Commit c1853fba authored by David Howells's avatar David Howells Committed by Linus Torvalds
Browse files

watch_queue: Fix to release page in ->release() 



When a pipe ring descriptor points to a notification message, the
refcount on the backing page is incremented by the generic get function,
but the release function, which marks the bitmap, doesn't drop the page
ref.

Fix this by calling generic_pipe_buf_release() at the end of
watch_queue_pipe_buf_release().

Fixes: c73be61c ("pipe: Add general notification queue support")
Reported-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent db8facfc

kernel/watch_queue.c

+1 −0
Original line number Diff line number Diff line
@@ -54,6 +54,7 @@ static void watch_queue_pipe_buf_release(struct pipe_inode_info *pipe, 
	bit += page->index;



	set_bit(bit, wqueue->notes_bitmap);

	generic_pipe_buf_release(pipe, buf);

}



// No try_steal function => no stealing