The patch titled
A potential bug in inotify_user.c
has been added to the -mm tree. Its filename is
a-potential-bug-in-inotify_userc.patch
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: A potential bug in inotify_user.c
From: "Yan Zheng" <yanzheng@xxxxxxxx>
Following comment is at fs/inotify_user.c:287
/* coalescing: drop this event if it is a dupe of the previous */
I think the previous event in the comment should be the last event in the
link list. But inotify_dev_get_event return the first event in the list.
In addition, it doesn't check whether the list is empty
Signed-off-by: Yan Zheng<yanzheng@xxxxxxxx>
Acked-by: Robert Love <rlove@xxxxxxxxx>
Cc: John McCutchan <ttb@xxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
fs/inotify_user.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff -puN fs/inotify_user.c~a-potential-bug-in-inotify_userc fs/inotify_user.c
--- a/fs/inotify_user.c~a-potential-bug-in-inotify_userc
+++ a/fs/inotify_user.c
@@ -248,6 +248,19 @@ inotify_dev_get_event(struct inotify_dev
}
/*
+ * inotify_dev_get_last_event - return the last event in the given dev's queue
+ *
+ * Caller must hold dev->ev_mutex.
+ */
+static inline struct inotify_kernel_event *
+inotify_dev_get_last_event(struct inotify_device *dev)
+{
+ if (list_empty(&dev->events))
+ return NULL;
+ return list_entry(dev->events.prev, struct inotify_kernel_event, list);
+}
+
+/*
* inotify_dev_queue_event - event handler registered with core inotify, adds
* a new event to the given device
*
@@ -273,7 +286,7 @@ static void inotify_dev_queue_event(stru
put_inotify_watch(w); /* final put */
/* coalescing: drop this event if it is a dupe of the previous */
- last = inotify_dev_get_event(dev);
+ last = inotify_dev_get_last_event(dev);
if (last && last->event.mask == mask && last->event.wd == wd &&
last->event.cookie == cookie) {
const char *lastname = last->name;
_
Patches currently in -mm which might be from yanzheng@xxxxxxxx are
a-potential-bug-in-inotify_userc.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
