[PATCH] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

[PATCH] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

[WenTao Liang]

In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference
via get_pid() and stores it in timer.it.cpu.pid. If the subsequent
posix_cpu_timer_set() call fails, the function returns immediately
without calling posix_cpu_timer_del() to release the pid reference,
causing a leak.

Fix it by calling posix_cpu_timer_del() before the unlock-and-return
on the error path, consistent with the other exit paths in the same
function.

Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 kernel/time/posix-cpu-timers.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 0de2bb7cbec0..6f3ddb2b1f46 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -1504,6 +1504,7 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
 		spin_lock_irq(&timer.it_lock);
 		error = posix_cpu_timer_set(&timer, flags, &it, NULL);
 		if (error) {
+			posix_cpu_timer_del(&timer);
 			spin_unlock_irq(&timer.it_lock);
 			return error;
 		}
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

[Frederic Weisbecker]

Le Fri, Jun 12, 2026 at 12:17:38AM +0800, WenTao Liang a écrit :
> In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference
> via get_pid() and stores it in timer.it.cpu.pid. If the subsequent
> posix_cpu_timer_set() call fails, the function returns immediately
> without calling posix_cpu_timer_del() to release the pid reference,
> causing a leak.
> 
> Fix it by calling posix_cpu_timer_del() before the unlock-and-return
> on the error path, consistent with the other exit paths in the same
> function.
> 
> Cc: stable@vger.kernel.org
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>

Reviewed-by: Frederic Weisbecker <frederic@kernel.org>

Thanks!

-- 
Frederic Weisbecker
SUSE Labs

[tip: timers/core] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

[tip-bot2 for WenTao Liang]

The following commit has been merged into the timers/core branch of tip:

Commit-ID:     87bd2ad568e15b90d5f7d4bcd70342d05dad649c
Gitweb:        https://git.kernel.org/tip/87bd2ad568e15b90d5f7d4bcd70342d05dad649c
Author:        WenTao Liang <vulab@iscas.ac.cn>
AuthorDate:    Fri, 12 Jun 2026 00:17:38 +08:00
Committer:     Thomas Gleixner <tglx@kernel.org>
CommitterDate: Sat, 13 Jun 2026 16:16:02 +02:00

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference
via get_pid() and stores it in timer.it.cpu.pid. If the subsequent
posix_cpu_timer_set() call fails, the function returns immediately
without calling posix_cpu_timer_del() to release the pid reference,
causing a leak.

Fix it by calling posix_cpu_timer_del() before the unlock-and-return
on the error path, consistent with the other exit paths in the same
function.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260611161738.97043-1-vulab@iscas.ac.cn
---
 kernel/time/posix-cpu-timers.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 395e297..74775b9 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -1506,6 +1506,7 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
 		spin_lock_irq(&timer.it_lock);
 		error = posix_cpu_timer_set(&timer, flags, &it, NULL);
 		if (error) {
+			posix_cpu_timer_del(&timer);
 			spin_unlock_irq(&timer.it_lock);
 			return error;
 		}