diff options
-rw-r--r-- | recipes-kernel/linux/files/0001-fsnotify-fix-oops-in-fsnotify_clear_marks_by_group_f.patch | 80 | ||||
-rw-r--r-- | recipes-kernel/linux/linux-qoriq-common.inc | 1 |
2 files changed, 81 insertions, 0 deletions
diff --git a/recipes-kernel/linux/files/0001-fsnotify-fix-oops-in-fsnotify_clear_marks_by_group_f.patch b/recipes-kernel/linux/files/0001-fsnotify-fix-oops-in-fsnotify_clear_marks_by_group_f.patch new file mode 100644 index 0000000..250c8db --- /dev/null +++ b/recipes-kernel/linux/files/0001-fsnotify-fix-oops-in-fsnotify_clear_marks_by_group_f.patch | |||
@@ -0,0 +1,80 @@ | |||
1 | From 8f2f3eb59dff4ec538de55f2e0592fec85966aab Mon Sep 17 00:00:00 2001 | ||
2 | From: Jan Kara <jack@suse.com> | ||
3 | Date: Thu, 6 Aug 2015 15:46:42 -0700 | ||
4 | Subject: [PATCH] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() | ||
5 | |||
6 | fsnotify_clear_marks_by_group_flags() can race with | ||
7 | fsnotify_destroy_marks() so that when fsnotify_destroy_mark_locked() | ||
8 | drops mark_mutex, a mark from the list iterated by | ||
9 | fsnotify_clear_marks_by_group_flags() can be freed and thus the next | ||
10 | entry pointer we have cached may become stale and we dereference free | ||
11 | memory. | ||
12 | |||
13 | Fix the problem by first moving marks to free to a special private list | ||
14 | and then always free the first entry in the special list. This method | ||
15 | is safe even when entries from the list can disappear once we drop the | ||
16 | lock. | ||
17 | |||
18 | Upstream-Status: Backported | ||
19 | |||
20 | Signed-off-by: Jan Kara <jack@suse.com> | ||
21 | Reported-by: Ashish Sangwan <a.sangwan@samsung.com> | ||
22 | Reviewed-by: Ashish Sangwan <a.sangwan@samsung.com> | ||
23 | Cc: Lino Sanfilippo <LinoSanfilippo@gmx.de> | ||
24 | Cc: <stable@vger.kernel.org> | ||
25 | Signed-off-by: Andrew Morton <akpm@linux-foundation.org> | ||
26 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | ||
27 | Signed-off-by: Adrian Dudau <adrian.dudau@enea.com> | ||
28 | --- | ||
29 | fs/notify/mark.c | 30 +++++++++++++++++++++++++----- | ||
30 | 1 file changed, 25 insertions(+), 5 deletions(-) | ||
31 | |||
32 | diff --git a/fs/notify/mark.c b/fs/notify/mark.c | ||
33 | index 92e48c7..39ddcaf 100644 | ||
34 | --- a/fs/notify/mark.c | ||
35 | +++ b/fs/notify/mark.c | ||
36 | @@ -412,16 +412,36 @@ void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group, | ||
37 | unsigned int flags) | ||
38 | { | ||
39 | struct fsnotify_mark *lmark, *mark; | ||
40 | + LIST_HEAD(to_free); | ||
41 | |||
42 | + /* | ||
43 | + * We have to be really careful here. Anytime we drop mark_mutex, e.g. | ||
44 | + * fsnotify_clear_marks_by_inode() can come and free marks. Even in our | ||
45 | + * to_free list so we have to use mark_mutex even when accessing that | ||
46 | + * list. And freeing mark requires us to drop mark_mutex. So we can | ||
47 | + * reliably free only the first mark in the list. That's why we first | ||
48 | + * move marks to free to to_free list in one go and then free marks in | ||
49 | + * to_free list one by one. | ||
50 | + */ | ||
51 | mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING); | ||
52 | list_for_each_entry_safe(mark, lmark, &group->marks_list, g_list) { | ||
53 | - if (mark->flags & flags) { | ||
54 | - fsnotify_get_mark(mark); | ||
55 | - fsnotify_destroy_mark_locked(mark, group); | ||
56 | - fsnotify_put_mark(mark); | ||
57 | - } | ||
58 | + if (mark->flags & flags) | ||
59 | + list_move(&mark->g_list, &to_free); | ||
60 | } | ||
61 | mutex_unlock(&group->mark_mutex); | ||
62 | + | ||
63 | + while (1) { | ||
64 | + mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING); | ||
65 | + if (list_empty(&to_free)) { | ||
66 | + mutex_unlock(&group->mark_mutex); | ||
67 | + break; | ||
68 | + } | ||
69 | + mark = list_first_entry(&to_free, struct fsnotify_mark, g_list); | ||
70 | + fsnotify_get_mark(mark); | ||
71 | + fsnotify_destroy_mark_locked(mark, group); | ||
72 | + mutex_unlock(&group->mark_mutex); | ||
73 | + fsnotify_put_mark(mark); | ||
74 | + } | ||
75 | } | ||
76 | |||
77 | /* | ||
78 | -- | ||
79 | 1.9.1 | ||
80 | |||
diff --git a/recipes-kernel/linux/linux-qoriq-common.inc b/recipes-kernel/linux/linux-qoriq-common.inc index 8270093..d6f0565 100644 --- a/recipes-kernel/linux/linux-qoriq-common.inc +++ b/recipes-kernel/linux/linux-qoriq-common.inc | |||
@@ -5,6 +5,7 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/files:" | |||
5 | SRC_URI += "file://b4860-hard_irq_disable-bug.patch \ | 5 | SRC_URI += "file://b4860-hard_irq_disable-bug.patch \ |
6 | file://0001-sdhci-fix-Timeout-error-messages.patch \ | 6 | file://0001-sdhci-fix-Timeout-error-messages.patch \ |
7 | file://powerpc-fsl-booke64-Set-vmemmap_psize-to-4K.patch \ | 7 | file://powerpc-fsl-booke64-Set-vmemmap_psize-to-4K.patch \ |
8 | file://0001-fsnotify-fix-oops-in-fsnotify_clear_marks_by_group_f.patch \ | ||
8 | " | 9 | " |
9 | 10 | ||
10 | ENEA_KERNEL_FRAGMENTS += "\ | 11 | ENEA_KERNEL_FRAGMENTS += "\ |