From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Kara Subject: Re: [PATCH 1/3] fsnotify: Fix oops in fsnotify_clear_marks_by_group_flags() Date: Thu, 16 Jul 2015 08:50:45 +0200 Message-ID: <20150716065045.GA22847@quack.suse.cz> References: <1436966481-12517-1-git-send-email-jack@suse.com> <1436966481-12517-2-git-send-email-jack@suse.com> <20150715134115.245dff27ab37c746a3ee8a21@linux-foundation.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Jan Kara , linux-fsdevel@vger.kernel.org, Jan Kara To: Andrew Morton Return-path: Received: from cantor2.suse.de ([195.135.220.15]:40994 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753498AbbGPGuv (ORCPT ); Thu, 16 Jul 2015 02:50:51 -0400 Content-Disposition: inline In-Reply-To: <20150715134115.245dff27ab37c746a3ee8a21@linux-foundation.org> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Wed 15-07-15 13:41:15, Andrew Morton wrote: > On Wed, 15 Jul 2015 15:21:19 +0200 Jan Kara wrote: > > > fsnotify_clear_marks_by_group_flags() can race with > > fsnotify_destroy_marks() so when fsnotify_destroy_mark_locked() drops > > mark_mutex, a mark from the list iterated by > > fsnotify_clear_marks_by_group_flags() can be freed and we dereference > > free memory in the loop there. > > > > Fix the problem by keeping mark_mutex held in > > fsnotify_destroy_mark_locked(). The reason why we drop that mutex is > > that we need to call a ->freeing_mark() callback which may acquire > > mark_mutex again. To avoid this and similar lock inversion issues, we > > move the call to ->freeing_mark() callback to the kthread destroying the > > mark. > > > > Reported-by: Ashish Sangwan > > Suggested-by: Lino Sanfilippo > > Signed-off-by: Jan Kara > > I added a cc:stable. Please let me know if you omitted this > deliberately. No, that was a mistake on my side. Thanks for adding it. Honza -- Jan Kara SUSE Labs, CR