kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/fs/notify
History
Jan Kara 8a781b2ef8 fanotify: fix list corruption in fanotify_get_response() 
[ Upstream commit 96d41019e3 ]

fanotify_get_response() calls fsnotify_remove_event() when it finds that
group is being released from fanotify_release() (bypass_perm is set).

However the event it removes need not be only in the group's notification
queue but it can have already moved to access_list (userspace read the
event before closing the fanotify instance fd) which is protected by a
different lock.  Thus when fsnotify_remove_event() races with
fanotify_release() operating on access_list, the list can get corrupted.

Fix the problem by moving all the logic removing permission events from
the lists to one place - fanotify_release().

Fixes: 5838d4442b ("fanotify: fix double free of pending permission events")
Link: http://lkml.kernel.org/r/1473797711-14111-3-git-send-email-jack@suse.cz
Signed-off-by: Jan Kara <jack@suse.cz>
Reported-by: Miklos Szeredi <mszeredi@redhat.com>
Tested-by: Miklos Szeredi <mszeredi@redhat.com>
Reviewed-by: Miklos Szeredi <mszeredi@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
History 2016-10-05 22:40:20 -04:00
..
dnotify security: make security_file_set_fowner, f_setown and __f_setown void return 2014-09-09 16:01:36 -04:00
fanotify fanotify: fix list corruption in fanotify_get_response() 2016-10-05 22:40:20 -04:00
inotify fsnotify: don't put user context if it was never assigned 2014-10-09 22:25:45 -04:00
fdinfo.c fs/notify: don't show f_handle if exportfs_encode_inode_fh failed 2014-09-10 15:42:12 -07:00
fdinfo.h fs, notify: add procfs fdinfo helper 2012-12-17 17:15:28 -08:00
fsnotify.c move d_rcu from overlapping d_child to overlapping d_alias 2014-12-16 09:39:06 -08:00
fsnotify.h fanotify: fix notification of groups with inode & mount marks 2014-11-13 16:17:06 -08:00
group.c fsnotify: add a way to stop queueing events on group shutdown 2016-10-05 22:40:20 -04:00
inode_mark.c fanotify: fix notification of groups with inode & mount marks 2014-11-13 16:17:06 -08:00
Kconfig fanotify: allow fanotify to be built 2010-10-28 17:22:13 -04:00
Makefile fs, notify: add procfs fdinfo helper 2012-12-17 17:15:28 -08:00
mark.c fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() 2015-08-19 13:16:07 -04:00
notification.c fanotify: fix list corruption in fanotify_get_response() 2016-10-05 22:40:20 -04:00
vfsmount_mark.c fanotify: fix notification of groups with inode & mount marks 2014-11-13 16:17:06 -08:00