From nobody Fri Jun 19 22:36:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 035E5C433F5 for ; Sun, 27 Mar 2022 15:50:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235898AbiC0Pvk (ORCPT ); Sun, 27 Mar 2022 11:51:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38280 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234251AbiC0Pvi (ORCPT ); Sun, 27 Mar 2022 11:51:38 -0400 Received: from sender4-of-o53.zoho.com (sender4-of-o53.zoho.com [136.143.188.53]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E04E2656F for ; Sun, 27 Mar 2022 08:49:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1648396192; cv=none; d=zohomail.com; s=zohoarc; b=RcvQOByGXY1unKdCDaOAC1LXz+mMzM43DKPB5bsS7he8xMlBOQ9iftL4k8yCob8vJvJqWzZxyHwpFBbNz3Ao/PQy/BGCPhEWO51iydLTr5wnr5Fm9leoZxuFUa/Pl+PYyzcDPhqTshv51XfZgb7pMKo4MdTjcth/9nirZjCADfk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1648396192; h=Content-Transfer-Encoding:Cc:Date:From:MIME-Version:Message-ID:Subject:To; bh=8ryXOoKRSeSj62X041ZptO6D0BqyP7/awmvCaEC3goQ=; b=Tg2GYmu667sTaIw7UUNqpS36/3Jdmgfl33zsLJU3BpOw97jipJ0Nto1TyQJodAaOGk3i/nnC2mPRSDRwC6iI9JomeAXo8tbeNU1I87TKe0vOflLac4r1f/UTCVITMcf7TFRpUFFgJda9LILqCC+9e5/GD6Gqkrnp/CX5HJYrm4E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=anirudhrb.com; spf=pass smtp.mailfrom=mail@anirudhrb.com; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1648396192; s=zoho; d=anirudhrb.com; i=mail@anirudhrb.com; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Message-Id:Message-Id:MIME-Version:Content-Transfer-Encoding:Reply-To; bh=8ryXOoKRSeSj62X041ZptO6D0BqyP7/awmvCaEC3goQ=; b=NKaXLtVA0nzqNngOwmr9FKIYWnsCiFxPqCU78hC0eXc8NGKqxYwIKWnu9IHEu7sj 0NWAlK3Gtq72gptaxHS2AZkaDpBGxTES+reSup/uQA0NWbeRl/ZDiX9Kc9TAIpuiSjE x/f5b/Idr7FN6++AKJZQHevU9Awms/+C6bU1y2Do= Received: from localhost.localdomain (49.207.212.179 [49.207.212.179]) by mx.zohomail.com with SMTPS id 1648396189292143.7738007891578; Sun, 27 Mar 2022 08:49:49 -0700 (PDT) From: Anirudh Rayabharam To: David Howells , Anirudh Rayabharam , Christophe JAILLET , "Fabio M. De Francesco" Cc: syzbot+25ea042ae28f3888727a@syzkaller.appspotmail.com, linux-kernel@vger.kernel.org Subject: [PATCH] watch_queue: free the notes array Date: Sun, 27 Mar 2022 21:19:33 +0530 Message-Id: <20220327154936.9353-1-mail@anirudhrb.com> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" __put_watch_queue() frees the individual notifications but doesn't free the notes array itself causing a memory leak. Reported by syzbot at: https://syzkaller.appspot.com/bug?extid=3D25ea042ae28f3888727a Fix by adding a kfree(). Fixes: c73be61cede5 ("pipe: Add general notification queue support") Reported-by: syzbot+25ea042ae28f3888727a@syzkaller.appspotmail.com Tested-by: syzbot+25ea042ae28f3888727a@syzkaller.appspotmail.com Signed-off-by: Anirudh Rayabharam --- kernel/watch_queue.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c index 3990e4df3d7b..230038d4f908 100644 --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -370,6 +370,7 @@ static void __put_watch_queue(struct kref *kref) =20 for (i =3D 0; i < wqueue->nr_pages; i++) __free_page(wqueue->notes[i]); + kfree(wqueue->notes); bitmap_free(wqueue->notes_bitmap); =20 wfilter =3D rcu_access_pointer(wqueue->filter); --=20 2.35.1