| Message ID | 20230307152106.6899-1-ddiss@suse.de (mailing list archive) |
|---|---|
| State | Mainlined, archived |
| Headers | show |
| Series | [v2] watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths | expand |
From: Christian Brauner (Microsoft) <brauner@kernel.org> On Tue, 07 Mar 2023 16:21:06 +0100, David Disseldorp wrote: > The watch_queue_set_size() allocation error paths return the ret value > set via the prior pipe_resize_ring() call, which will always be zero. > > As a result, IOC_WATCH_QUEUE_SET_SIZE callers such as "keyctl watch" > fail to detect kernel wqueue->notes allocation failures and proceed to > KEYCTL_WATCH_KEY, with any notifications subsequently lost. > > [...] Unless someone got to it before me, I've now picked this up: [1/1] watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths commit: 03e1d60e177eedbd302b77af4ea5e21b5a7ade31 Thanks! Christian
diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c index a6f9bdd956c3..f10f403104e7 100644 --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -273,6 +273,7 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes) if (ret < 0) goto error; + ret = -ENOMEM; pages = kcalloc(sizeof(struct page *), nr_pages, GFP_KERNEL); if (!pages) goto error;
The watch_queue_set_size() allocation error paths return the ret value set via the prior pipe_resize_ring() call, which will always be zero. As a result, IOC_WATCH_QUEUE_SET_SIZE callers such as "keyctl watch" fail to detect kernel wqueue->notes allocation failures and proceed to KEYCTL_WATCH_KEY, with any notifications subsequently lost. Fixes: c73be61cede58 ("pipe: Add general notification queue support") Signed-off-by: David Disseldorp <ddiss@suse.de> --- Version 2: - document "keyctl watch" behaviour with this bug kernel/watch_queue.c | 1 + 1 file changed, 1 insertion(+)