xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fanotify: Fix use after free for permission events

Browse Source 
Currently struct fanotify_event_info has been destroyed immediately
after reporting its contents to userspace. However that is wrong for
permission events because those need to stay around until userspace
provides response which is filled back in fanotify_event_info. So change
to code to free permission events only after we have got the response
from userspace.

Reported-and-tested-by: Jiri Kosina <jkosina@suse.cz>
Reported-and-tested-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: Jan Kara <jack@suse.cz>
This commit is contained in:
Jan Kara
2014-01-28 21:38:06 +01:00
parent 83c0e1b442
commit 8581679424
3 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
fs/notify/fanotify/fanotify_user.c
View File

@@ -319,7 +319,12 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
if (IS_ERR(kevent))
break;
ret = copy_event_to_user(group, kevent, buf);
fsnotify_destroy_event(group, kevent);
/*
* Permission events get destroyed after we
* receive response
*/
if (!(kevent->mask & FAN_ALL_PERM_EVENTS))
fsnotify_destroy_event(group, kevent);
if (ret < 0)
break;
buf += ret;