Files
linux/include/linux
Jan Kara 96d41019e3 fanotify: fix list corruption in fanotify_get_response()
fanotify_get_response() calls fsnotify_remove_event() when it finds that
group is being released from fanotify_release() (bypass_perm is set).

However the event it removes need not be only in the group's notification
queue but it can have already moved to access_list (userspace read the
event before closing the fanotify instance fd) which is protected by a
different lock.  Thus when fsnotify_remove_event() races with
fanotify_release() operating on access_list, the list can get corrupted.

Fix the problem by moving all the logic removing permission events from
the lists to one place - fanotify_release().

Fixes: 5838d4442b ("fanotify: fix double free of pending permission events")
Link: http://lkml.kernel.org/r/1473797711-14111-3-git-send-email-jack@suse.cz
Signed-off-by: Jan Kara <jack@suse.cz>
Reported-by: Miklos Szeredi <mszeredi@redhat.com>
Tested-by: Miklos Szeredi <mszeredi@redhat.com>
Reviewed-by: Miklos Szeredi <mszeredi@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2016-09-19 15:36:17 -07:00
..
2015-10-07 18:08:15 +01:00
2016-03-04 23:50:27 -06:00
2016-07-04 17:19:22 +05:30
2016-07-08 16:23:11 +02:00
2016-07-25 11:47:52 +01:00
2015-05-13 12:04:55 -05:00
2016-07-04 08:19:21 -07:00
2015-12-23 08:37:10 -07:00
2015-03-25 20:28:11 -04:00
2016-03-15 16:55:16 -07:00
2016-08-16 09:16:51 -06:00
2016-08-04 08:50:07 -04:00
2016-08-07 14:41:02 -06:00
2016-08-07 14:41:02 -06:00
2016-08-16 09:16:51 -06:00
2016-06-07 13:41:38 -06:00
2016-08-11 09:41:35 -06:00
2016-07-01 16:30:38 -04:00
2016-06-25 09:04:48 -07:00
2016-08-02 19:35:24 -04:00
2015-02-12 18:54:15 -08:00
2016-07-26 16:19:19 -07:00
2016-06-07 13:41:38 -06:00
2016-05-17 15:48:12 -04:00
2016-09-01 11:11:59 +02:00
2016-05-29 18:35:12 -04:00
2016-06-27 12:26:08 -07:00
2015-12-28 13:41:50 +01:00
2015-03-16 21:45:54 +11:00
2016-07-22 09:07:02 +02:00
2015-05-05 13:40:42 -06:00
2015-11-25 09:22:00 -07:00
2016-03-11 14:58:58 -05:00
2015-10-23 05:44:28 -07:00
2016-02-11 09:59:22 -05:00
2016-03-22 15:36:02 -07:00
2016-08-02 19:35:44 -04:00
2016-05-11 22:37:54 +02:00
2015-06-25 12:06:45 +02:00
2016-01-28 14:19:12 -08:00
2016-03-22 15:36:02 -07:00
2016-03-22 15:36:02 -07:00
2015-07-28 08:50:42 +01:00
2016-01-15 17:56:32 -08:00
2015-04-29 17:17:17 -05:00
2016-05-03 15:07:35 -07:00
2015-10-27 18:55:31 -07:00
2015-06-24 17:49:41 -07:00
2016-08-04 10:16:55 +09:30
2016-06-24 10:40:41 -05:00
2015-07-21 10:39:05 -07:00
2016-07-29 12:17:52 -07:00
2016-07-12 19:25:38 -07:00
2016-07-01 05:32:17 -04:00
2016-06-03 19:37:21 -04:00
2016-09-04 11:41:12 -07:00
2016-05-17 15:47:55 -04:00
2016-04-25 15:09:11 -04:00
2016-02-16 13:04:58 -05:00
2016-05-02 09:00:56 -05:00
2016-07-28 16:07:41 -07:00
2016-05-19 19:12:14 -07:00
2015-04-12 21:03:31 +02:00
2016-02-11 18:35:48 -08:00
2016-03-14 15:43:11 -04:00
2015-01-25 23:17:28 -05:00
2016-07-12 19:25:38 -07:00
2015-10-06 17:08:19 +02:00
2016-02-16 13:04:58 -05:00
2016-03-17 15:09:34 -07:00
2016-07-06 10:51:14 +01:00
2016-03-22 15:36:02 -07:00
2016-07-26 16:19:19 -07:00
2016-06-14 10:54:40 -07:00
2016-07-20 23:30:06 -04:00
2016-01-04 16:11:11 -05:00
2016-08-28 23:44:55 -04:00
2016-05-08 23:46:14 -04:00
2015-06-25 17:00:39 -07:00
2016-05-19 19:12:14 -07:00
2016-06-20 12:47:15 -07:00
2015-10-01 09:57:59 -07:00
2016-07-19 17:43:38 +03:00
2016-05-23 17:04:14 -07:00
2016-04-07 16:53:29 -04:00
2016-09-17 14:05:30 -07:00
2015-11-23 09:44:58 +01:00
2016-07-26 16:19:19 -07:00
2016-05-20 17:58:30 -07:00
2016-02-22 16:10:08 -07:00
2016-06-25 09:04:48 -07:00
2015-12-03 07:24:29 -08:00
2015-03-24 09:48:14 -07:00
2015-09-08 15:35:28 -07:00