summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorAmy Griffis <amy.griffis@hp.com>2006-05-20 15:00:06 -0700
committerLinus Torvalds <torvalds@g5.osdl.org>2006-05-21 12:59:18 -0700
commit66055a4e7334b05354c835123ff621c5f700e56a (patch)
treede9d4b432e48d4c919b70a627d9ba0b50e840de0 /fs
parent12783b002db1f02c29353c8f698a85514420b9f4 (diff)
downloadlinux-3.10-66055a4e7334b05354c835123ff621c5f700e56a.tar.gz
linux-3.10-66055a4e7334b05354c835123ff621c5f700e56a.tar.bz2
linux-3.10-66055a4e7334b05354c835123ff621c5f700e56a.zip
[PATCH] fix race in inotify_release
While doing some inotify stress testing, I hit the following race. In inotify_release(), it's possible for a watch to be removed from the lists in between dropping dev->mutex and taking inode->inotify_mutex. The reference we hold prevents the watch from being freed, but not from being removed. Checking the dev's idr mapping will prevent a double list_del of the same watch. Signed-off-by: Amy Griffis <amy.griffis@hp.com> Acked-by: John McCutchan <john@johnmccutchan.com> Cc: Robert Love <rml@novell.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/inotify.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/fs/inotify.c b/fs/inotify.c
index 1f50302849c..7d572533652 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -848,7 +848,11 @@ static int inotify_release(struct inode *ignored, struct file *file)
inode = watch->inode;
mutex_lock(&inode->inotify_mutex);
mutex_lock(&dev->mutex);
- remove_watch_no_event(watch, dev);
+
+ /* make sure we didn't race with another list removal */
+ if (likely(idr_find(&dev->idr, watch->wd)))
+ remove_watch_no_event(watch, dev);
+
mutex_unlock(&dev->mutex);
mutex_unlock(&inode->inotify_mutex);
put_inotify_watch(watch);