From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: [PATCH 25/26] audit: fix mark refcounting Date: Thu, 17 Nov 2011 17:05:05 -0500 Message-ID: <20111117220505.23481.3607.stgit@paris.rdu.redhat.com> References: <20111117220244.23481.96785.stgit@paris.rdu.redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20111117220244.23481.96785.stgit@paris.rdu.redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: viro@zeniv.linux.org.uk List-Id: linux-audit@redhat.com From: Miklos Szeredi Removing the parent of a watched file results in "kernel BUG at fs/notify/mark.c:139". To reproduce add "-w /tmp/audit/dir/watched_file" to audit.rules rm -rf /tmp/audit/dir This is caused by fsnotify_destroy_mark() being called without an extra reference taken by the caller. Reported by Francesco Cosoleto here: https://bugzilla.novell.com/show_bug.cgi?id=689860 Signed-off-by: Miklos Szeredi CC: Al Viro CC: Eric Paris CC: stable@vger.kernel.org Signed-off-by: Eric Paris --- kernel/audit_watch.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c index e683869..4270d84 100644 --- a/kernel/audit_watch.c +++ b/kernel/audit_watch.c @@ -349,7 +349,9 @@ static void audit_remove_parent_watches(struct audit_parent *parent) } mutex_unlock(&audit_filter_mutex); + audit_get_parent(parent); fsnotify_destroy_mark(&parent->mark); + audit_put_parent(parent); } /* Get path information necessary for adding watches. */