Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'audit-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs
Pull audit-tree fixes from Miklos Szeredi:
"The audit subsystem maintainers (Al and Eric) are not responding to
repeated resends. Eric did ack them a while ago, but no response
since then. So I'm sending these directly to you."
* 'audit-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
audit: clean up refcounting in audit-tree
audit: fix refcounting in audit-tree
audit: don't free_chunk() after fsnotify_add_mark()
+12
-7
+12
-7
kernel/audit_tree.c
+12
-7
kernel/audit_tree.c
···
250
250
spin_unlock(&hash_lock);
251
251
spin_unlock(&entry->lock);
252
252
fsnotify_destroy_mark(entry);
253
-
fsnotify_put_mark(entry);
254
253
goto out;
255
254
}
256
255
···
258
259
259
260
fsnotify_duplicate_mark(&new->mark, entry);
260
261
if (fsnotify_add_mark(&new->mark, new->mark.group, new->mark.i.inode, NULL, 1)) {
261
-
free_chunk(new);
262
+
fsnotify_put_mark(&new->mark);
262
263
goto Fallback;
263
264
}
264
265
···
292
293
spin_unlock(&hash_lock);
293
294
spin_unlock(&entry->lock);
294
295
fsnotify_destroy_mark(entry);
295
-
fsnotify_put_mark(entry);
296
+
fsnotify_put_mark(&new->mark); /* drop initial reference */
296
297
goto out;
297
298
298
299
Fallback:
···
321
322
322
323
entry = &chunk->mark;
323
324
if (fsnotify_add_mark(entry, audit_tree_group, inode, NULL, 0)) {
324
-
free_chunk(chunk);
325
+
fsnotify_put_mark(entry);
325
326
return -ENOSPC;
326
327
}
327
328
···
346
347
insert_hash(chunk);
347
348
spin_unlock(&hash_lock);
348
349
spin_unlock(&entry->lock);
350
+
fsnotify_put_mark(entry); /* drop initial reference */
349
351
return 0;
350
352
}
351
353
···
396
396
fsnotify_duplicate_mark(chunk_entry, old_entry);
397
397
if (fsnotify_add_mark(chunk_entry, chunk_entry->group, chunk_entry->i.inode, NULL, 1)) {
398
398
spin_unlock(&old_entry->lock);
399
-
free_chunk(chunk);
399
+
fsnotify_put_mark(chunk_entry);
400
400
fsnotify_put_mark(old_entry);
401
401
return -ENOSPC;
402
402
}
···
444
444
spin_unlock(&chunk_entry->lock);
445
445
spin_unlock(&old_entry->lock);
446
446
fsnotify_destroy_mark(old_entry);
447
+
fsnotify_put_mark(chunk_entry); /* drop initial reference */
447
448
fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */
448
-
fsnotify_put_mark(old_entry); /* and kill it */
449
449
return 0;
450
450
}
451
451
···
916
916
struct audit_chunk *chunk = container_of(entry, struct audit_chunk, mark);
917
917
918
918
evict_chunk(chunk);
919
-
fsnotify_put_mark(entry);
919
+
920
+
/*
921
+
* We are guaranteed to have at least one reference to the mark from
922
+
* either the inode or the caller of fsnotify_destroy_mark().
923
+
*/
924
+
BUG_ON(atomic_read(&entry->refcnt) < 1);
920
925
}
921
926
922
927
static bool audit_tree_send_event(struct fsnotify_group *group, struct inode *inode,