On Wed, 15 Jul 2015 15:21:19 +0200 Jan Kara <jack@xxxxxxxx> wrote: > fsnotify_clear_marks_by_group_flags() can race with > fsnotify_destroy_marks() so when fsnotify_destroy_mark_locked() drops > mark_mutex, a mark from the list iterated by > fsnotify_clear_marks_by_group_flags() can be freed and we dereference > free memory in the loop there. > > Fix the problem by keeping mark_mutex held in > fsnotify_destroy_mark_locked(). The reason why we drop that mutex is > that we need to call a ->freeing_mark() callback which may acquire > mark_mutex again. To avoid this and similar lock inversion issues, we > move the call to ->freeing_mark() callback to the kthread destroying the > mark. > > Reported-by: Ashish Sangwan <a.sangwan@xxxxxxxxxxx> > Suggested-by: Lino Sanfilippo <LinoSanfilippo@xxxxxx> > Signed-off-by: Jan Kara <jack@xxxxxxx> I added a cc:stable. Please let me know if you omitted this deliberately. -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
