Commit d295b66a authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'fsnotify_for_v6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

Pull inotify fix from Jan Kara:
 "A fix for possibly reporting invalid watch descriptor with inotify
  event"

* tag 'fsnotify_for_v6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  inotify: Avoid reporting event with invalid wd
parents 2a78769d c915d8f5
...@@ -65,7 +65,7 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask, ...@@ -65,7 +65,7 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask,
struct fsnotify_event *fsn_event; struct fsnotify_event *fsn_event;
struct fsnotify_group *group = inode_mark->group; struct fsnotify_group *group = inode_mark->group;
int ret; int ret;
int len = 0; int len = 0, wd;
int alloc_len = sizeof(struct inotify_event_info); int alloc_len = sizeof(struct inotify_event_info);
struct mem_cgroup *old_memcg; struct mem_cgroup *old_memcg;
...@@ -80,6 +80,13 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask, ...@@ -80,6 +80,13 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask,
i_mark = container_of(inode_mark, struct inotify_inode_mark, i_mark = container_of(inode_mark, struct inotify_inode_mark,
fsn_mark); fsn_mark);
/*
* We can be racing with mark being detached. Don't report event with
* invalid wd.
*/
wd = READ_ONCE(i_mark->wd);
if (wd == -1)
return 0;
/* /*
* Whoever is interested in the event, pays for the allocation. Do not * Whoever is interested in the event, pays for the allocation. Do not
* trigger OOM killer in the target monitoring memcg as it may have * trigger OOM killer in the target monitoring memcg as it may have
...@@ -110,7 +117,7 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask, ...@@ -110,7 +117,7 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask,
fsn_event = &event->fse; fsn_event = &event->fse;
fsnotify_init_event(fsn_event); fsnotify_init_event(fsn_event);
event->mask = mask; event->mask = mask;
event->wd = i_mark->wd; event->wd = wd;
event->sync_cookie = cookie; event->sync_cookie = cookie;
event->name_len = len; event->name_len = len;
if (len) if (len)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment