From: David Howells <dhowells@xxxxxxxxxx>
commit 7ea1a0124b6da246b5bc8c66cddaafd36acf3ecb upstream.
Free the watch_queue note allocation bitmap when the watch_queue is
destroyed.
Fixes: c73be61cede5 ("pipe: Add general notification queue support")
Reported-by: Jann Horn <jannh@xxxxxxxxxx>
Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
kernel/watch_queue.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/watch_queue.c
+++ b/kernel/watch_queue.c
@@ -373,6 +373,7 @@ static void __put_watch_queue(struct kre
for (i = 0; i < wqueue->nr_pages; i++)
__free_page(wqueue->notes[i]);
+ bitmap_free(wqueue->notes_bitmap);
wfilter = rcu_access_pointer(wqueue->filter);
if (wfilter)
Patches currently in stable-queue which might be from dhowells@xxxxxxxxxx are
queue-5.16/watch_queue-fix-lack-of-barrier-sync-lock-between-post-and-read.patch
queue-5.16/watch_queue-pipe-free-watchqueue-state-after-clearing-pipe-ring.patch
queue-5.16/watch_queue-make-comment-about-setting-defunct-more-accurate.patch
queue-5.16/watch_queue-fix-the-alloc-bitmap-size-to-reflect-notes-allocated.patch
queue-5.16/watch_queue-free-the-alloc-bitmap-when-the-watch_queue-is-torn-down.patch
queue-5.16/watch_queue-fix-to-always-request-a-pow-of-2-pipe-ring-size.patch
queue-5.16/watch_queue-fix-filter-limit-check.patch
queue-5.16/watch_queue-fix-to-release-page-in-release.patch
