Messages in this thread Patch in this message | | | From | Miklos Szeredi <> | Subject | [PATCH] audit: fix mark refcounting | Date | Mon, 07 Nov 2011 15:59:18 +0100 |
| |
From: Miklos Szeredi <mszeredi@suse.cz>
Removing the parent of a watched file results in "kernel BUG at fs/notify/mark.c:139".
To reproduce
add "-w /tmp/audit/dir/watched_file" to audit.rules rm -rf /tmp/audit/dir
This is caused by fsnotify_destroy_mark() being called without an extra reference taken by the caller.
Reported by Francesco Cosoleto here:
https://bugzilla.novell.com/show_bug.cgi?id=689860
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> CC: Al Viro <viro@zeniv.linux.org.uk> CC: Eric Paris <eparis@redhat.com> CC: stable@vger.kernel.org --- kernel/audit_watch.c | 2 ++ 1 file changed, 2 insertions(+)
Index: linux.git/kernel/audit_watch.c =================================================================== --- linux.git.orig/kernel/audit_watch.c 2011-09-13 16:08:20.000000000 +0200 +++ linux.git/kernel/audit_watch.c 2011-11-07 15:19:07.000000000 +0100 @@ -349,7 +349,9 @@ static void audit_remove_parent_watches( } mutex_unlock(&audit_filter_mutex); + audit_get_parent(parent); fsnotify_destroy_mark(&parent->mark); + audit_put_parent(parent); } /* Get path information necessary for adding watches. */
| |