Re: [PATCH] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

[Frederic Weisbecker]

Le Fri, Jun 12, 2026 at 12:17:38AM +0800, WenTao Liang a écrit :
> In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference
> via get_pid() and stores it in timer.it.cpu.pid. If the subsequent
> posix_cpu_timer_set() call fails, the function returns immediately
> without calling posix_cpu_timer_del() to release the pid reference,
> causing a leak.
> 
> Fix it by calling posix_cpu_timer_del() before the unlock-and-return
> on the error path, consistent with the other exit paths in the same
> function.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>

Reviewed-by: Frederic Weisbecker <frederic@xxxxxxxxxx>

Thanks!

-- 
Frederic Weisbecker
SUSE Labs