From: David Howells <dhowells@xxxxxxxxxx> commit c1853fbadcba1497f4907971e7107888e0714c81 upstream. When a pipe ring descriptor points to a notification message, the refcount on the backing page is incremented by the generic get function, but the release function, which marks the bitmap, doesn't drop the page ref. Fix this by calling generic_pipe_buf_release() at the end of watch_queue_pipe_buf_release(). Fixes: c73be61cede5 ("pipe: Add general notification queue support") Reported-by: Jann Horn <jannh@xxxxxxxxxx> Signed-off-by: David Howells <dhowells@xxxxxxxxxx> Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- kernel/watch_queue.c | 1 + 1 file changed, 1 insertion(+) --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -54,6 +54,7 @@ static void watch_queue_pipe_buf_release bit += page->index; set_bit(bit, wqueue->notes_bitmap); + generic_pipe_buf_release(pipe, buf); } // No try_steal function => no stealing Patches currently in stable-queue which might be from dhowells@xxxxxxxxxx are queue-5.16/watch_queue-fix-lack-of-barrier-sync-lock-between-post-and-read.patch queue-5.16/watch_queue-pipe-free-watchqueue-state-after-clearing-pipe-ring.patch queue-5.16/watch_queue-make-comment-about-setting-defunct-more-accurate.patch queue-5.16/watch_queue-fix-the-alloc-bitmap-size-to-reflect-notes-allocated.patch queue-5.16/watch_queue-free-the-alloc-bitmap-when-the-watch_queue-is-torn-down.patch queue-5.16/watch_queue-fix-to-always-request-a-pow-of-2-pipe-ring-size.patch queue-5.16/watch_queue-fix-filter-limit-check.patch queue-5.16/watch_queue-fix-to-release-page-in-release.patch