Commit 7294fbd4 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'fsnotify_for_v5.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

Pull fsnotify fixes from Jan Kara:
 "One inotify and one fanotify fix"

* tag 'fsnotify_for_v5.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fanotify: Allow copying of file handle to userspace
  inotify: Fix fsnotify_mark refcount leak in inotify_update_existing_watch()
parents 54c49016 b2d22b6b
...@@ -208,6 +208,7 @@ static int copy_fid_to_user(struct fanotify_event *event, char __user *buf) ...@@ -208,6 +208,7 @@ static int copy_fid_to_user(struct fanotify_event *event, char __user *buf)
{ {
struct fanotify_event_info_fid info = { }; struct fanotify_event_info_fid info = { };
struct file_handle handle = { }; struct file_handle handle = { };
unsigned char bounce[FANOTIFY_INLINE_FH_LEN], *fh;
size_t fh_len = event->fh_len; size_t fh_len = event->fh_len;
size_t len = fanotify_event_info_len(event); size_t len = fanotify_event_info_len(event);
...@@ -233,7 +234,16 @@ static int copy_fid_to_user(struct fanotify_event *event, char __user *buf) ...@@ -233,7 +234,16 @@ static int copy_fid_to_user(struct fanotify_event *event, char __user *buf)
buf += sizeof(handle); buf += sizeof(handle);
len -= sizeof(handle); len -= sizeof(handle);
if (copy_to_user(buf, fanotify_event_fh(event), fh_len)) /*
* For an inline fh, copy through stack to exclude the copy from
* usercopy hardening protections.
*/
fh = fanotify_event_fh(event);
if (fh_len <= FANOTIFY_INLINE_FH_LEN) {
memcpy(bounce, fh, fh_len);
fh = bounce;
}
if (copy_to_user(buf, fh, fh_len))
return -EFAULT; return -EFAULT;
/* Pad with 0's */ /* Pad with 0's */
......
...@@ -519,8 +519,10 @@ static int inotify_update_existing_watch(struct fsnotify_group *group, ...@@ -519,8 +519,10 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
fsn_mark = fsnotify_find_mark(&inode->i_fsnotify_marks, group); fsn_mark = fsnotify_find_mark(&inode->i_fsnotify_marks, group);
if (!fsn_mark) if (!fsn_mark)
return -ENOENT; return -ENOENT;
else if (create) else if (create) {
return -EEXIST; ret = -EEXIST;
goto out;
}
i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark); i_mark = container_of(fsn_mark, struct inotify_inode_mark, fsn_mark);
...@@ -548,6 +550,7 @@ static int inotify_update_existing_watch(struct fsnotify_group *group, ...@@ -548,6 +550,7 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
/* return the wd */ /* return the wd */
ret = i_mark->wd; ret = i_mark->wd;
out:
/* match the get from fsnotify_find_mark() */ /* match the get from fsnotify_find_mark() */
fsnotify_put_mark(fsn_mark); fsnotify_put_mark(fsn_mark);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment