aboutsummaryrefslogtreecommitdiff
path: root/kernel/watch_queue.c
diff options
context:
space:
mode:
authorGravatar David Howells <dhowells@redhat.com> 2022-03-11 13:23:46 +0000
committerGravatar Linus Torvalds <torvalds@linux-foundation.org> 2022-03-11 10:17:12 -0800
commitc1853fbadcba1497f4907971e7107888e0714c81 (patch)
tree5c264ab6f12882ea260bfe11bc87fc1c3e2ab8fe /kernel/watch_queue.c
parentwatch_queue, pipe: Free watchqueue state after clearing pipe ring (diff)
downloadlinux-c1853fbadcba1497f4907971e7107888e0714c81.tar.gz
linux-c1853fbadcba1497f4907971e7107888e0714c81.tar.bz2
linux-c1853fbadcba1497f4907971e7107888e0714c81.zip
watch_queue: Fix to release page in ->release()
When a pipe ring descriptor points to a notification message, the refcount on the backing page is incremented by the generic get function, but the release function, which marks the bitmap, doesn't drop the page ref. Fix this by calling generic_pipe_buf_release() at the end of watch_queue_pipe_buf_release(). Fixes: c73be61cede5 ("pipe: Add general notification queue support") Reported-by: Jann Horn <jannh@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel/watch_queue.c')
-rw-r--r--kernel/watch_queue.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c
index 427b0318e303..dfb3a7e28280 100644
--- a/kernel/watch_queue.c
+++ b/kernel/watch_queue.c
@@ -54,6 +54,7 @@ static void watch_queue_pipe_buf_release(struct pipe_inode_info *pipe,
bit += page->index;
set_bit(bit, wqueue->notes_bitmap);
+ generic_pipe_buf_release(pipe, buf);
}
// No try_steal function => no stealing