Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b3a00660 authored by Jan Kara's avatar Jan Kara
Browse files

dnotify: Handle errors from fsnotify_add_mark_locked() in fcntl_dirnotify() 



fsnotify_add_mark_locked() can fail but we do not check its return
value. This didn't matter before commit 9dd813c1 "fsnotify: Move
mark list head from object into dedicated structure" as none of possible
failures could happen for dnotify but after that commit -ENOMEM can be
returned. Handle this error properly in fcntl_dirnotify() as
otherwise we just hit BUG_ON(dn_mark->dn) in dnotify_free_mark().

Reviewed-by: default avatarAmir Goldstein <amir73il@gmail.com>
Reported-by: syzkaller
Fixes: 9dd813c1
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent ff5abbe7

fs/notify/dnotify/dnotify.c

+6 −1
Original line number Diff line number Diff line
@@ -319,7 +319,11 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) 
		dn_mark = container_of(fsn_mark, struct dnotify_mark, fsn_mark);

		spin_lock(&fsn_mark->lock);

	} else {

		fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0);

		error = fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0);

		if (error) {

			mutex_unlock(&dnotify_group->mark_mutex);

			goto out_err;

		}

		spin_lock(&new_fsn_mark->lock);

		fsn_mark = new_fsn_mark;

		dn_mark = new_dn_mark;
@@ -345,6 +349,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) 
		 */

		if (dn_mark == new_dn_mark)

			destroy = 1;

		error = 0;

		goto out;

	}