aboutsummaryrefslogtreecommitdiffstats
path: root/arch/m32r
diff options
context:
space:
mode:
authorSasha Levin <sasha.levin@oracle.com>2014-10-09 15:24:37 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2014-10-09 22:25:45 -0400
commit105d1b425303120c7681abc0761b6fc6c3f8a8e8 (patch)
treedd62771c0fc306feb10074c361bb422b3b634041 /arch/m32r
parentfs/notify/group.c: make fsnotify_final_destroy_group() static (diff)
downloadlinux-dev-105d1b425303120c7681abc0761b6fc6c3f8a8e8.tar.xz
linux-dev-105d1b425303120c7681abc0761b6fc6c3f8a8e8.zip
fsnotify: don't put user context if it was never assigned
On some failure paths we may attempt to free user context even if it wasn't assigned yet. This will cause a NULL ptr deref and a kernel BUG. The path I was looking at is in inotify_new_group(): oevent = kmalloc(sizeof(struct inotify_event_info), GFP_KERNEL); if (unlikely(!oevent)) { fsnotify_destroy_group(group); return ERR_PTR(-ENOMEM); } fsnotify_destroy_group() would get called here, but group->inotify_data.user is only getting assigned later: group->inotify_data.user = get_current_user(); Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Cc: John McCutchan <john@johnmccutchan.com> Cc: Robert Love <rlove@rlove.org> Cc: Eric Paris <eparis@parisplace.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'arch/m32r')
0 files changed, 0 insertions, 0 deletions