The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x ca090c837b430752038b24e56dd182010d77f6f6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051305-bronzing-output-dbca@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
ca090c837b43 ("drm/msm: fix missing wq allocation error handling")
dfa70344d1b5 ("Revert "drm/msm: Add missing check and destroy for alloc_ordered_workqueue"")
643b7d0869cc ("drm/msm: Add missing check and destroy for alloc_ordered_workqueue")
2027e5b3413d ("drm/msm: Initialize MDSS irq domain at probe time")
ec919e6e7146 ("drm/msm: Allocate msm_drm_private early and pass it as driver data")
83b965d118cb ("Merge remote-tracking branch 'drm/drm-next' into msm-next-staging")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From ca090c837b430752038b24e56dd182010d77f6f6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Mon, 6 Mar 2023 11:07:19 +0100
Subject: [PATCH] drm/msm: fix missing wq allocation error handling
Add the missing sanity check to handle workqueue allocation failures.
Fixes: c8afe684c95c ("drm/msm: basic KMS driver for snapdragon")
Cc: stable(a)vger.kernel.org # 3.12
Cc: Rob Clark <robdclark(a)gmail.com>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/525102/
Link: https://lore.kernel.org/r/20230306100722.28485-8-johan+linaro@kernel.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 4d85ca0ba0c1..2a9a363afe50 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -433,6 +433,10 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
priv->dev = ddev;
priv->wq = alloc_ordered_workqueue("msm", 0);
+ if (!priv->wq) {
+ ret = -ENOMEM;
+ goto err_put_dev;
+ }
INIT_LIST_HEAD(&priv->objects);
mutex_init(&priv->obj_lock);
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x ca090c837b430752038b24e56dd182010d77f6f6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051302-dexterity-tripping-9b43@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
ca090c837b43 ("drm/msm: fix missing wq allocation error handling")
dfa70344d1b5 ("Revert "drm/msm: Add missing check and destroy for alloc_ordered_workqueue"")
643b7d0869cc ("drm/msm: Add missing check and destroy for alloc_ordered_workqueue")
2027e5b3413d ("drm/msm: Initialize MDSS irq domain at probe time")
ec919e6e7146 ("drm/msm: Allocate msm_drm_private early and pass it as driver data")
83b965d118cb ("Merge remote-tracking branch 'drm/drm-next' into msm-next-staging")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From ca090c837b430752038b24e56dd182010d77f6f6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Mon, 6 Mar 2023 11:07:19 +0100
Subject: [PATCH] drm/msm: fix missing wq allocation error handling
Add the missing sanity check to handle workqueue allocation failures.
Fixes: c8afe684c95c ("drm/msm: basic KMS driver for snapdragon")
Cc: stable(a)vger.kernel.org # 3.12
Cc: Rob Clark <robdclark(a)gmail.com>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/525102/
Link: https://lore.kernel.org/r/20230306100722.28485-8-johan+linaro@kernel.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 4d85ca0ba0c1..2a9a363afe50 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -433,6 +433,10 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
priv->dev = ddev;
priv->wq = alloc_ordered_workqueue("msm", 0);
+ if (!priv->wq) {
+ ret = -ENOMEM;
+ goto err_put_dev;
+ }
INIT_LIST_HEAD(&priv->objects);
mutex_init(&priv->obj_lock);
The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x ca090c837b430752038b24e56dd182010d77f6f6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051359-eats-capable-97be@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
ca090c837b43 ("drm/msm: fix missing wq allocation error handling")
dfa70344d1b5 ("Revert "drm/msm: Add missing check and destroy for alloc_ordered_workqueue"")
643b7d0869cc ("drm/msm: Add missing check and destroy for alloc_ordered_workqueue")
2027e5b3413d ("drm/msm: Initialize MDSS irq domain at probe time")
ec919e6e7146 ("drm/msm: Allocate msm_drm_private early and pass it as driver data")
83b965d118cb ("Merge remote-tracking branch 'drm/drm-next' into msm-next-staging")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From ca090c837b430752038b24e56dd182010d77f6f6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Mon, 6 Mar 2023 11:07:19 +0100
Subject: [PATCH] drm/msm: fix missing wq allocation error handling
Add the missing sanity check to handle workqueue allocation failures.
