• Siddh Raman Pant's avatar
    watch_queue: prevent dangling pipe pointer · 943211c8
    Siddh Raman Pant authored
    NULL the dangling pipe reference while clearing watch_queue.
    
    If not done, a reference to a freed pipe remains in the watch_queue,
    as this function is called before freeing a pipe in free_pipe_info()
    (see line 834 of fs/pipe.c).
    
    The sole use of wqueue->defunct is for checking if the watch queue has
    been cleared, but wqueue->pipe is also NULLed while clearing.
    
    Thus, wqueue->defunct is superfluous, as wqueue->pipe can be checked
    for NULL. Hence, the former can be removed.
    
    Tested with keyutils testsuite.
    
    Cc: stable@vger.kernel.org # 6.1
    Signed-off-by: default avatarSiddh Raman Pant <code@siddh.me>
    Acked-by: default avatarDavid Howells <dhowells@redhat.com>
    Message-Id: <20230605143616.640517-1-code@siddh.me>
    Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
    943211c8
watch_queue.c 17.2 KB