![]() fanotify_get_response() calls fsnotify_remove_event() when it finds that
group is being released from fanotify_release() (bypass_perm is set).
However the event it removes need not be only in the group's notification
queue but it can have already moved to access_list (userspace read the
event before closing the fanotify instance fd) which is protected by a
different lock. Thus when fsnotify_remove_event() races with
fanotify_release() operating on access_list, the list can get corrupted.
Fix the problem by moving all the logic removing permission events from
the lists to one place - fanotify_release().
Fixes:
|
||
---|---|---|
.. | ||
dnotify | ||
fanotify | ||
inotify | ||
fdinfo.c | ||
fdinfo.h | ||
fsnotify.c | ||
fsnotify.h | ||
group.c | ||
inode_mark.c | ||
Kconfig | ||
Makefile | ||
mark.c | ||
notification.c | ||
vfsmount_mark.c |