audit: fix mark refcounting

Removing the parent of a watched file results in "kernel BUG at

To reproduce

  add "-w /tmp/audit/dir/watched_file" to audit.rules
  rm -rf /tmp/audit/dir

This is caused by fsnotify_destroy_mark() being called without an
extra reference taken by the caller.

Reported by Francesco Cosoleto here:

This is not actually a real bug in the logic, but it does hit a BUG().
Even though the mark is not pinned by a reference after the destroy, it
will not get freed because it is held by the srcu mark lock.  The real
'fix' would be to take a reference under the srcu lock every time a mark
is found, but this is an expensive operation.  Instead just get the
mark in the odd places, like here, where a mark might get destroyed with
the only thing keeping it from being freed being the srcu lock.

Signed-off-by: Miklos Szeredi <>
CC: Al Viro <>
CC: Eric Paris <>
Signed-off-by: Eric Paris <>
1 file changed