Fixes: c8afe684c95c ("drm/msm: basic KMS driver for snapdragon")
Cc: stable(a)vger.kernel.org # 3.12
Cc: Rob Clark <robdclark(a)gmail.com>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/525102/
Link: https://lore.kernel.org/r/20230306100722.28485-8-johan+linaro@kernel.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 4d85ca0ba0c1..2a9a363afe50 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -433,6 +433,10 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
priv->dev = ddev;
priv->wq = alloc_ordered_workqueue("msm", 0);
+ if (!priv->wq) {
+ ret = -ENOMEM;
+ goto err_put_dev;
+ }
INIT_LIST_HEAD(&priv->objects);
mutex_init(&priv->obj_lock);
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x ca090c837b430752038b24e56dd182010d77f6f6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051356-rupture-negate-a5c5@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
ca090c837b43 ("drm/msm: fix missing wq allocation error handling")
dfa70344d1b5 ("Revert "drm/msm: Add missing check and destroy for alloc_ordered_workqueue"")
643b7d0869cc ("drm/msm: Add missing check and destroy for alloc_ordered_workqueue")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From ca090c837b430752038b24e56dd182010d77f6f6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan+linaro(a)kernel.org>
Date: Mon, 6 Mar 2023 11:07:19 +0100
Subject: [PATCH] drm/msm: fix missing wq allocation error handling
Add the missing sanity check to handle workqueue allocation failures.
Fixes: c8afe684c95c ("drm/msm: basic KMS driver for snapdragon")
Cc: stable(a)vger.kernel.org # 3.12
Cc: Rob Clark <robdclark(a)gmail.com>
Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/525102/
Link: https://lore.kernel.org/r/20230306100722.28485-8-johan+linaro@kernel.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 4d85ca0ba0c1..2a9a363afe50 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -433,6 +433,10 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
priv->dev = ddev;
priv->wq = alloc_ordered_workqueue("msm", 0);
+ if (!priv->wq) {
+ ret = -ENOMEM;
+ goto err_put_dev;
+ }
INIT_LIST_HEAD(&priv->objects);
mutex_init(&priv->obj_lock);
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y
git checkout FETCH_HEAD
git cherry-pick -x c2bd1e18c6f85c0027da2e5e7753b9bfd9f8e6dc
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051334-mulberry-contempt-caa5@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^..
Possible dependencies:
c2bd1e18c6f8 ("sh: mcount.S: fix build error when PRINTK is not enabled")
37744feebc08 ("sh: remove sh5 support")
62d0fd591db1 ("arch: split MODULE_ARCH_VERMAGIC definitions out to <asm/vermagic.h>")
630f289b7114 ("asm-generic: make more kernel-space headers mandatory")
a8222fd5b80c ("Merge tag 'microblaze-v5.7-rc1' of git://git.monstr.eu/linux-2.6-microblaze")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From c2bd1e18c6f85c0027da2e5e7753b9bfd9f8e6dc Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap(a)infradead.org>
Date: Sun, 5 Mar 2023 20:00:37 -0800
Subject: [PATCH] sh: mcount.S: fix build error when PRINTK is not enabled
Fix a build error in mcount.S when CONFIG_PRINTK is not enabled.
Fixes this build error:
sh2-linux-ld: arch/sh/lib/mcount.o: in function `stack_panic':
(.text+0xec): undefined reference to `dump_stack'
Fixes: e460ab27b6c3 ("sh: Fix up stack overflow check with ftrace disabled.")
Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org>
Cc: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: Rich Felker <dalias(a)libc.org>
Suggested-by: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: stable(a)vger.kernel.org
Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
Link: https://lore.kernel.org/r/20230306040037.20350-8-rdunlap@infradead.org
Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
index 10290e5c1f43..c449e7c1b20f 100644
--- a/arch/sh/Kconfig.debug
+++ b/arch/sh/Kconfig.debug
@@ -15,7 +15,7 @@ config SH_STANDARD_BIOS
config STACK_DEBUG
bool "Check for stack overflows"
- depends on DEBUG_KERNEL
+ depends on DEBUG_KERNEL && PRINTK
help
This option will cause messages to be printed if free stack space
drops below a certain limit. Saying Y here will add overhead to
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y
git checkout FETCH_HEAD
git cherry-pick -x c2bd1e18c6f85c0027da2e5e7753b9bfd9f8e6dc
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051330-unused-wrongness-eefc@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^..
Possible dependencies:
c2bd1e18c6f8 ("sh: mcount.S: fix build error when PRINTK is not enabled")
37744feebc08 ("sh: remove sh5 support")
62d0fd591db1 ("arch: split MODULE_ARCH_VERMAGIC definitions out to <asm/vermagic.h>")
630f289b7114 ("asm-generic: make more kernel-space headers mandatory")
a8222fd5b80c ("Merge tag 'microblaze-v5.7-rc1' of git://git.monstr.eu/linux-2.6-microblaze")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From c2bd1e18c6f85c0027da2e5e7753b9bfd9f8e6dc Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap(a)infradead.org>
Date: Sun, 5 Mar 2023 20:00:37 -0800
Subject: [PATCH] sh: mcount.S: fix build error when PRINTK is not enabled
Fix a build error in mcount.S when CONFIG_PRINTK is not enabled.
Fixes this build error:
sh2-linux-ld: arch/sh/lib/mcount.o: in function `stack_panic':
(.text+0xec): undefined reference to `dump_stack'
Fixes: e460ab27b6c3 ("sh: Fix up stack overflow check with ftrace disabled.")
Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org>
Cc: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: Rich Felker <dalias(a)libc.org>
Suggested-by: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: stable(a)vger.kernel.org
Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
Link: https://lore.kernel.org/r/20230306040037.20350-8-rdunlap@infradead.org
Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
index 10290e5c1f43..c449e7c1b20f 100644
--- a/arch/sh/Kconfig.debug
+++ b/arch/sh/Kconfig.debug
@@ -15,7 +15,7 @@ config SH_STANDARD_BIOS
config STACK_DEBUG
bool "Check for stack overflows"
- depends on DEBUG_KERNEL
+ depends on DEBUG_KERNEL && PRINTK
help
This option will cause messages to be printed if free stack space
drops below a certain limit. Saying Y here will add overhead to
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x c2bd1e18c6f85c0027da2e5e7753b9bfd9f8e6dc
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051327-diligence-reshuffle-6a74@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
c2bd1e18c6f8 ("sh: mcount.S: fix build error when PRINTK is not enabled")
37744feebc08 ("sh: remove sh5 support")
62d0fd591db1 ("arch: split MODULE_ARCH_VERMAGIC definitions out to <asm/vermagic.h>")
630f289b7114 ("asm-generic: make more kernel-space headers mandatory")
a8222fd5b80c ("Merge tag 'microblaze-v5.7-rc1' of git://git.monstr.eu/linux-2.6-microblaze")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From c2bd1e18c6f85c0027da2e5e7753b9bfd9f8e6dc Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap(a)infradead.org>
Date: Sun, 5 Mar 2023 20:00:37 -0800
Subject: [PATCH] sh: mcount.S: fix build error when PRINTK is not enabled
Fix a build error in mcount.S when CONFIG_PRINTK is not enabled.
Fixes this build error:
sh2-linux-ld: arch/sh/lib/mcount.o: in function `stack_panic':
(.text+0xec): undefined reference to `dump_stack'
Fixes: e460ab27b6c3 ("sh: Fix up stack overflow check with ftrace disabled.")
Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org>
Cc: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
Cc: Yoshinori Sato <ysato(a)users.sourceforge.jp>
Cc: Rich Felker <dalias(a)libc.org>
Suggested-by: Geert Uytterhoeven <geert(a)linux-m68k.org>
Cc: stable(a)vger.kernel.org
Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
Link: https://lore.kernel.org/r/20230306040037.20350-8-rdunlap@infradead.org
Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de>
diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug
index 10290e5c1f43..c449e7c1b20f 100644
--- a/arch/sh/Kconfig.debug
+++ b/arch/sh/Kconfig.debug
@@ -15,7 +15,7 @@ config SH_STANDARD_BIOS
config STACK_DEBUG
bool "Check for stack overflows"
- depends on DEBUG_KERNEL
+ depends on DEBUG_KERNEL && PRINTK
help
This option will cause messages to be printed if free stack space
drops below a certain limit. Saying Y here will add overhead to
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.14.y
git checkout FETCH_HEAD
git cherry-pick -x c915d8f5918bea7c3962b09b8884ca128bfd9b0c
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051355-axis-manly-3a44@gregkh' --subject-prefix 'PATCH 4.14.y' HEAD^..
Possible dependencies:
c915d8f5918b ("inotify: Avoid reporting event with invalid wd")
ec165450968b ("memcg, fsnotify: no oom-kill for remote memcg charging")
a0a92d261f29 ("fsnotify: move mask out of struct fsnotify_event")
d0a6a87e40da ("fanotify: support reporting thread id instead of process id")
bdd5a46fe306 ("fanotify: add BUILD_BUG_ON() to count the bits of fanotify constants")
23c9deeb3285 ("fanotify: deprecate uapi FAN_ALL_* constants")
a72fd224e37b ("fanotify: simplify handling of FAN_ONDIR")
b723a7911d02 ("fanotify: fix collision of internal and uapi mark flags")
96a71f21ef1f ("fanotify: store fanotify_init() flags in group's fanotify_data")
d54f4fba889b ("fanotify: add API to attach/detach super block mark")
6ada4e282679 ("Merge branch 'akpm' (patches from Andrew)")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From c915d8f5918bea7c3962b09b8884ca128bfd9b0c Mon Sep 17 00:00:00 2001
From: Jan Kara <jack(a)suse.cz>
Date: Mon, 24 Apr 2023 18:32:19 +0200
Subject: [PATCH] inotify: Avoid reporting event with invalid wd
When inotify_freeing_mark() races with inotify_handle_inode_event() it
can happen that inotify_handle_inode_event() sees that i_mark->wd got
already reset to -1 and reports this value to userspace which can
confuse the inotify listener. Avoid the problem by validating that wd is
sensible (and pretend the mark got removed before the event got
generated otherwise).
CC: stable(a)vger.kernel.org
Fixes: 7e790dd5fc93 ("inotify: fix error paths in inotify_update_watch")
Message-Id: <20230424163219.9250-1-jack(a)suse.cz>
Reported-by: syzbot+4a06d4373fd52f0b2f9c(a)syzkaller.appspotmail.com
Reviewed-by: Amir Goldstein <amir73il(a)gmail.com>
Signed-off-by: Jan Kara <jack(a)suse.cz>
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 49cfe2ae6d23..993375f0db67 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -65,7 +65,7 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask,
struct fsnotify_event *fsn_event;
struct fsnotify_group *group = inode_mark->group;
int ret;
- int len = 0;
+ int len = 0, wd;
int alloc_len = sizeof(struct inotify_event_info);
struct mem_cgroup *old_memcg;
@@ -80,6 +80,13 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask,
i_mark = container_of(inode_mark, struct inotify_inode_mark,
fsn_mark);
+ /*
+ * We can be racing with mark being detached. Don't report event with
+ * invalid wd.
