Messages in this thread | | | Date | Thu, 11 Sep 2014 21:49:10 -0400 | From | Sasha Levin <> | Subject | Re: [PATCH] fsnotify: don't put user context if it was never assigned |
| |
On 09/11/2014 04:43 PM, Andrew Morton wrote: > On Tue, 29 Jul 2014 09:25:14 -0400 Sasha Levin <sasha.levin@oracle.com> wrote: > >> > On some failure paths we may attempt to free user context even >> > if it wasn't assigned yet. This will cause a NULL ptr deref >> > and a kernel BUG. > Are you able to identify "some failure paths"? I spent some time > grepping, but it's a pain. > > Please try to include such info in changelogs because reviewers (ie, > me) might want to review those callers to decide whether the bug lies > elsewhere. >
Sorry about that.
The path I was looking at is in inotify_new_group():
oevent = kmalloc(sizeof(struct inotify_event_info), GFP_KERNEL); if (unlikely(!oevent)) { fsnotify_destroy_group(group); return ERR_PTR(-ENOMEM); }
fsnotify_destroy_group() would get called here, but group->inotify_data.user is only getting assigned later:
group->inotify_data.user = get_current_user();
Thanks, Sasha
| |