Re: [PATCH] inotify: race use after free/double free in inotifyinode marks

[Andrew Morton]

On Wed, 12 May 2010 12:08:00 -0400 Eric Paris <eparis@xxxxxxxxxx> wrote:

> From: root <root@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>

hm.

> There is a race in the inotify add/rm watch code.  A task can find and
> remove a mark which doesn't have all of it's references.  This can
> result in a use after free/double free situation.
> 
> Task A					Task B
> ------------				-----------
> inotify_new_watch()
>  allocate a mark (refcnt == 1)
>  add it to the idr
> 					inotify_rm_watch()
> 					 inotify_remove_from_idr()
> 					  fsnotify_put_mark()
> 					      refcnt hits 0, free
>  take reference because we are on idr
>  [at this point it is a use after free]
>  [time goes on]
>  refcnt may hit 0 again, double free
> 
> The fix is to take the reference BEFORE the object can be found in the
> idr.
> 
> Signed-off-by: Eric Paris <eparis@xxxxxxxxxx>

The changelog has no "Cc: <stable@xxxxxxxxxx>".  I suspect it should
have that?

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/