Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3587b1b0 authored by Al Viro's avatar Al Viro Committed by Linus Torvalds
Browse files

fanotify: fix FAN_Q_OVERFLOW case of fanotify_read() 



If the FAN_Q_OVERFLOW bit set in event->mask, the fanotify event
metadata will not contain a valid file descriptor, but
copy_event_to_user() didn't check for that, and unconditionally does a
fd_install() on the file descriptor.

Which in turn will cause a BUG_ON() in __fd_install().

Introduced by commit 352e3b24 ("fanotify: sanitize failure exits in
copy_event_to_user()")

Mea culpa - missed that path ;-/

Reported-by: default avatarAlex Shi <lkml.alex@gmail.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 8d938105

fs/notify/fanotify/fanotify_user.c

+2 −1
Original line number Diff line number Diff line
@@ -258,6 +258,7 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group, 
	if (ret)

		goto out_close_fd;



	if (fd != FAN_NOFD)

		fd_install(fd, f);

	return fanotify_event_metadata.event_len;