• Eric Paris's avatar
    inotify: fix double free/corruption of stuct user · d0de4dc5
    Eric Paris authored
    On an error path in inotify_init1 a normal user can trigger a double
    free of struct user.  This is a regression introduced by a2ae4cc9
    ("inotify: stop kernel memory leak on file creation failure").
    
    We fix this by making sure that if a group exists the user reference is
    dropped when the group is cleaned up.  We should not explictly drop the
    reference on error and also drop the reference when the group is cleaned
    up.
    
    The new lifetime rules are that an inotify group lives from
    inotify_new_group to the last fsnotify_put_group.  Since the struct user
    and inotify_devs are directly tied to this lifetime they are only
    changed/updated in those two locations.  We get rid of all special
    casing of struct user or user->inotify_devs.
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    Cc: stable@kernel.org (2.6.37 and up)
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    d0de4dc5
inotify_user.c 22.1 KB