From: David Howells <dhowells@xxxxxxxxxx> commit 7ea1a0124b6da246b5bc8c66cddaafd36acf3ecb upstream. Free the watch_queue note allocation bitmap when the watch_queue is destroyed. Fixes: c73be61cede5 ("pipe: Add general notification queue support") Reported-by: Jann Horn <jannh@xxxxxxxxxx> Signed-off-by: David Howells <dhowells@xxxxxxxxxx> Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- kernel/watch_queue.c | 1 + 1 file changed, 1 insertion(+) --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -373,6 +373,7 @@ static void __put_watch_queue(struct kre for (i = 0; i < wqueue->nr_pages; i++) __free_page(wqueue->notes[i]); + bitmap_free(wqueue->notes_bitmap); wfilter = rcu_access_pointer(wqueue->filter); if (wfilter) Patches currently in stable-queue which might be from dhowells@xxxxxxxxxx are queue-5.16/watch_queue-fix-lack-of-barrier-sync-lock-between-post-and-read.patch queue-5.16/watch_queue-pipe-free-watchqueue-state-after-clearing-pipe-ring.patch queue-5.16/watch_queue-make-comment-about-setting-defunct-more-accurate.patch queue-5.16/watch_queue-fix-the-alloc-bitmap-size-to-reflect-notes-allocated.patch queue-5.16/watch_queue-free-the-alloc-bitmap-when-the-watch_queue-is-torn-down.patch queue-5.16/watch_queue-fix-to-always-request-a-pow-of-2-pipe-ring-size.patch queue-5.16/watch_queue-fix-filter-limit-check.patch queue-5.16/watch_queue-fix-to-release-page-in-release.patch