fanotify: fix double free of pending permission events

[cascardo/linux.git] / fs / notify / fanotify / fanotify.c

diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index fdeb36b..30d3add 100644 (file)
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -70,8 +70,15 @@ static int fanotify_get_response(struct fsnotify_group *group,
        wait_event(group->fanotify_data.access_waitq, event->response ||
                                atomic_read(&group->fanotify_data.bypass_perm));
 
-       if (!event->response) /* bypass_perm set */
+       if (!event->response) { /* bypass_perm set */
+               /*
+                * Event was canceled because group is being destroyed. Remove
+                * it from group's event list because we are responsible for
+                * freeing the permission event.
+                */
+               fsnotify_remove_event(group, &event->fae.fse);
                return 0;
+       }
 
        /* userspace responded, convert to something usable */
        switch (event->response) {