History

Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notify

* 'for-linus' of git://git.infradead.org/users/eparis/notify: inotify: don't leak user struct on inotify release inotify: race use after free/double free in inotify inode marks inotify: clean up the inotify_add_watch out path Inotify: undefined reference to `anon_inode_getfd' Manual merge to remove duplicate "select ANON_INODES" from Kconfig file

Linus Torvalds committed 16 years ago

Commit 4fc4c3c2 parents 97b2073 b3b38d82 files · +10 −8Browse files

Unified · Split

2 files
  1. fs/notify/inotify/inotify_fsnotify.c +2 −0
  2. fs/notify/inotify/inotify_user.c +8 −8
fs/notify/inotify/inotify_fsnotify.c+2−0
@@ -28,6 +28,7 @@ · 27 unmodified lines
28#include <linux/path.h> /* struct path */28#include <linux/path.h> /* struct path */
29#include <linux/slab.h> /* kmem_* */29#include <linux/slab.h> /* kmem_* */
30#include <linux/types.h>30#include <linux/types.h>
31#include <linux/sched.h>
31 32
32#include "inotify.h"33#include "inotify.h"
33 34
@@ -146,6 +147,7 @@ static void inotify_free_group_priv(struct fsnotify_group *group) · 112 unmodified lines
146 idr_for_each(&group->inotify_data.idr, idr_callback, group);147 idr_for_each(&group->inotify_data.idr, idr_callback, group);
147 idr_remove_all(&group->inotify_data.idr);148 idr_remove_all(&group->inotify_data.idr);
148 idr_destroy(&group->inotify_data.idr);149 idr_destroy(&group->inotify_data.idr);
150 free_uid(group->inotify_data.user);
149}151}
150 152
151void inotify_free_event_priv(struct fsnotify_event_private_data *fsn_event_priv)153void inotify_free_event_priv(struct fsnotify_event_private_data *fsn_event_priv)
fs/notify/inotify/inotify_user.c+8−8
@@ -546,21 +546,24 @@ retry: · 545 unmodified lines
546 if (unlikely(!idr_pre_get(&group->inotify_data.idr, GFP_KERNEL)))546 if (unlikely(!idr_pre_get(&group->inotify_data.idr, GFP_KERNEL)))
547 goto out_err;547 goto out_err;
548 548
549 /* we are putting the mark on the idr, take a reference */
550 fsnotify_get_mark(&tmp_ientry->fsn_entry);
551
549 spin_lock(&group->inotify_data.idr_lock);552 spin_lock(&group->inotify_data.idr_lock);
550 ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,553 ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,
551 group->inotify_data.last_wd+1,554 group->inotify_data.last_wd+1,
552 &tmp_ientry->wd);555 &tmp_ientry->wd);
553 spin_unlock(&group->inotify_data.idr_lock);556 spin_unlock(&group->inotify_data.idr_lock);
554 if (ret) {557 if (ret) {
558 /* we didn't get on the idr, drop the idr reference */
559 fsnotify_put_mark(&tmp_ientry->fsn_entry);
560
555 /* idr was out of memory allocate and try again */561 /* idr was out of memory allocate and try again */
556 if (ret == -EAGAIN)562 if (ret == -EAGAIN)
557 goto retry;563 goto retry;
558 goto out_err;564 goto out_err;
559 }565 }
560 566
561 /* we put the mark on the idr, take a reference */
562 fsnotify_get_mark(&tmp_ientry->fsn_entry);
563
564 /* we are on the idr, now get on the inode */567 /* we are on the idr, now get on the inode */
565 ret = fsnotify_add_mark(&tmp_ientry->fsn_entry, group, inode);568 ret = fsnotify_add_mark(&tmp_ientry->fsn_entry, group, inode);
566 if (ret) {569 if (ret) {
@@ -578,16 +581,13 @@ retry: · 11 unmodified lines
578 /* return the watch descriptor for this new entry */581 /* return the watch descriptor for this new entry */
579 ret = tmp_ientry->wd;582 ret = tmp_ientry->wd;
580 583
581 /* match the ref from fsnotify_init_markentry() */
582 fsnotify_put_mark(&tmp_ientry->fsn_entry);
583
584 /* if this mark added a new event update the group mask */584 /* if this mark added a new event update the group mask */
585 if (mask & ~group->mask)585 if (mask & ~group->mask)
586 fsnotify_recalc_group_mask(group);586 fsnotify_recalc_group_mask(group);
587 587
588out_err:588out_err:
589 if (ret < 0)589 /* match the ref from fsnotify_init_markentry() */
590 kmem_cache_free(inotify_inode_mark_cachep, tmp_ientry);590 fsnotify_put_mark(&tmp_ientry->fsn_entry);
591 591
592 return ret;592 return ret;
593}593}