On Tue 25-04-23 09:01:20, Amir Goldstein wrote: > On Mon, Apr 24, 2023 at 7:32 PM Jan Kara <jack@xxxxxxx> wrote: > > > > When inotify_freeing_mark() races with inotify_handle_inode_event() it > > can happen that inotify_handle_inode_event() sees that i_mark->wd got > > already reset to -1 and reports this value to userspace which can > > confuse the inotify listener. Avoid the problem by validating that wd is > > sensible (and pretend the mark got removed before the event got > > generated otherwise). > > > > CC: stable@xxxxxxxxxxxxxxx > > Fixes: 7e790dd5fc93 ("inotify: fix error paths in inotify_update_watch") > > Reported-by: syzbot+4a06d4373fd52f0b2f9c@xxxxxxxxxxxxxxxxxxxxxxxxx > > Signed-off-by: Jan Kara <jack@xxxxxxx> > > Makes sense. > > Reviewed-by: Amir Goldstein <amir73il@xxxxxxxxx> Thanks. I've pulled the patch into my tree. Honza -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR