Commit 66055a4e authored by Amy Griffis's avatar Amy Griffis Committed by Linus Torvalds
Browse files

[PATCH] fix race in inotify_release

While doing some inotify stress testing, I hit the following race.  In
inotify_release(), it's possible for a watch to be removed from the lists
in between dropping dev->mutex and taking inode->inotify_mutex.  The
reference we hold prevents the watch from being freed, but not from being

Checking the dev's idr mapping will prevent a double list_del of the
same watch.
Signed-off-by: default avatarAmy Griffis <>
Acked-by: default avatarJohn McCutchan <>
Cc: Robert Love <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent 12783b00
......@@ -848,7 +848,11 @@ static int inotify_release(struct inode *ignored, struct file *file)
inode = watch->inode;
remove_watch_no_event(watch, dev);
/* make sure we didn't race with another list removal */
if (likely(idr_find(&dev->idr, watch->wd)))
remove_watch_no_event(watch, dev);
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment