Commit e0873344 authored by Eric Paris's avatar Eric Paris
Browse files

inotify: race use after free/double free in inotify inode marks

There is a race in the inotify add/rm watch code.  A task can find and
remove a mark which doesn't have all of it's references.  This can
result in a use after free/double free situation.

Task A					Task B
------------				-----------
 allocate a mark (refcnt == 1)
 add it to the idr
					      refcnt hits 0, free
 take reference because we are on idr
 [at this point it is a use after free]
 [time goes on]
 refcnt may hit 0 again, double free

The fix is to take the reference BEFORE the object can be found in the

Signed-off-by: default avatarEric Paris <>
Cc: <>
parent 3dbc6fb6
......@@ -546,21 +546,24 @@ retry:
if (unlikely(!idr_pre_get(&group->inotify_data.idr, GFP_KERNEL)))
goto out_err;
/* we are putting the mark on the idr, take a reference */
ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry,
if (ret) {
/* we didn't get on the idr, drop the idr reference */
/* idr was out of memory allocate and try again */
if (ret == -EAGAIN)
goto retry;
goto out_err;
/* we put the mark on the idr, take a reference */
/* we are on the idr, now get on the inode */
ret = fsnotify_add_mark(&tmp_ientry->fsn_entry, group, inode);
if (ret) {
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment