96d41019e3
fanotify_get_response() calls fsnotify_remove_event() when it finds that
group is being released from fanotify_release() (bypass_perm is set).
However the event it removes need not be only in the group's notification
queue but it can have already moved to access_list (userspace read the
event before closing the fanotify instance fd) which is protected by a
different lock. Thus when fsnotify_remove_event() races with
fanotify_release() operating on access_list, the list can get corrupted.
Fix the problem by moving all the logic removing permission events from
the lists to one place - fanotify_release().
Fixes:
|
||
|---|---|---|
| .. | ||
| dnotify | ||
| fanotify | ||
| inotify | ||
| Kconfig | ||
| Makefile | ||
| fdinfo.c | ||
| fdinfo.h | ||
| fsnotify.c | ||
| fsnotify.h | ||
| group.c | ||
| inode_mark.c | ||
| mark.c | ||
| notification.c | ||
| vfsmount_mark.c | ||