diff options
| author | Eric Paris <eparis@redhat.com> | 2010-05-11 17:17:40 -0400 |
|---|---|---|
| committer | Eric Paris <eparis@redhat.com> | 2010-05-14 11:52:57 -0400 |
| commit | e08733446e72b983fed850fc5d8bd21b386feb29 (patch) | |
| tree | 6b169001ff9faa82577341fbfa4cbcd9ccf00663 /Documentation/powerpc | |
| parent | 3dbc6fb6a3c8a7dc164ae330ab024a3fe65ae53e (diff) | |
inotify: race use after free/double free in inotify inode marks
There is a race in the inotify add/rm watch code. A task can find and
remove a mark which doesn't have all of it's references. This can
result in a use after free/double free situation.
Task A Task B
------------ -----------
inotify_new_watch()
allocate a mark (refcnt == 1)
add it to the idr
inotify_rm_watch()
inotify_remove_from_idr()
fsnotify_put_mark()
refcnt hits 0, free
take reference because we are on idr
[at this point it is a use after free]
[time goes on]
refcnt may hit 0 again, double free
The fix is to take the reference BEFORE the object can be found in the
idr.
Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: <stable@kernel.org>
Diffstat (limited to 'Documentation/powerpc')
0 files changed, 0 insertions, 0 deletions