Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7294fbd4 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'fsnotify_for_v5.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 

Pull fsnotify fixes from Jan Kara:
 "One inotify and one fanotify fix"

* tag 'fsnotify_for_v5.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fanotify: Allow copying of file handle to userspace
  inotify: Fix fsnotify_mark refcount leak in inotify_update_existing_watch()
parents 54c49016 b2d22b6b

fs/notify/fanotify/fanotify_user.c

+11 −1
Original line number Diff line number Diff line
@@ -208,6 +208,7 @@ static int copy_fid_to_user(struct fanotify_event *event, char __user *buf) 
{

	struct fanotify_event_info_fid info = { };

	struct file_handle handle = { };

	unsigned char bounce[FANOTIFY_INLINE_FH_LEN], *fh;

	size_t fh_len = event->fh_len;

	size_t len = fanotify_event_info_len(event);
@@ -233,7 +234,16 @@ static int copy_fid_to_user(struct fanotify_event *event, char __user *buf) 


	buf += sizeof(handle);

	len -= sizeof(handle);

	if (copy_to_user(buf, fanotify_event_fh(event), fh_len))

	/*

	 * For an inline fh, copy through stack to exclude the copy from

	 * usercopy hardening protections.

	 */

	fh = fanotify_event_fh(event);

	if (fh_len <= FANOTIFY_INLINE_FH_LEN) {

		memcpy(bounce, fh, fh_len);

		fh = bounce;

	}

	if (copy_to_user(buf, fh, fh_len))

		return -EFAULT;



	/* Pad with 0's */

fs/notify/inotify/inotify_user.c

+5 −2
Original line number Diff line number Diff line
@@ -519,8 +519,10 @@ static int inotify_update_existing_watch(struct fsnotify_group *group, 
	fsn_mark = fsnotify_find_mark(&inode->i_fsnotify_marks, group);

	if (!fsn_mark)

		return -ENOENT;

	else if (create)

		return -EEXIST;

	else if (create) {

		ret = -EEXIST;

		goto out;

	}



	i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
@@ -548,6 +550,7 @@ static int inotify_update_existing_watch(struct fsnotify_group *group, 
	/* return the wd */

	ret = i_mark->wd;



out:

	/* match the get from fsnotify_find_mark() */

	fsnotify_put_mark(fsn_mark);