Your commit:
inotify: fix double free/corruption of stuct user
On an error path in inotify_init1 a normal user can trigger a double
free of struct user. This is a regression introduced by a2ae4cc9a16e
("inotify: stop kernel memory leak on file creation failure").
We fix this by making sure that if a group exists the user reference is
dropped when the group is cleaned up. We should not explictly drop the
reference on error and also drop the reference when the group is cleaned
up.
The new lifetime rules are that an inotify group lives from
inotify_new_group to the last fsnotify_put_group. Since the struct user
and inotify_devs are directly tied to this lifetime they are only
changed/updated in those two locations. We get rid of all special
casing of struct user or user->inotify_devs.
Signed-off-by: Eric Paris <[email protected]>
Cc: [email protected] (2.6.37 and up)
Signed-off-by: Linus Torvalds <[email protected]>
has been added to the upstream SCSI tree
You can find it here:
http://git.kernel.org/?p=linux/kernel/git/jejb/scsi-misc-2.6.git;a=commit;h=d0de4dc584ec6aa3b26fffea320a8457827768fc
This patch is scheduled to be pushed when the merge window opens for 2.6.39
James Bottomley
P.S. If you find this email unwanted, set up a procmail rule junking on
the header:
X-Git-Tree: SCSI
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
