On Sat, 7 Dec 2024 at 22:17, Christian Brauner <brauner@xxxxxxxxxx> wrote:
> I took another look at f{a,s}notify. There's no copy_to_user() happening
> when adding events via fsnotify(). It happens when the caller retrieves
> events via read() from the relevant notify file descriptor. We should
> still move calls to notify_mounts() out of the namespace semaphore
> whenever we can though.
Doesn't work. After unlocking namespace_sem deref of mnt->prev_ns
might lead to UAF.
Anyway, I don't think this is an issue, especially with the downgrade
to read that you added.
Thanks,
Miklos
