lkml.org 
[lkml]   [2010]   [May]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] inotify: race use after free/double free in inotify inode marks
On Wed, 12 May 2010 12:08:00 -0400 Eric Paris <eparis@redhat.com> wrote:

> From: root <root@tyan-gt24-04.rhts.eng.bos.redhat.com>

hm.

> There is a race in the inotify add/rm watch code. A task can find and
> remove a mark which doesn't have all of it's references. This can
> result in a use after free/double free situation.
>
> Task A Task B
> ------------ -----------
> inotify_new_watch()
> allocate a mark (refcnt == 1)
> add it to the idr
> inotify_rm_watch()
> inotify_remove_from_idr()
> fsnotify_put_mark()
> refcnt hits 0, free
> take reference because we are on idr
> [at this point it is a use after free]
> [time goes on]
> refcnt may hit 0 again, double free
>
> The fix is to take the reference BEFORE the object can be found in the
> idr.
>
> Signed-off-by: Eric Paris <eparis@redhat.com>

The changelog has no "Cc: <stable@kernel.org>". I suspect it should
have that?



\
 
 \ /
  Last update: 2010-05-13 05:21    [W:0.046 / U:11.040 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site