Commit 783bc29b authored by Robert Love's avatar Robert Love Committed by Linus Torvalds
Browse files

[PATCH] inotify: oops fix 



Bug fix: Ensure that the fd passed to inotify_add_watch() and
inotify_rm_watch() belongs to inotify.

Signed-off-by: default avatarRobert Love <rml@novell.com>
Signed-off-by: default avatarJohn McCutchan <ttb@tentacle.dhs.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 33ea2f52

fs/inotify.c

+15 −1
Original line number Diff line number Diff line
@@ -929,6 +929,12 @@ asmlinkage long sys_inotify_add_watch(int fd, const char __user *path, u32 mask) 
	if (unlikely(!filp))

		return -EBADF;



	/* verify that this is indeed an inotify instance */

	if (unlikely(filp->f_op != &inotify_fops)) {

		ret = -EINVAL;

		goto fput_and_out;

	}



	ret = find_inode(path, &nd);

	if (unlikely(ret))

		goto fput_and_out;
@@ -986,10 +992,18 @@ asmlinkage long sys_inotify_rm_watch(int fd, u32 wd) 
	filp = fget_light(fd, &fput_needed);

	if (unlikely(!filp))

		return -EBADF;



	/* verify that this is indeed an inotify instance */

	if (unlikely(filp->f_op != &inotify_fops)) {

		ret = -EINVAL;

		goto out;

	}



	dev = filp->private_data;

	ret = inotify_ignore(dev, wd);

	fput_light(filp, fput_needed);



out:

	fput_light(filp, fput_needed);

	return ret;

}