audit: fix mark refcounting
Removing the parent of a watched file results in "kernel BUG at
add "-w /tmp/audit/dir/watched_file" to audit.rules
rm -rf /tmp/audit/dir
This is caused by fsnotify_destroy_mark() being called without an
extra reference taken by the caller.
Reported by Francesco Cosoleto here:
This is not actually a real bug in the logic, but it does hit a BUG().
Even though the mark is not pinned by a reference after the destroy, it
will not get freed because it is held by the srcu mark lock. The real
'fix' would be to take a reference under the srcu lock every time a mark
is found, but this is an expensive operation. Instead just get the
mark in the odd places, like here, where a mark might get destroyed with
the only thing keeping it from being freed being the srcu lock.
Signed-off-by: Miklos Szeredi <email@example.com>
CC: Al Viro <firstname.lastname@example.org>
CC: Eric Paris <email@example.com>
Signed-off-by: Eric Paris <firstname.lastname@example.org>
1 file changed