![]() fsnotify_unmount_inodes() plays complex tricks to pin next inode in the sb->s_inodes list when iterating over all inodes. Furthermore the code has a bug that if the current inode is the last on i_sb_list that does not have e.g. I_FREEING set, then we leave next_i pointing to inode which may get removed from the i_sb_list once we drop s_inode_list_lock thus resulting in use-after-free issues (usually manifesting as infinite looping in fsnotify_unmount_inodes()). Fix the problem by keeping current inode pinned somewhat longer. Then we can make the code much simpler and standard. CC: stable@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> |
||
---|---|---|
.. | ||
dnotify | ||
fanotify | ||
inotify | ||
fdinfo.c | ||
fdinfo.h | ||
fsnotify.c | ||
fsnotify.h | ||
group.c | ||
inode_mark.c | ||
Kconfig | ||
Makefile | ||
mark.c | ||
notification.c | ||
vfsmount_mark.c |