lkml.org 
[lkml]   [2022]   [Mar]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Subject[PATCH 0/2] watch_queue: A couple more fixes
From
Date

Hi Linus,

Here are fixes for a couple more watch_queue bugs, both found by syzbot:

(1) Fix error cleanup in watch_queue_set_size() where it tries to clean up
all the pointers in the page list, even if they've not been allocated
yet[1]. Unfortunately, __free_page() doesn't treat a NULL pointer as
being "do nothing".

A second report[2] looks like it's probably the same bug, but on arm64
rather than x86_64, but there's no reproducer.

(2) Fix a missing kfree in free_watch() to actually free the watch[3].

Both have syzbot reproducers.

The fixes are also available through git:

https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-fixes

David

Link: https://lore.kernel.org/r/000000000000b1807c05daad8f98@google.com/ [1]
Link: https://lore.kernel.org/r/000000000000035b9c05daae8a5e@google.com/ [2]
Link: https://lore.kernel.org/r/000000000000bc8eaf05dab91c63@google.com/ [3]
---
David Howells (2):
watch_queue: Fix NULL dereference in error cleanup
watch_queue: Actually free the watch


kernel/watch_queue.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)


\
 
 \ /
  Last update: 2022-03-21 14:01    [W:0.062 / U:0.412 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site