futex: fix reference leak (2fff78c7) · Commits · 戴 / test

kernel/futex.c

+28 −25

Original line number	Diff line number	Diff line
		@@ -1165,6 +1165,7 @@ static int futex_wait(u32 __user *uaddr, int fshared,
		u32 val, ktime_t *abs_time, u32 bitset, int clockrt)
		{
		struct task_struct *curr = current;
		struct restart_block *restart;
		DECLARE_WAITQUEUE(wait, curr);
		struct futex_hash_bucket *hb;
		struct futex_q q;
		@@ -1216,11 +1217,13 @@ retry:

		if (!ret)
		goto retry;
		return ret;
		goto out;
		}
		ret = -EWOULDBLOCK;
		if (uval != val)
		goto out_unlock_put_key;
		if (unlikely(uval != val)) {
		queue_unlock(&q, hb);
		goto out_put_key;
		}

		/* Only actually queue if uaddr contained val. /
		queue_me(&q, hb);
		@@ -1284,19 +1287,21 @@ retry:
		*/

		/* If we were woken (and unqueued), we succeeded, whatever. */
		ret = 0;
		if (!unqueue_me(&q))
		return 0;
		goto out_put_key;
		ret = -ETIMEDOUT;
		if (rem)
		return -ETIMEDOUT;
		goto out_put_key;

		/*
		* We expect signal_pending(current), but another thread may
		* have handled it for us already.
		*/
		ret = -ERESTARTSYS;
		if (!abs_time)
		return -ERESTARTSYS;
		else {
		struct restart_block *restart;
		goto out_put_key;

		restart = &current_thread_info()->restart_block;
		restart->fn = futex_wait_restart;
		restart->futex.uaddr = (u32 *)uaddr;
		@@ -1309,13 +1314,11 @@ retry:
		restart->futex.flags \|= FLAGS_SHARED;
		if (clockrt)
		restart->futex.flags \|= FLAGS_CLOCKRT;
		return -ERESTART_RESTARTBLOCK;
		}

		out_unlock_put_key:
		queue_unlock(&q, hb);
		put_futex_key(fshared, &q.key);
		ret = -ERESTART_RESTARTBLOCK;

		out_put_key:
		put_futex_key(fshared, &q.key);
		out:
		return ret;
		}