Messages in this thread | | | Date | Wed, 12 May 2010 20:16:31 -0400 | From | Andrew Morton <> | Subject | Re: [PATCH] inotify: race use after free/double free in inotify inode marks |
| |
On Wed, 12 May 2010 12:08:00 -0400 Eric Paris <eparis@redhat.com> wrote:
> From: root <root@tyan-gt24-04.rhts.eng.bos.redhat.com>
hm.
> There is a race in the inotify add/rm watch code. A task can find and > remove a mark which doesn't have all of it's references. This can > result in a use after free/double free situation. > > Task A Task B > ------------ ----------- > inotify_new_watch() > allocate a mark (refcnt == 1) > add it to the idr > inotify_rm_watch() > inotify_remove_from_idr() > fsnotify_put_mark() > refcnt hits 0, free > take reference because we are on idr > [at this point it is a use after free] > [time goes on] > refcnt may hit 0 again, double free > > The fix is to take the reference BEFORE the object can be found in the > idr. > > Signed-off-by: Eric Paris <eparis@redhat.com>
The changelog has no "Cc: <stable@kernel.org>". I suspect it should have that?
| |