On Wed 15-07-15 13:41:15, Andrew Morton wrote: > On Wed, 15 Jul 2015 15:21:19 +0200 Jan Kara <jack@xxxxxxxx> wrote: > > > fsnotify_clear_marks_by_group_flags() can race with > > fsnotify_destroy_marks() so when fsnotify_destroy_mark_locked() drops > > mark_mutex, a mark from the list iterated by > > fsnotify_clear_marks_by_group_flags() can be freed and we dereference > > free memory in the loop there. > > > > Fix the problem by keeping mark_mutex held in > > fsnotify_destroy_mark_locked(). The reason why we drop that mutex is > > that we need to call a ->freeing_mark() callback which may acquire > > mark_mutex again. To avoid this and similar lock inversion issues, we > > move the call to ->freeing_mark() callback to the kthread destroying the > > mark. > > > > Reported-by: Ashish Sangwan <a.sangwan@xxxxxxxxxxx> > > Suggested-by: Lino Sanfilippo <LinoSanfilippo@xxxxxx> > > Signed-off-by: Jan Kara <jack@xxxxxxx> > > I added a cc:stable. Please let me know if you omitted this > deliberately. No, that was a mistake on my side. Thanks for adding it. Honza -- Jan Kara <jack@xxxxxxx> SUSE Labs, CR -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
