Commit 3587b1b0 authored by Al Viro's avatar Al Viro Committed by Linus Torvalds

fanotify: fix FAN_Q_OVERFLOW case of fanotify_read()

If the FAN_Q_OVERFLOW bit set in event->mask, the fanotify event
metadata will not contain a valid file descriptor, but
copy_event_to_user() didn't check for that, and unconditionally does a
fd_install() on the file descriptor.

Which in turn will cause a BUG_ON() in __fd_install().

Introduced by commit 352e3b24 ("fanotify: sanitize failure exits in
copy_event_to_user()")

Mea culpa - missed that path ;-/
Reported-by: default avatarAlex Shi <lkml.alex@gmail.com>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 8d938105
...@@ -258,6 +258,7 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group, ...@@ -258,6 +258,7 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
if (ret) if (ret)
goto out_close_fd; goto out_close_fd;
if (fd != FAN_NOFD)
fd_install(fd, f); fd_install(fd, f);
return fanotify_event_metadata.event_len; return fanotify_event_metadata.event_len;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment