The patch titled
Subject: fsnotify: don't BUG in fsnotify_destroy_mark()
has been removed from the -mm tree. Its filename was
fsnotify-dont-bug-in-fsnotify_destroy_mark.patch
This patch was dropped because it was merged into mainline or a subsystem tree
The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
From: Miklos Szeredi <mszeredi@xxxxxxx>
Subject: fsnotify: don't BUG in fsnotify_destroy_mark()
Removing the parent of a watched file results in "kernel BUG at
fs/notify/mark.c:139".
To reproduce
add "-w /tmp/audit/dir/watched_file" to audit.rules
rm -rf /tmp/audit/dir
This is caused by fsnotify_destroy_mark() being called without an
extra reference taken by the caller.
Reported by Francesco Cosoleto here:
https://bugzilla.novell.com/show_bug.cgi?id=689860
Fix by removing the BUG_ON and adding a comment about not accessing mark after
the iput.
Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxx>
Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
fs/notify/mark.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff -puN fs/notify/mark.c~fsnotify-dont-bug-in-fsnotify_destroy_mark fs/notify/mark.c
--- a/fs/notify/mark.c~fsnotify-dont-bug-in-fsnotify_destroy_mark
+++ a/fs/notify/mark.c
@@ -124,9 +124,6 @@ void fsnotify_destroy_mark(struct fsnoti
mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
- /* 1 from caller and 1 for being on i_list/g_list */
- BUG_ON(atomic_read(&mark->refcnt) < 2);
-
spin_lock(&group->mark_lock);
if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) {
@@ -171,6 +168,11 @@ void fsnotify_destroy_mark(struct fsnoti
iput(inode);
/*
+ * We don't necessarily have a ref on mark from caller so the above iput
+ * may have already destroyed it. Don't touch from now on.
+ */
+
+ /*
* it's possible that this group tried to destroy itself, but this
* this mark was simultaneously being freed by inode. If that's the
* case, we finish freeing the group here.
_
Patches currently in -mm which might be from mszeredi@xxxxxxx are
origin.patch
linux-next.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
