mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

futex: fix reference leak 

Catalin noticed that (38d47c1b7075: futex: rely on get_user_pages() for
shared futexes) caused an mm_struct leak.

Some tracing with the function graph tracer quickly pointed out that
futex_wait() has exit paths with unbalanced reference counts.

This regression was discovered by kmemleak.

Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Tested-by: "Pallipadi, Venkatesh" <venkatesh.pallipadi@intel.com>
Tested-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
This commit is contained in:
Peter Zijlstra 2009-02-11 18:10:10 +01:00 committed by Ingo Molnar
parent 6c6f1f0f4d
commit 2fff78c784
1 changed files with 27 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
kernel/futex.c
View File

@ -1165,6 +1165,7 @@ static int futex_wait(u32 __user *uaddr, int fshared,
u32 val, ktime_t *abs_time, u32 bitset, int clockrt) u32 val, ktime_t *abs_time, u32 bitset, int clockrt)
{ {
struct task_struct *curr = current; struct task_struct *curr = current;
struct restart_block *restart;
DECLARE_WAITQUEUE(wait, curr); DECLARE_WAITQUEUE(wait, curr);
struct futex_hash_bucket *hb; struct futex_hash_bucket *hb;
struct futex_q q; struct futex_q q;
@ -1216,11 +1217,13 @@ retry:
if (!ret) if (!ret)
goto retry; goto retry;
return ret; goto out;
} }
ret = -EWOULDBLOCK; ret = -EWOULDBLOCK;
if (uval != val) if (unlikely(uval != val)) {
goto out_unlock_put_key; queue_unlock(&q, hb);
goto out_put_key;
}
/* Only actually queue if *uaddr contained val. */ /* Only actually queue if *uaddr contained val. */
queue_me(&q, hb); queue_me(&q, hb);
@ -1284,38 +1287,38 @@ retry:
*/ */
/* If we were woken (and unqueued), we succeeded, whatever. */ /* If we were woken (and unqueued), we succeeded, whatever. */
ret = 0;
if (!unqueue_me(&q)) if (!unqueue_me(&q))
return 0; goto out_put_key;
ret = -ETIMEDOUT;
if (rem) if (rem)
return -ETIMEDOUT; goto out_put_key;
/* /*
* We expect signal_pending(current), but another thread may * We expect signal_pending(current), but another thread may
* have handled it for us already. * have handled it for us already.
*/ */
ret = -ERESTARTSYS;
if (!abs_time) if (!abs_time)
return -ERESTARTSYS; goto out_put_key;
else {
struct restart_block *restart;
restart = &current_thread_info()->restart_block;
restart->fn = futex_wait_restart;
restart->futex.uaddr = (u32 *)uaddr;
restart->futex.val = val;
restart->futex.time = abs_time->tv64;
restart->futex.bitset = bitset;
restart->futex.flags = 0;
if (fshared) restart = &current_thread_info()->restart_block;
restart->futex.flags |= FLAGS_SHARED; restart->fn = futex_wait_restart;
if (clockrt) restart->futex.uaddr = (u32 *)uaddr;
restart->futex.flags |= FLAGS_CLOCKRT; restart->futex.val = val;
return -ERESTART_RESTARTBLOCK; restart->futex.time = abs_time->tv64;
} restart->futex.bitset = bitset;
restart->futex.flags = 0;
out_unlock_put_key: if (fshared)
queue_unlock(&q, hb); restart->futex.flags |= FLAGS_SHARED;
if (clockrt)
restart->futex.flags |= FLAGS_CLOCKRT;
ret = -ERESTART_RESTARTBLOCK;
out_put_key:
put_futex_key(fshared, &q.key); put_futex_key(fshared, &q.key);
out: out:
return ret; return ret;
} }