From: Al Viro <viro@ZenIV.linux.org.uk>
Date: Sun, 18 Nov 2012 19:19:00 +0000 (+0000)
Subject: fanotify: fix FAN_Q_OVERFLOW case of fanotify_read()
X-Git-Tag: v3.7-rc7~31
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3587b1b097d70c2eb9fee95ea7995d13c05f66e5;p=pandora-kernel.git

fanotify: fix FAN_Q_OVERFLOW case of fanotify_read()

If the FAN_Q_OVERFLOW bit set in event->mask, the fanotify event
metadata will not contain a valid file descriptor, but
copy_event_to_user() didn't check for that, and unconditionally does a
fd_install() on the file descriptor.

Which in turn will cause a BUG_ON() in __fd_install().

Introduced by commit 352e3b249284 ("fanotify: sanitize failure exits in
copy_event_to_user()")

Mea culpa - missed that path ;-/

Reported-by: Alex Shi <lkml.alex@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

Reading git-diff-tree failed