• Eric Paris's avatar
    inotify: race use after free/double free in inotify inode marks · e0873344
    Eric Paris authored
    There is a race in the inotify add/rm watch code.  A task can find and
    remove a mark which doesn't have all of it's references.  This can
    result in a use after free/double free situation.
    
    Task A					Task B
    ------------				-----------
    inotify_new_watch()
     allocate a mark (refcnt == 1)
     add it to the idr
    					inotify_rm_watch()
    					 inotify_remove_from_idr()
    					  fsnotify_put_mark()
    					      refcnt hits 0, free
     take reference because we are on idr
     [at this point it is a use after free]
     [time goes on]
     refcnt may hit 0 again, double free
    
    The fix is to take the reference BEFORE the object can be found in the
    idr.
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    Cc: <stable@kernel.org>
    e0873344
inotify_user.c 19.5 KB