Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-09 23:00:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fanotify: fix FAN_Q_OVERFLOW case of fanotify_read()

Browse Source 
If the FAN_Q_OVERFLOW bit set in event->mask, the fanotify event
metadata will not contain a valid file descriptor, but
copy_event_to_user() didn't check for that, and unconditionally does a
fd_install() on the file descriptor.

Which in turn will cause a BUG_ON() in __fd_install().

Introduced by commit 352e3b249284 ("fanotify: sanitize failure exits in
copy_event_to_user()")

Mea culpa - missed that path ;-/

Reported-by: Alex Shi <lkml.alex@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Al Viro 2012-11-18 19:19:00 +00:00 committed by Linus Torvalds
parent 8d938105e4
commit 3587b1b097
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/notify/fanotify/fanotify_user.c
View File

@ -258,7 +258,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
if (ret)
goto out_close_fd;
fd_install(fd, f);
if (fd != FAN_NOFD)
fd_install(fd, f);
return fanotify_event_metadata.event_len;
out_close_fd: