1 files changed, 11 insertions, 5 deletions

diff --git a/kernel/futex.c b/kernel/futex.c
index e6a4d72bca3d..4000454e4d83 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -802,8 +802,10 @@ retry:
 
                 ret = get_user(dummy, uaddr2);
                 if (ret)
-                        return ret;
+                        goto out_put_keys;
 
+                put_futex_key(fshared, &key2);
+                put_futex_key(fshared, &key1);
                 goto retryfull;
         }
 
@@ -878,6 +880,9 @@ retry:
                         if (hb1 != hb2)
                                 spin_unlock(&hb2->lock);
 
+                        put_futex_key(fshared, &key2);
+                        put_futex_key(fshared, &key1);
+
                         ret = get_user(curval, uaddr1);
 
                         if (!ret)
@@ -1453,6 +1458,7 @@ retry_locked:
                          * exit to complete.
                          */
                         queue_unlock(&q, hb);
+                        put_futex_key(fshared, &q.key);
                         cond_resched();
                         goto retry;
 
@@ -1595,13 +1601,12 @@ uaddr_faulted:
 
         ret = get_user(uval, uaddr);
         if (!ret)
-                goto retry;
+                goto retry_unlocked;
 
-        if (to)
-                destroy_hrtimer_on_stack(&to->timer);
-        return ret;
+        goto out_put_key;
 }
 
+
 /*
  * Userspace attempted a TID -> 0 atomic transition, and failed.
  * This is the in-kernel slowpath: we look up the PI state (if any),
@@ -1705,6 +1710,7 @@ pi_faulted:
         }
 
         ret = get_user(uval, uaddr);
+        put_futex_key(fshared, &key);
         if (!ret)
                 goto retry;