Re: [PATCH v2 2/7] fsnotify: pin both inode and vfsmount mark

[Jan Kara]

On Wed 25-10-17 10:41:34, Miklos Szeredi wrote:
> We may fail to pin one of the marks in fsnotify_prepare_user_wait() when
> dropping the srcu read lock, resulting in use after free at the next
> iteration.
> 
> Solution is to store both marks in iter_info instead of just the one we'll
> be sending the event for.

I'm sorry but I'm not getting it. Where exactly is use-after-free
happening? And how come because if fsnotify_prepare_user_wait() fails to
pin some mark, it does not drop SRCU and bails out, doesn't it?

								Honza
 
> diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
> index 0c4583b61717..48ec61f4c4d5 100644
> --- a/fs/notify/fsnotify.c
> +++ b/fs/notify/fsnotify.c
> @@ -336,6 +336,9 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
>  			vfsmount_group = vfsmount_mark->group;
>  		}
>  
> +		iter_info.inode_mark = inode_mark;
> +		iter_info.vfsmount_mark = vfsmount_mark;
> +
>  		if (inode_group && vfsmount_group) {
>  			int cmp = fsnotify_compare_groups(inode_group,
>  							  vfsmount_group);
> @@ -348,9 +351,6 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
>  			}
>  		}
>  
> -		iter_info.inode_mark = inode_mark;
> -		iter_info.vfsmount_mark = vfsmount_mark;
> -
>  		ret = send_to_group(to_tell, inode_mark, vfsmount_mark, mask,
>  				    data, data_is, cookie, file_name,
>  				    &iter_info);
> -- 
> 2.5.5
> 
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR