Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fed47485 authored by Miklos Szeredi's avatar Miklos Szeredi Committed by Linus Torvalds
Browse files

fsnotify: don't BUG in fsnotify_destroy_mark() 

Removing the parent of a watched file results in "kernel BUG at
fs/notify/mark.c:139".

To reproduce

  add "-w /tmp/audit/dir/watched_file" to audit.rules
  rm -rf /tmp/audit/dir

This is caused by fsnotify_destroy_mark() being called without an
extra reference taken by the caller.

Reported by Francesco Cosoleto here:

  https://bugzilla.novell.com/show_bug.cgi?id=689860



Fix by removing the BUG_ON and adding a comment about not accessing mark after
the iput.

Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
CC: stable@vger.kernel.org
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 1e6c4dfd

fs/notify/mark.c

+5 −3
Original line number Diff line number Diff line
@@ -135,9 +135,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark) 


	mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;



	/* 1 from caller and 1 for being on i_list/g_list */

	BUG_ON(atomic_read(&mark->refcnt) < 2);



	spin_lock(&group->mark_lock);



	if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
@@ -181,6 +178,11 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark) 
	if (inode && (mark->flags & FSNOTIFY_MARK_FLAG_OBJECT_PINNED))

		iput(inode);



	/*

	 * We don't necessarily have a ref on mark from caller so the above iput

	 * may have already destroyed it.  Don't touch from now on.

	 */



	/*

	 * it's possible that this group tried to destroy itself, but this

	 * this mark was simultaneously being freed by inode.  If that's the