From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S932968AbdCGSCz (ORCPT <rfc822;w@1wt.eu>);
        Tue, 7 Mar 2017 13:02:55 -0500
Received: from merlin.infradead.org ([205.233.59.134]:59108 "EHLO
        merlin.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1755020AbdCGSCq (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 7 Mar 2017 13:02:46 -0500
Date: Tue, 7 Mar 2017 19:01:58 +0100
From: Peter Zijlstra <peterz@infradead.org>
To: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Thomas Gleixner <tglx@linutronix.de>, mingo@kernel.org,
        juri.lelli@arm.com, rostedt@goodmis.org, xlpang@redhat.com,
        linux-kernel@vger.kernel.org, mathieu.desnoyers@efficios.com,
        jdesfossez@efficios.com, bristot@redhat.com, dvhart@infradead.org
Subject: Re: [PATCH -v5 07/14] futex: Change locking rules
Message-ID: <20170307180158.GG3312@twins.programming.kicks-ass.net>
References: <20170304092717.762954142@infradead.org>
 <20170304093559.216725723@infradead.org>
 <alpine.DEB.2.20.1703071419290.3584@nanos>
 <20170307164743.grb6v4lcpfzbpb5i@linutronix.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20170307164743.grb6v4lcpfzbpb5i@linutronix.de>
User-Agent: Mutt/1.5.23.1 (2014-03-12)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Mar 07, 2017 at 05:47:44PM +0100, Sebastian Andrzej Siewior wrote:
> On 2017-03-07 14:22:14 [+0100], Thomas Gleixner wrote:
> > Both 'return' statements leak &pi_state->pi_mutex.wait_lock ....
> 
> this has unlock in both 'return's.

>  handle_fault:
> +	raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
>  	spin_unlock(q->lock_ptr);
>  
>  	ret = fault_in_user_writeable(uaddr);
>  
>  	spin_lock(q->lock_ptr);
> +	raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
>  
>  	/*
>  	 * Check if someone else fixed it for us:
>  	 */
> -	if (pi_state->owner != oldowner)
> +	if (pi_state->owner != oldowner) {
> +		raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
>  		return 0;
> +	}
>  
> -	if (ret)
> +	if (ret) {
> +		raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
>  		return ret;
> +	}
>  
>  	goto retry;
>  }

I had locally already fixed it with a common:

out_unlock:
  raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
  return ret;