watch_queue: fix IOC_WATCH_QUEUE_SET_SIZE alloc error paths

[ Upstream commit 865b5573c7c5a56ab60c0e28cbcb29474ceb4062 ]

The watch_queue_set_size() allocation error paths return the ret value
set via the prior pipe_resize_ring() call, which will always be zero.

As a result, IOC_WATCH_QUEUE_SET_SIZE callers such as "keyctl watch"
fail to detect kernel wqueue->notes allocation failures and proceed to
KEYCTL_WATCH_KEY, with any notifications subsequently lost.

Fixes: 175295c8c9fa4 ("pipe: Add general notification queue support")
Signed-off-by: David Disseldorp <ddiss@suse.de>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c
index a6f9bdd956c39d2fabbb5932441965672c747aa2..f10f403104e7dcccaf8d702ed73d71d1e5ac9a35 100644 (file)
--- a/kernel/watch_queue.c
+++ b/kernel/watch_queue.c
@@ -273,6 +273,7 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes)
        if (ret < 0)
                goto error;
 
+       ret = -ENOMEM;
        pages = kcalloc(sizeof(struct page *), nr_pages, GFP_KERNEL);
        if (!pages)
                goto error;