[PATCH v2] watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths

[PATCH v2] watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths

[David Disseldorp]

The watch_queue_set_size() allocation error paths return the ret value
set via the prior pipe_resize_ring() call, which will always be zero.

As a result, IOC_WATCH_QUEUE_SET_SIZE callers such as "keyctl watch"
fail to detect kernel wqueue->notes allocation failures and proceed to
KEYCTL_WATCH_KEY, with any notifications subsequently lost.

Fixes: c73be61cede58 ("pipe: Add general notification queue support")
Signed-off-by: David Disseldorp <ddiss@suse.de>
---
Version 2:
- document "keyctl watch" behaviour with this bug

 kernel/watch_queue.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c
index a6f9bdd956c3..f10f403104e7 100644
--- a/kernel/watch_queue.c
+++ b/kernel/watch_queue.c
@@ -273,6 +273,7 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)
 	if (ret < 0)
 		goto error;
 
+	ret = -ENOMEM;
 	pages = kcalloc(sizeof(struct page *), nr_pages, GFP_KERNEL);
 	if (!pages)
 		goto error;
-- 
2.35.3

Re: [PATCH v2] watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths

[Christian Brauner]

From: Christian Brauner (Microsoft) <brauner@kernel.org>


On Tue, 07 Mar 2023 16:21:06 +0100, David Disseldorp wrote:
> The watch_queue_set_size() allocation error paths return the ret value
> set via the prior pipe_resize_ring() call, which will always be zero.
> 
> As a result, IOC_WATCH_QUEUE_SET_SIZE callers such as "keyctl watch"
> fail to detect kernel wqueue->notes allocation failures and proceed to
> KEYCTL_WATCH_KEY, with any notifications subsequently lost.
> 
> [...]

Unless someone got to it before me, I've now picked this up:

[1/1] watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths
      commit: 03e1d60e177eedbd302b77af4ea5e21b5a7ade31

Thanks!
Christian