Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 105d1b42 authored by Sasha Levin's avatar Sasha Levin Committed by Linus Torvalds
Browse files

fsnotify: don't put user context if it was never assigned 



On some failure paths we may attempt to free user context even if it
wasn't assigned yet.  This will cause a NULL ptr deref and a kernel BUG.

The path I was looking at is in inotify_new_group():

        oevent = kmalloc(sizeof(struct inotify_event_info), GFP_KERNEL);
        if (unlikely(!oevent)) {
                fsnotify_destroy_group(group);
                return ERR_PTR(-ENOMEM);
        }

fsnotify_destroy_group() would get called here, but
group->inotify_data.user is only getting assigned later:

	group->inotify_data.user = get_current_user();

Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
Cc: John McCutchan <john@johnmccutchan.com>
Cc: Robert Love <rlove@rlove.org>
Cc: Eric Paris <eparis@parisplace.org>
Reviewed-by: default avatarHeinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent cafbaae8

fs/notify/inotify/inotify_fsnotify.c

+4 −2
Original line number Diff line number Diff line
@@ -165,9 +165,11 @@ static void inotify_free_group_priv(struct fsnotify_group *group) 
	/* ideally the idr is empty and we won't hit the BUG in the callback */

	idr_for_each(&group->inotify_data.idr, idr_callback, group);

	idr_destroy(&group->inotify_data.idr);

	if (group->inotify_data.user) {

		atomic_dec(&group->inotify_data.user->inotify_devs);

		free_uid(group->inotify_data.user);

	}

}



static void inotify_free_event(struct fsnotify_event *fsn_event)

{