+ */
+ wd = READ_ONCE(i_mark->wd);
+ if (wd == -1)
+ return 0;
/*
* Whoever is interested in the event, pays for the allocation. Do not
* trigger OOM killer in the target monitoring memcg as it may have
@@ -110,7 +117,7 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask,
fsn_event = &event->fse;
fsnotify_init_event(fsn_event);
event->mask = mask;
- event->wd = i_mark->wd;
+ event->wd = wd;
event->sync_cookie = cookie;
event->name_len = len;
if (len)
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y
git checkout FETCH_HEAD
git cherry-pick -x c915d8f5918bea7c3962b09b8884ca128bfd9b0c
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2023051351-cross-bunny-a0c7@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^..
Possible dependencies:
c915d8f5918b ("inotify: Avoid reporting event with invalid wd")
ec165450968b ("memcg, fsnotify: no oom-kill for remote memcg charging")
a0a92d261f29 ("fsnotify: move mask out of struct fsnotify_event")
d0a6a87e40da ("fanotify: support reporting thread id instead of process id")
bdd5a46fe306 ("fanotify: add BUILD_BUG_ON() to count the bits of fanotify constants")
23c9deeb3285 ("fanotify: deprecate uapi FAN_ALL_* constants")
a72fd224e37b ("fanotify: simplify handling of FAN_ONDIR")
b723a7911d02 ("fanotify: fix collision of internal and uapi mark flags")
96a71f21ef1f ("fanotify: store fanotify_init() flags in group's fanotify_data")
d54f4fba889b ("fanotify: add API to attach/detach super block mark")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From c915d8f5918bea7c3962b09b8884ca128bfd9b0c Mon Sep 17 00:00:00 2001
From: Jan Kara <jack(a)suse.cz>
Date: Mon, 24 Apr 2023 18:32:19 +0200
Subject: [PATCH] inotify: Avoid reporting event with invalid wd
When inotify_freeing_mark() races with inotify_handle_inode_event() it
can happen that inotify_handle_inode_event() sees that i_mark->wd got
already reset to -1 and reports this value to userspace which can
confuse the inotify listener. Avoid the problem by validating that wd is
sensible (and pretend the mark got removed before the event got
generated otherwise).
CC: stable(a)vger.kernel.org
Fixes: 7e790dd5fc93 ("inotify: fix error paths in inotify_update_watch")
Message-Id: <20230424163219.9250-1-jack(a)suse.cz>
Reported-by: syzbot+4a06d4373fd52f0b2f9c(a)syzkaller.appspotmail.com
Reviewed-by: Amir Goldstein <amir73il(a)gmail.com>
Signed-off-by: Jan Kara <jack(a)suse.cz>
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 49cfe2ae6d23..993375f0db67 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -65,7 +65,7 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask,
struct fsnotify_event *fsn_event;
struct fsnotify_group *group = inode_mark->group;
int ret;
- int len = 0;
+ int len = 0, wd;
int alloc_len = sizeof(struct inotify_event_info);
struct mem_cgroup *old_memcg;
@@ -80,6 +80,13 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask,
i_mark = container_of(inode_mark, struct inotify_inode_mark,
fsn_mark);
+ /*
+ * We can be racing with mark being detached. Don't report event with
+ * invalid wd.
+ */
+ wd = READ_ONCE(i_mark->wd);
+ if (wd == -1)
+ return 0;
/*
* Whoever is interested in the event, pays for the allocation. Do not
* trigger OOM killer in the target monitoring memcg as it may have
@@ -110,7 +117,7 @@ int inotify_handle_inode_event(struct fsnotify_mark *inode_mark, u32 mask,
fsn_event = &event->fse;
fsnotify_init_event(fsn_event);
event->mask = mask;
- event->wd = i_mark->wd;
+ event->wd = wd;
event->sync_cookie = cookie;
event->name_len = len;
if (len)