lkml.org 
[lkml]   [2015]   [Jun]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[BUG] fs: inotify_handle_event() reading un-init memory
From
Date
Caught by kmemcheck.

Don't know the fix... just pointed at the bug.

Introduced in commit 7053aee26a3 ("fsnotify: do not share
events between notification groups").
---
fs/notify/inotify/inotify_fsnotify.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 2cd900c2c737..370d66dc4ddb 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -96,11 +96,12 @@ int inotify_handle_event(struct fsnotify_group *group,
i_mark = container_of(inode_mark, struct inotify_inode_mark,
fsn_mark);

+ // new object alloc here
event = kmalloc(alloc_len, GFP_KERNEL);
if (unlikely(!event))
return -ENOMEM;

- fsn_event = &event->fse;
+ fsn_event = &event->fse; // This looks wrong!?! read from un-init mem?
fsnotify_init_event(fsn_event, inode, mask);
event->wd = i_mark->wd;
event->sync_cookie = cookie;


\
 
 \ /
  Last update: 2015-06-16 13:41    [W:0.047 / U:0.872 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site