linux-stable/fs/notify/fanotify/fanotify.h
Jan Kara 8581679424 fanotify: Fix use after free for permission events
Currently struct fanotify_event_info has been destroyed immediately
after reporting its contents to userspace. However that is wrong for
permission events because those need to stay around until userspace
provides response which is filled back in fanotify_event_info. So change
to code to free permission events only after we have got the response
from userspace.

Reported-and-tested-by: Jiri Kosina <jkosina@suse.cz>
Reported-and-tested-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: Jan Kara <jack@suse.cz>
2014-01-29 13:57:17 +01:00

30 lines
914 B
C

#include <linux/fsnotify_backend.h>
#include <linux/path.h>
#include <linux/slab.h>
extern struct kmem_cache *fanotify_event_cachep;
/*
* Lifetime of the structure differs for normal and permission events. In both
* cases the structure is allocated in fanotify_handle_event(). For normal
* events the structure is freed immediately after reporting it to userspace.
* For permission events we free it only after we receive response from
* userspace.
*/
struct fanotify_event_info {
struct fsnotify_event fse;
/*
* We hold ref to this path so it may be dereferenced at any point
* during this object's lifetime
*/
struct path path;
struct pid *tgid;
#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
u32 response; /* userspace answer to question */
#endif
};
static inline struct fanotify_event_info *FANOTIFY_E(struct fsnotify_event *fse)
{
return container_of(fse, struct fanotify_event_info, fse);
}