mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-06 08:46:46 +00:00
Code Issues Releases Wiki Activity

fsnotify: fix pinning group in fsnotify_prepare_user_wait()

Browse source 
commit 9a31d7ad99 upstream.

Blind increment of group's user_waits is not enough, we could be far enough
in the group's destruction that it isn't taken into account (i.e. grabbing
the mark ref afterwards doesn't guarantee that it was the ref coming from
the _group_ that was grabbed).

Instead we need to check (under lock) that the mark is still attached to
the group after having obtained a ref to the mark.  If not, skip it.

Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 9385a84d7e ("fsnotify: Pass fsnotify_iter_info into handle_event handler")
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Miklos Szeredi 2017-10-30 21:14:56 +01:00 committed by Greg Kroah-Hartman
parent 9e9569f05e
commit 2f5be98162
1 changed files with 11 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
fs/notify/mark.c
View file

@ -255,23 +255,20 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
*/
static bool fsnotify_get_mark_safe(struct fsnotify_mark *mark)
{
struct fsnotify_group *group;
if (!mark)
return true;
group = mark->group;
/*
* Since acquisition of mark reference is an atomic op as well, we can
* be sure this inc is seen before any effect of refcount increment.
*/
atomic_inc(&group->user_waits);
if (atomic_inc_not_zero(&mark->refcnt))
return true;
if (atomic_dec_and_test(&group->user_waits) && group->shutdown)
wake_up(&group->notification_waitq);
if (atomic_inc_not_zero(&mark->refcnt)) {
spin_lock(&mark->lock);
if (mark->flags & FSNOTIFY_MARK_FLAG_ATTACHED) {
/* mark is attached, group is still alive then */
atomic_inc(&mark->group->user_waits);
spin_unlock(&mark->lock);
return true;
}
spin_unlock(&mark->lock);
fsnotify_put_mark(mark);
}
return false;
}