Messages in this thread Patch in this message | | | From | Miklos Szeredi <> | Subject | [PATCH resend] audit: fix mark refcounting | Date | Wed, 14 Dec 2011 15:35:09 +0100 |
| |
I think this should go into 3.2 (and stable).
Please apply.
Thanks, Miklos ----
From: Miklos Szeredi <mszeredi@suse.cz> Subject: audit: fix mark refcounting
Removing the parent of a watched file results in "kernel BUG at fs/notify/mark.c:139".
To reproduce
add "-w /tmp/audit/dir/watched_file" to audit.rules rm -rf /tmp/audit/dir
This is caused by fsnotify_destroy_mark() being called without an extra reference taken by the caller.
Reported by Francesco Cosoleto here:
https://bugzilla.novell.com/show_bug.cgi?id=689860
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> CC: Al Viro <viro@zeniv.linux.org.uk> CC: Eric Paris <eparis@redhat.com> CC: stable@vger.kernel.org --- kernel/audit_watch.c | 2 ++ 1 file changed, 2 insertions(+)
Index: linux.git/kernel/audit_watch.c =================================================================== --- linux.git.orig/kernel/audit_watch.c 2011-12-06 16:39:48.000000000 +0100 +++ linux.git/kernel/audit_watch.c 2011-12-13 14:05:37.000000000 +0100 @@ -349,7 +349,9 @@ static void audit_remove_parent_watches( } mutex_unlock(&audit_filter_mutex); + audit_get_parent(parent); fsnotify_destroy_mark(&parent->mark); + audit_put_parent(parent); } /* Get path information necessary for adding watches. */
| |