fanotify: fix list corruption in fanotify_get_response()
authorJan Kara <jack@suse.cz>
Mon, 19 Sep 2016 21:44:30 +0000 (14:44 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Mon, 19 Sep 2016 22:36:17 +0000 (15:36 -0700)
commit96d41019e3ac55f6f0115b0ce97e4f24a3d636d2
tree4178f8feee6258da1c08f27de55af8de3f2b5af2
parent12703dbfeb15402260e7554d32a34ac40c233990
fanotify: fix list corruption in fanotify_get_response()

fanotify_get_response() calls fsnotify_remove_event() when it finds that
group is being released from fanotify_release() (bypass_perm is set).

However the event it removes need not be only in the group's notification
queue but it can have already moved to access_list (userspace read the
event before closing the fanotify instance fd) which is protected by a
different lock.  Thus when fsnotify_remove_event() races with
fanotify_release() operating on access_list, the list can get corrupted.

Fix the problem by moving all the logic removing permission events from
the lists to one place - fanotify_release().

Fixes: 5838d4442bd5 ("fanotify: fix double free of pending permission events")
Link: http://lkml.kernel.org/r/1473797711-14111-3-git-send-email-jack@suse.cz
Signed-off-by: Jan Kara <jack@suse.cz>
Reported-by: Miklos Szeredi <mszeredi@redhat.com>
Tested-by: Miklos Szeredi <mszeredi@redhat.com>
Reviewed-by: Miklos Szeredi <mszeredi@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/notify/fanotify/fanotify.c
fs/notify/fanotify/fanotify_user.c
fs/notify/notification.c
include/linux/fsnotify_backend.h