summaryrefslogtreecommitdiff
path: root/fs/notify/inotify/inotify_fsnotify.c
diff options
context:
space:
mode:
authorEric Paris <eparis@redhat.com>2011-04-05 17:20:50 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2011-04-05 15:27:14 -0700
commitd0de4dc584ec6aa3b26fffea320a8457827768fc (patch)
tree6895419a694ba323c6b18cdb6aa2714892b6f481 /fs/notify/inotify/inotify_fsnotify.c
parent623dda65b6f71e6474f3f156dbed2acf6ff43584 (diff)
inotify: fix double free/corruption of stuct user
On an error path in inotify_init1 a normal user can trigger a double free of struct user. This is a regression introduced by a2ae4cc9a16e ("inotify: stop kernel memory leak on file creation failure"). We fix this by making sure that if a group exists the user reference is dropped when the group is cleaned up. We should not explictly drop the reference on error and also drop the reference when the group is cleaned up. The new lifetime rules are that an inotify group lives from inotify_new_group to the last fsnotify_put_group. Since the struct user and inotify_devs are directly tied to this lifetime they are only changed/updated in those two locations. We get rid of all special casing of struct user or user->inotify_devs. Signed-off-by: Eric Paris <eparis@redhat.com> Cc: stable@kernel.org (2.6.37 and up) Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/notify/inotify/inotify_fsnotify.c')
-rw-r--r--fs/notify/inotify/inotify_fsnotify.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index a91b69a6a291..0348d0c8f65e 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -198,6 +198,7 @@ static void inotify_free_group_priv(struct fsnotify_group *group)
idr_for_each(&group->inotify_data.idr, idr_callback, group);
idr_remove_all(&group->inotify_data.idr);
idr_destroy(&group->inotify_data.idr);
+ atomic_dec(&group->inotify_data.user->inotify_devs);
free_uid(group->inotify_data.user);
}