From: Eric Paris Date: Tue, 11 May 2010 21:17:40 +0000 (-0400) Subject: inotify: race use after free/double free in inotify inode marks X-Git-Tag: v2.6.34~13^2~1 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e08733446e72b983fed850fc5d8bd21b386feb29;p=pandora-kernel.git inotify: race use after free/double free in inotify inode marks There is a race in the inotify add/rm watch code. A task can find and remove a mark which doesn't have all of it's references. This can result in a use after free/double free situation. Task A Task B ------------ ----------- inotify_new_watch() allocate a mark (refcnt == 1) add it to the idr inotify_rm_watch() inotify_remove_from_idr() fsnotify_put_mark() refcnt hits 0, free take reference because we are on idr [at this point it is a use after free] [time goes on] refcnt may hit 0 again, double free The fix is to take the reference BEFORE the object can be found in the idr. Signed-off-by: Eric Paris Cc: --- Reading git-diff-tree failed