Reported-and-tested-by: syzbot+c34692a51b9a6ca93540@xxxxxxxxxxxxxxxxxxxxxxxxx
Fixes: 3ac70bfcde81 ("fsnotify: add helper to get mask from connector")
Signed-off-by: Amir Goldstein <amir73il@xxxxxxxxx>
---
Jan,
syzbot reported (in private email) that the reproducer did not trigger
the warning, so added tested-by.
Thanks,
Amir.
fs/notify/mark.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index 05506d60131c..d559a8ffe7ed 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -236,6 +236,13 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
if (hlist_empty(&conn->list)) {
inode = fsnotify_detach_connector_from_object(conn);
free_conn = true;
+ } else if (conn->type == FSNOTIFY_OBJ_TYPE_DETACHED) {
+ /*
+ * fsnotify_destroy_marks() detaches conn from object before
+ * put on last mark of object list and other marks on the list
+ * may still have elevated refcounts. We don't need to recalc
+ * mask nor to free_conn in that case.
+ */
} else {
__fsnotify_recalc_mask(conn);
}
--
2.7.4
