summaryrefslogtreecommitdiff
path: root/fs/nls/mac-roman.c
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2015-07-17 16:24:12 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2015-07-17 16:39:54 -0700
commita2673b6e040663bf16a552f8619e6bde9f4b9acf (patch)
tree88ccec30ae06241d16a7695b772f0fa5a1c4a053 /fs/nls/mac-roman.c
parent3581d458c39bc5e58ceeeaf51796625bc978d2eb (diff)
downloadlinux-a2673b6e040663bf16a552f8619e6bde9f4b9acf.tar.gz
fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()
fsnotify_clear_marks_by_group_flags() can race with fsnotify_destroy_marks() so when fsnotify_destroy_mark_locked() drops mark_mutex, a mark from the list iterated by fsnotify_clear_marks_by_group_flags() can be freed and we dereference free memory in the loop there. Fix the problem by keeping mark_mutex held in fsnotify_destroy_mark_locked(). The reason why we drop that mutex is that we need to call a ->freeing_mark() callback which may acquire mark_mutex again. To avoid this and similar lock inversion issues, we move the call to ->freeing_mark() callback to the kthread destroying the mark. Signed-off-by: Jan Kara <jack@suse.cz> Reported-by: Ashish Sangwan <a.sangwan@samsung.com> Suggested-by: Lino Sanfilippo <LinoSanfilippo@gmx.de> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/nls/mac-roman.c')
0 files changed, 0 insertions, 0 deletions