My static checker complains that if we drop the last reference then it would be a use after free. I don't know if it's possible, but really the atomic_dec(&group->num_marks); should be done while we are holding a reference to "group". Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> diff --git a/fs/notify/mark.c b/fs/notify/mark.c index 923fe4a..27e357e 100644 --- a/fs/notify/mark.c +++ b/fs/notify/mark.c @@ -262,9 +262,9 @@ int fsnotify_add_mark_locked(struct fsnotify_mark *mark, err: mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE; list_del_init(&mark->g_list); + atomic_dec(&group->num_marks); fsnotify_put_group(group); mark->group = NULL; - atomic_dec(&group->num_marks); spin_unlock(&mark->lock); -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
