Commit 94cd8fa0 authored by Mathieu Desnoyers's avatar Mathieu Desnoyers Committed by Peter Zijlstra
Browse files

futex: Fix futex_waitv() hrtimer debug object leak on kcalloc error 



In a scenario where kcalloc() fails to allocate memory, the futex_waitv
system call immediately returns -ENOMEM without invoking
destroy_hrtimer_on_stack(). When CONFIG_DEBUG_OBJECTS_TIMERS=y, this
results in leaking a timer debug object.

Fixes: bf69bad3 ("futex: Implement sys_futex_waitv()")
Signed-off-by: default avatarMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: default avatarDavidlohr Bueso <dave@stgolabs.net>
Cc: stable@vger.kernel.org
Cc: stable@vger.kernel.org # v5.16+
Link: https://lore.kernel.org/r/20221214222008.200393-1-mathieu.desnoyers@efficios.com
parent 1c0908d8

kernel/futex/syscalls.c

+7 −4
Original line number Original line Diff line number Diff line
@@ -286,19 +286,22 @@ SYSCALL_DEFINE5(futex_waitv, struct futex_waitv __user *, waiters, 
	}

	}





	futexv = kcalloc(nr_futexes, sizeof(*futexv), GFP_KERNEL);

	futexv = kcalloc(nr_futexes, sizeof(*futexv), GFP_KERNEL);

	if (!futexv)

	if (!futexv) {

		return -ENOMEM;

		ret = -ENOMEM;

		goto destroy_timer;

	}





	ret = futex_parse_waitv(futexv, waiters, nr_futexes);

	ret = futex_parse_waitv(futexv, waiters, nr_futexes);

	if (!ret)

	if (!ret)

		ret = futex_wait_multiple(futexv, nr_futexes, timeout ? &to : NULL);

		ret = futex_wait_multiple(futexv, nr_futexes, timeout ? &to : NULL);





	kfree(futexv);



destroy_timer:

	if (timeout) {

	if (timeout) {

		hrtimer_cancel(&to.timer);

		hrtimer_cancel(&to.timer);

		destroy_hrtimer_on_stack(&to.timer);

		destroy_hrtimer_on_stack(&to.timer);

	}

	}



	kfree(futexv);

	return ret;

	return ret;

}

}