linux-stable.git/fs/notify, branch linux-3.7.y

inotify: remove broken mask checks causing unmount to be EINVAL

2013-02-27T17:21:09+00:00

commit 676a0675cf9200ac047fb50825f80867b3bb733b upstream.

Running the command:

	inotifywait -e unmount /mnt/disk

immediately aborts with a -EINVAL return code.  This is however a valid
parameter.  This abort occurs only if unmount is the sole event
parameter.  If other event parameters are supplied, then the unmount
event wait will work.

The problem was introduced by commit 44b350fc23e ("inotify: Fix mask
checks").  In that commit, it states:

	The mask checks in inotify_update_existing_watch() and
	inotify_new_watch() are useless because inotify_arg_to_mask()
	sets FS_IN_IGNORED and FS_EVENT_ON_CHILD bits anyway.

But instead of removing the useless checks, it did this:

	        mask = inotify_arg_to_mask(arg);
	-       if (unlikely(!mask))
	+       if (unlikely(!(mask & IN_ALL_EVENTS)))
	                return -EINVAL;

The problem is that IN_ALL_EVENTS doesn't include IN_UNMOUNT, and other
parts of the code keep IN_UNMOUNT separate from IN_ALL_EVENTS.  So the
check should be:

	if (unlikely(!(mask & (IN_ALL_EVENTS | IN_UNMOUNT))))

But inotify_arg_to_mask(arg) always sets the IN_UNMOUNT bit in the mask
anyway, so the check is always going to pass and thus should simply be
removed.  Also note that inotify_arg_to_mask completely controls what
mask bits get set from arg, there's no way for invalid bits to get
enabled there.

Lets fix it by simply removing the useless broken checks.

Signed-off-by: Jim Somerville 
Signed-off-by: Paul Gortmaker 
Cc: Jerome Marchand 
Cc: John McCutchan 
Cc: Robert Love 
Cc: Eric Paris 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

fanotify: fix FAN_Q_OVERFLOW case of fanotify_read()

2012-11-18T19:30:00+00:00

If the FAN_Q_OVERFLOW bit set in event->mask, the fanotify event
metadata will not contain a valid file descriptor, but
copy_event_to_user() didn't check for that, and unconditionally does a
fd_install() on the file descriptor.

Which in turn will cause a BUG_ON() in __fd_install().

Introduced by commit 352e3b249284 ("fanotify: sanitize failure exits in
copy_event_to_user()")

Mea culpa - missed that path ;-/

Reported-by: Alex Shi 
Signed-off-by: Al Viro 
Signed-off-by: Linus Torvalds

fanotify: fix missing break

2012-11-09T05:41:47+00:00

Anders Blomdell noted in 2010 that Fanotify lost events and provided a
test case.  Eric Paris confirmed it was a bug and posted a fix to the
list

  https://groups.google.com/forum/?fromgroups=#!topic/linux.kernel/RrJfTfyW2BE

but never applied it.  Repeated attempts over time to actually get him
to apply it have never had a reply from anyone who has raised it

So apply it anyway

Signed-off-by: Alan Cox 
Reported-by: Anders Blomdell 
Cc: Eric Paris 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

switch simple cases of fget_light to fdget

2012-09-27T02:20:08+00:00

Signed-off-by: Al Viro

fanotify: sanitize failure exits in copy_event_to_user()

2012-09-27T01:08:52+00:00

* do copy_to_user() before prepare_for_access_response(); that kills
the need in remove_access_response().
* don't do fd_install() until we are past the last possible failure
exit.  Don't use sys_close() on cleanup side - just put_unused_fd()
and fput().  Less racy that way...

Signed-off-by: Al Viro

switch dentry_open() to struct path, make it grab references itself

2012-07-22T20:01:29+00:00

Signed-off-by: Al Viro

vfs: switch i_dentry/d_alias to hlist

2012-07-14T12:32:55+00:00

Signed-off-by: Al Viro

fsnotify: remove unused parameter from send_to_group()

2012-05-31T01:04:53+00:00

We don't use "mnt" anymore in send_to_group() after 1968f5eed5 ("fanotify:
use both marks when possible") was applied.

Signed-off-by: Dan Carpenter 
Cc: Al Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Al Viro

fs/notify/notification.c: make subsys_initcall function static

2012-03-23T23:58:31+00:00

Signed-off-by: H Hartley Sweeten 
Cc: Eric Dumazet 
Cc: Mike Frysinger 
Cc: Arun Sharma 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fsnotify: don't BUG in fsnotify_destroy_mark()

2012-01-15T02:01:42+00:00

Removing the parent of a watched file results in "kernel BUG at
fs/notify/mark.c:139".

To reproduce

  add "-w /tmp/audit/dir/watched_file" to audit.rules
  rm -rf /tmp/audit/dir

This is caused by fsnotify_destroy_mark() being called without an
extra reference taken by the caller.

Reported by Francesco Cosoleto here:

  https://bugzilla.novell.com/show_bug.cgi?id=689860

Fix by removing the BUG_ON and adding a comment about not accessing mark after
the iput.

Signed-off-by: Miklos Szeredi 
CC: stable@vger.kernel.org
Signed-off-by: Linus Torvalds