linux

History

Eric Dumazet b490207017 watch_queue: Free the page array when watch_queue is dismantled Commit `7ea1a0124b` ("watch_queue: Free the alloc bitmap when the watch_queue is torn down") took care of the bitmap, but not the page array. BUG: memory leak unreferenced object 0xffff88810d9bc140 (size 32): comm "syz-executor335", pid 3603, jiffies 4294946994 (age 12.840s) hex dump (first 32 bytes): 40 a7 40 04 00 ea ff ff 00 00 00 00 00 00 00 00 @.@............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: kmalloc_array include/linux/slab.h:621 [inline] kcalloc include/linux/slab.h:652 [inline] watch_queue_set_size+0x12f/0x2e0 kernel/watch_queue.c:251 pipe_ioctl+0x82/0x140 fs/pipe.c:632 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] Reported-by: syzbot+25ea042ae28f3888727a@syzkaller.appspotmail.com Fixes: `c73be61ced` ("pipe: Add general notification queue support") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Cc: Jann Horn <jannh@google.com> Link: https://lore.kernel.org/r/20220322004654.618274-1-eric.dumazet@gmail.com/ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2022-04-02 10:37:39 -07:00
..
bpf	bpf: Fix maximum permitted number of arguments check	2022-03-28 19:08:17 -07:00
cgroup	…
configs	…
debug	…
dma	dma-mapping updates for Linux 5.18	2022-03-29 08:50:14 -07:00
entry	ptrace: Cleanups for v5.18	2022-03-28 17:29:53 -07:00
events	…
futex	…
gcov	…
irq	…
kcsan	…
livepatch	ptrace: Cleanups for v5.18	2022-03-28 17:29:53 -07:00
locking	…
power	…
printk	…
rcu	…
sched	ptrace: Cleanups for v5.18	2022-03-28 17:29:53 -07:00
time	ptrace: Cleanups for v5.18	2022-03-28 17:29:53 -07:00
trace	tracing: mark user_events as BROKEN	2022-04-02 10:32:14 -07:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	…
Kconfig.preempt	…
Makefile	kprobes: Use rethook for kretprobe if possible	2022-03-28 19:38:09 -07:00
acct.c	…
async.c	…
audit.c	…
audit.h	…
audit_fsnotify.c	…
audit_tree.c	…
audit_watch.c	…
auditfilter.c	…
auditsc.c	…
backtracetest.c	…
bounds.c	…
capability.c	…
cfi.c	…
compat.c	…
configs.c	…
context_tracking.c	…
cpu.c	…
cpu_pm.c	…
crash_core.c	…
crash_dump.c	…
cred.c	…
delayacct.c	…
dma.c	…
exec_domain.c	…
exit.c	ptrace: Cleanups for v5.18	2022-03-28 17:29:53 -07:00
extable.c	…
fail_function.c	…
fork.c	…
freezer.c	…
gen_kheaders.sh	…
groups.c	…
hung_task.c	…
iomem.c	…
irq_work.c	…
jump_label.c	…
kallsyms.c	…
kcmp.c	…
kcov.c	…
kexec.c	…
kexec_core.c	…
kexec_elf.c	…
kexec_file.c	…
kexec_internal.h	…
kheaders.c	…
kmod.c	…
kprobes.c	kprobes: Use rethook for kretprobe if possible	2022-03-28 19:38:09 -07:00
ksysfs.c	…
kthread.c	…
latencytop.c	…
module-internal.h	…
module.c	…
module_decompress.c	…
module_signature.c	…
module_signing.c	…
notifier.c	…
nsproxy.c	…
padata.c	…
panic.c	…
params.c	…
pid.c	…
pid_namespace.c	…
profile.c	…
ptrace.c	…
range.c	…
reboot.c	…
regset.c	…
relay.c	…
resource.c	…
resource_kunit.c	…
rseq.c	…
scftorture.c	…
scs.c	…
seccomp.c	ptrace: Cleanups for v5.18	2022-03-28 17:29:53 -07:00
signal.c	ptrace: Cleanups for v5.18	2022-03-28 17:29:53 -07:00
smp.c	…
smpboot.c	…
smpboot.h	…
softirq.c	…
stackleak.c	…
stacktrace.c	…
static_call.c	…
stop_machine.c	…
sys.c	…
sys_ni.c	…
sysctl-test.c	…
sysctl.c	…
task_work.c	…
taskstats.c	…
torture.c	…
tracepoint.c	…
tsacct.c	…
ucount.c	…
uid16.c	…
uid16.h	…
umh.c	…
up.c	…
user-return-notifier.c	…
user.c	…
user_namespace.c	…
usermode_driver.c	…
utsname.c	…
utsname_sysctl.c	…
watch_queue.c	watch_queue: Free the page array when watch_queue is dismantled	2022-04-02 10:37:39 -07:00
watchdog.c	…
watchdog_hld.c	…
workqueue.c	…
workqueue_internal.h	…