diff options
| -rw-r--r-- | fs/notify/fanotify/fanotify.c | 21 |
1 files changed, 16 insertions, 5 deletions
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c index 95a330d2f8a1..4feed8601e29 100644 --- a/fs/notify/fanotify/fanotify.c +++ b/fs/notify/fanotify/fanotify.c @@ -27,6 +27,7 @@ static bool should_merge(struct fsnotify_event *old, struct fsnotify_event *new) return false; } +/* Note, if we return an event in *arg that a reference is being held... */ static int fanotify_merge(struct list_head *list, struct fsnotify_event *event, void **arg) @@ -34,17 +35,22 @@ static int fanotify_merge(struct list_head *list, struct fsnotify_event_holder *test_holder; struct fsnotify_event *test_event; struct fsnotify_event *new_event; + struct fsnotify_event **return_event = (struct fsnotify_event **)arg; int ret = 0; pr_debug("%s: list=%p event=%p\n", __func__, list, event); + *return_event = NULL; + /* and the list better be locked by something too! */ list_for_each_entry_reverse(test_holder, list, event_list) { test_event = test_holder->event; if (should_merge(test_event, event)) { - ret = -EEXIST; + fsnotify_get_event(test_event); + *return_event = test_event; + ret = -EEXIST; /* if they are exactly the same we are done */ if (test_event->mask == event->mask) goto out; @@ -66,11 +72,14 @@ static int fanotify_merge(struct list_head *list, goto out; } + /* we didn't return the test_event, so drop that ref */ + fsnotify_put_event(test_event); + /* the reference we return on new_event is from clone */ + *return_event = new_event; + /* build new event and replace it on the list */ new_event->mask = (test_event->mask | event->mask); fsnotify_replace_event(test_holder, new_event); - /* match ref from fsnotify_clone_event() */ - fsnotify_put_event(new_event); break; } @@ -82,7 +91,7 @@ out: static int fanotify_handle_event(struct fsnotify_group *group, struct fsnotify_event *event) { int ret; - + struct fsnotify_event *used_event; BUILD_BUG_ON(FAN_ACCESS != FS_ACCESS); BUILD_BUG_ON(FAN_MODIFY != FS_MODIFY); @@ -94,10 +103,12 @@ static int fanotify_handle_event(struct fsnotify_group *group, struct fsnotify_e pr_debug("%s: group=%p event=%p\n", __func__, group, event); - ret = fsnotify_add_notify_event(group, event, NULL, fanotify_merge, NULL); + ret = fsnotify_add_notify_event(group, event, NULL, fanotify_merge, (void **)&used_event); /* -EEXIST means this event was merged with another, not that it was an error */ if (ret == -EEXIST) ret = 0; + if (used_event) + fsnotify_put_event(used_event); return ret; } |