Jan Kara 96d41019e3 fanotify: fix list corruption in fanotify_get_response() ... fanotify_get_response() calls fsnotify_remove_event() when it finds that group is being released from fanotify_release() (bypass_perm is set). However the event it removes need not be only in the group's notification queue but it can have already moved to access_list (userspace read the event before closing the fanotify instance fd) which is protected by a different lock. Thus when fsnotify_remove_event() races with fanotify_release() operating on access_list, the list can get corrupted. Fix the problem by moving all the logic removing permission events from the lists to one place - fanotify_release(). Fixes: 5838d4442b ("fanotify: fix double free of pending permission events") Link: http://lkml.kernel.org/r/1473797711-14111-3-git-send-email-jack@suse.cz Signed-off-by: Jan Kara <jack@suse.cz> Reported-by: Miklos Szeredi <mszeredi@redhat.com> Tested-by: Miklos Szeredi <mszeredi@redhat.com> Reviewed-by: Miklos Szeredi <mszeredi@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2016-09-19 15:36:17 -07:00
..
fanotify_user.c	fanotify: fix list corruption in fanotify_get_response()	2016-09-19 15:36:17 -07:00
fanotify.c	fanotify: fix list corruption in fanotify_get_response()	2016-09-19 15:36:17 -07:00
fanotify.h	fanotify: use fanotify event structure for permission response processing	2014-04-03 16:20:51 -07:00
Kconfig	treewide: fix typo of "suport" in various comments and Kconfig	2012-11-19 14:16:09 +01:00
Makefile	fanotify: fanotify_init syscall declaration	2010-07-28 09:58:55 -04:00