linux.git/fs/notify/mark.c, branch v4.17

fsnotify: convert fsnotify_mark.refcnt from atomic_t to refcount_t

2017-10-31T16:54:56+00:00

atomic_t variables are currently used to implement reference
counters with the following properties:
 - counter is initialized to 1 using atomic_set()
 - a resource is freed upon counter reaching zero
 - once counter reaches zero, its further
   increments aren't allowed
 - counter schema uses basic atomic operations
   (set, inc, inc_not_zero, dec_and_test, etc.)

Such atomic variables should be converted to a newly provided
refcount_t type and API that prevents accidental counter overflows
and underflows. This is important since overflows and underflows
can lead to use-after-free situation and be exploitable.

The variable fsnotify_mark.refcnt is used as pure reference counter.
Convert it to refcount_t and fix up the operations.

Suggested-by: Kees Cook 
Reviewed-by: David Windsor 
Reviewed-by: Hans Liljestrand 
Signed-off-by: Elena Reshetova 
Signed-off-by: Jan Kara

fsnotify: fix pinning group in fsnotify_prepare_user_wait()

2017-10-31T16:54:56+00:00

Blind increment of group's user_waits is not enough, we could be far enough
in the group's destruction that it isn't taken into account (i.e. grabbing
the mark ref afterwards doesn't guarantee that it was the ref coming from
the _group_ that was grabbed).

Instead we need to check (under lock) that the mark is still attached to
the group after having obtained a ref to the mark.  If not, skip it.

Reviewed-by: Amir Goldstein 
Signed-off-by: Miklos Szeredi 
Fixes: 9385a84d7e1f ("fsnotify: Pass fsnotify_iter_info into handle_event handler")
Cc:  # v4.12
Signed-off-by: Jan Kara

fsnotify: clean up fsnotify_prepare/finish_user_wait()

2017-10-31T16:54:56+00:00

This patch doesn't actually fix any bug, just paves the way for fixing mark
and group pinning.

Reviewed-by: Amir Goldstein 
Signed-off-by: Miklos Szeredi 
Cc:  # v4.12
Signed-off-by: Jan Kara

fsnotify: Protect bail out path of fsnotify_add_mark_locked() properly

2017-10-31T16:54:56+00:00

When fsnotify_add_mark_locked() fails it cleans up the mark it was
adding. Since the mark is already visible in group's list, we should
protect update of mark->flags with mark->lock. I'm not aware of any real
issues this could cause (since we also hold group->mark_mutex) but
better be safe and obey locking rules properly.

Reviewed-by: Amir Goldstein 
Signed-off-by: Jan Kara

fsnotify: remove a stray unlock

2017-04-24T14:41:28+00:00

We recently shifted this code around, so we're no longer holding the
lock on this path.

Fixes: 755b5bc681eb ("fsnotify: Remove indirection from mark list addition")
Signed-off-by: Dan Carpenter 
Signed-off-by: Jan Kara

fsnotify: Move ->free_mark callback to fsnotify_ops

2017-04-10T15:37:36+00:00

Pointer to ->free_mark callback unnecessarily occupies one long in each
fsnotify_mark although they are the same for all marks from one
notification group. Move the callback pointer to fsnotify_ops.

Reviewed-by: Miklos Szeredi 
Reviewed-by: Amir Goldstein 
Signed-off-by: Jan Kara

fsnotify: Add group pointer in fsnotify_init_mark()

2017-04-10T15:37:36+00:00

Currently we initialize mark->group only in fsnotify_add_mark_lock().
However we will need to access fsnotify_ops of corresponding group from
fsnotify_put_mark() so we need mark->group initialized earlier. Do that
in fsnotify_init_mark() which has a consequence that once
fsnotify_init_mark() is called on a mark, the mark has to be destroyed
by fsnotify_put_mark().

Reviewed-by: Miklos Szeredi 
Reviewed-by: Amir Goldstein 
Signed-off-by: Jan Kara

fsnotify: Remove fsnotify_detach_group_marks()

2017-04-10T15:37:36+00:00

The function is already mostly contained in what
fsnotify_clear_marks_by_group() does. Just update that function to not
select marks when all of them should be destroyed and remove
fsnotify_detach_group_marks().

Reviewed-by: Miklos Szeredi 
Reviewed-by: Amir Goldstein 
Signed-off-by: Jan Kara

fsnotify: Rename fsnotify_clear_marks_by_group_flags()

2017-04-10T15:37:36+00:00

The _flags() suffix in the function name was more confusing than
explaining so just remove it. Also rename the argument from 'flags' to
'type' to better explain what the function expects.

Reviewed-by: Miklos Szeredi 
Suggested-by: Amir Goldstein 
Reviewed-by: Amir Goldstein 
Signed-off-by: Jan Kara

fsnotify: Remove fsnotify_set_mark_{,ignored_}mask_locked()

2017-04-10T15:37:36+00:00

These helpers are now only a simple assignment and just obfuscate
what is going on. Remove them.

Reviewed-by: Miklos Szeredi 
Reviewed-by: Amir Goldstein 
Signed-off-by: Jan Kara