Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d599e36a authored by Nick Piggin's avatar Nick Piggin Committed by Linus Torvalds
Browse files

inotify: fix race 



There is a race between setting an inode's children's "parent watched" flag
when placing the first watch on a parent, and instantiating new children of
that parent: a child could miss having its flags set by
set_dentry_child_flags, but then inotify_d_instantiate might still see
!inotify_inode_watched.

The solution is to set_dentry_child_flags after adding the watch.  Locking is
taken care of, because both set_dentry_child_flags and inotify_d_instantiate
hold dcache_lock and child->d_locks.

Signed-off-by: default avatarNick Piggin <npiggin@suse.de>
Cc: Robert Love <rlove@google.com>
Cc: John McCutchan <ttb@tentacle.dhs.org>
Cc: Jan Kara <jack@ucw.cz>
Cc: Yan Zheng <yanzheng@21cn.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent eea63e0e

fs/inotify.c

+10 −3
Original line number Diff line number Diff line
@@ -627,6 +627,7 @@ s32 inotify_add_watch(struct inotify_handle *ih, struct inotify_watch *watch, 
		      struct inode *inode, u32 mask)

{

	int ret = 0;

	int newly_watched;



	/* don't allow invalid bits: we don't want flags set */

	mask &= IN_ALL_EVENTS | IN_ONESHOT;
@@ -653,12 +654,18 @@ s32 inotify_add_watch(struct inotify_handle *ih, struct inotify_watch *watch, 
	 */

	watch->inode = igrab(inode);



	if (!inotify_inode_watched(inode))

		set_dentry_child_flags(inode, 1);



	/* Add the watch to the handle's and the inode's list */

	newly_watched = !inotify_inode_watched(inode);

	list_add(&watch->h_list, &ih->watches);

	list_add(&watch->i_list, &inode->inotify_watches);

	/*

	 * Set child flags _after_ adding the watch, so there is no race

	 * windows where newly instantiated children could miss their parent's

	 * watched flag.

	 */

	if (newly_watched)

		set_dentry_child_flags(inode, 1);



out:

	mutex_unlock(&ih->mutex);

	mutex_unlock(&inode->inotify_mutex);