us already.
*/ */
ret = -ERESTARTSYS;
if (!abs_time) if (!abs_time)
return -ERESTARTSYS; goto out_put_key;
else {
struct restart_block *restart;
restart = &current_thread_info()->restart_block; restart = &current_thread_info()->restart_block;
restart->fn = futex_wait_restart; restart->fn = futex_wait_restart;
restart->futex.uaddr = (u32 *)uaddr; restart->futex.uaddr = (u32 *)uaddr;
...@@ -1309,13 +1314,11 @@ static int futex_wait(u32 __user *uaddr, int fshared, ...@@ -1309,13 +1314,11 @@ static int futex_wait(u32 __user *uaddr, int fshared,
restart->futex.flags |= FLAGS_SHARED; restart->futex.flags |= FLAGS_SHARED;
if (clockrt) if (clockrt)
restart->futex.flags |= FLAGS_CLOCKRT; restart->futex.flags |= FLAGS_CLOCKRT;
return -ERESTART_RESTARTBLOCK;
}
out_unlock_put_key: ret = -ERESTART_RESTARTBLOCK;
queue_unlock(&q, hb);
put_futex_key(fshared, &q.key);
out_put_key:
put_futex_key(fshared, &q.key);
out: out:
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment