Miklos Szeredi a2140fc0cb audit: fix refcounting in audit-tree
Refcounting of fsnotify_mark in audit tree is broken.  E.g:

                              refcount
create_chunk
  alloc_chunk                 1
  fsnotify_add_mark           2

untag_chunk
  fsnotify_get_mark           3
  fsnotify_destroy_mark
    audit_tree_freeing_mark   2
  fsnotify_put_mark           1
  fsnotify_put_mark           0
  via destroy_list
    fsnotify_mark_destroy    -1

This was reported by various people as triggering Oops when stopping auditd.

We could just remove the put_mark from audit_tree_freeing_mark() but that would
break freeing via inode destruction.  So this patch simply omits a put_mark
after calling destroy_mark or adds a get_mark before.

The additional get_mark is necessary where there's no other put_mark after
fsnotify_destroy_mark() since it assumes that the caller is holding a reference
(or the inode is keeping the mark pinned, not the case here AFAICS).

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Reported-by: Valentin Avram <aval13@gmail.com>
Reported-by: Peter Moody <pmoody@google.com>
Acked-by: Eric Paris <eparis@redhat.com>
CC: stable@vger.kernel.org
2012-08-15 12:55:22 +02:00
..
2011-07-26 16:49:45 -07:00
2012-07-14 16:35:02 +04:00
2012-05-21 23:52:30 -04:00
2012-05-31 17:49:27 -07:00
2011-07-14 12:59:14 +03:00
2012-03-28 18:30:03 +01:00
2012-07-31 18:42:43 -07:00
2012-05-31 17:49:32 -07:00
2012-05-29 23:28:41 -04:00
2012-03-29 19:52:46 +08:00
2012-06-13 21:16:42 +02:00
2012-03-28 18:30:03 +01:00
2012-06-11 15:07:52 +02:00
2012-05-31 17:49:32 -07:00
2012-07-30 17:25:13 -07:00
2012-03-15 18:17:55 -07:00
2012-05-19 15:44:40 -06:00