On Tue 25-04-23 09:01:20, Amir Goldstein wrote:
> On Mon, Apr 24, 2023 at 7:32 PM Jan Kara <jack@xxxxxxx> wrote:
> >
> > When inotify_freeing_mark() races with inotify_handle_inode_event() it
> > can happen that inotify_handle_inode_event() sees that i_mark->wd got
> > already reset to -1 and reports this value to userspace which can
> > confuse the inotify listener. Avoid the problem by validating that wd is
> > sensible (and pretend the mark got removed before the event got
> > generated otherwise).
> >
> > CC: stable@xxxxxxxxxxxxxxx
> > Fixes: 7e790dd5fc93 ("inotify: fix error paths in inotify_update_watch")
> > Reported-by: syzbot+4a06d4373fd52f0b2f9c@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Signed-off-by: Jan Kara <jack@xxxxxxx>
>
> Makes sense.
>
> Reviewed-by: Amir Goldstein <amir73il@xxxxxxxxx>
Thanks. I've pulled the patch into my tree.
Honza
--
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR
