From patchwork Tue Oct 31 16:15:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kara X-Patchwork-Id: 10034903 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 1578B602B9 for ; Tue, 31 Oct 2017 16:15:14 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 05B412625B for ; Tue, 31 Oct 2017 16:15:14 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id EEC0628BFE; Tue, 31 Oct 2017 16:15:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 72A992625B for ; Tue, 31 Oct 2017 16:15:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753641AbdJaQPL (ORCPT ); Tue, 31 Oct 2017 12:15:11 -0400 Received: from mx2.suse.de ([195.135.220.15]:39180 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753342AbdJaQPL (ORCPT ); Tue, 31 Oct 2017 12:15:11 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 3A586AC08; Tue, 31 Oct 2017 16:15:10 +0000 (UTC) Received: by quack2.suse.cz (Postfix, from userid 1000) id 04F691E1164; Tue, 31 Oct 2017 17:15:10 +0100 (CET) Date: Tue, 31 Oct 2017 17:15:10 +0100 From: Jan Kara To: Amir Goldstein Cc: Jan Kara , linux-fsdevel Subject: Re: [PATCH 1/2] dnotify: Handle errors from fsnotify_add_mark_locked() in fcntl_dirnotify() Message-ID: <20171031161510.GE26128@quack2.suse.cz> References: <20171031093342.25216-1-jack@suse.cz> <20171031093342.25216-2-jack@suse.cz> <20171031154557.GC26128@quack2.suse.cz> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20171031154557.GC26128@quack2.suse.cz> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Tue 31-10-17 16:45:57, Jan Kara wrote: > On Tue 31-10-17 14:11:49, Amir Goldstein wrote: > > On Tue, Oct 31, 2017 at 11:33 AM, Jan Kara wrote: > > > Signed-off-by: Jan Kara > > > --- > > > fs/notify/dnotify/dnotify.c | 5 ++++- > > > 1 file changed, 4 insertions(+), 1 deletion(-) > > > > > > diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c > > > index cba328315929..a50183bd0ab9 100644 > > > --- a/fs/notify/dnotify/dnotify.c > > > +++ b/fs/notify/dnotify/dnotify.c > > > @@ -319,7 +319,9 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) > > > dn_mark = container_of(fsn_mark, struct dnotify_mark, fsn_mark); > > > spin_lock(&fsn_mark->lock); > > > } else { > > > - fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0); > > > + error = fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0); > > > + if (error) > > > + goto out_err; > > > > out_err is not unlocking dnotify_group->mark_mutex, and probably need to > > put fsn_mark as well? > > Argh, good point about mark_mutex (I wonder how come this didn't deadlock > when I've tested it). You don't need to put fsn_mark - that is guaranteed > to be NULL here. Attached is a new version of the patch. Honza Reviewed-by: Amir Goldstein From 54abcb76cd57877794e2007ac944d8437baf49c1 Mon Sep 17 00:00:00 2001 From: Jan Kara Date: Tue, 31 Oct 2017 09:53:28 +0100 Subject: [PATCH 1/2] dnotify: Handle errors from fsnotify_add_mark_locked() in fcntl_dirnotify() fsnotify_add_mark_locked() can fail but we do not check its return value. This didn't matter before commit 9dd813c15b2c "fsnotify: Move mark list head from object into dedicated structure" as none of possible failures could happen for dnotify but after that commit -ENOMEM can be returned. Handle this error properly in fcntl_dirnotify() as otherwise we just hit BUG_ON(dn_mark->dn) in dnotify_free_mark(). Reported-by: syzkaller Fixes: 9dd813c15b2c101168808d4f5941a29985758973 Signed-off-by: Jan Kara --- fs/notify/dnotify/dnotify.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c index cba328315929..63a1ca4b9dee 100644 --- a/fs/notify/dnotify/dnotify.c +++ b/fs/notify/dnotify/dnotify.c @@ -319,7 +319,11 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) dn_mark = container_of(fsn_mark, struct dnotify_mark, fsn_mark); spin_lock(&fsn_mark->lock); } else { - fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0); + error = fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0); + if (error) { + mutex_unlock(&dnotify_group->mark_mutex); + goto out_err; + } spin_lock(&new_fsn_mark->lock); fsn_mark = new_fsn_mark; dn_mark = new_dn_mark; @@ -345,6 +349,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) */ if (dn_mark == new_dn_mark) destroy = 1; + error = 0; goto out; } -- 2.12.3