From: Jeff Burke <jburke@redhat.com> Date: Thu, 10 Jul 2008 16:26:10 -0400 Subject: [fs] inotify: previous event should be last in list Message-id: 48767062.5070204@redhat.com O-Subject: [RHEL5.3 PATCH] BZ453990: Bug in inotify_user.c Bugzilla: 453990 RH-Acked-by: Jarod Wilson <jwilson@redhat.com> RH-Acked-by: Peter Staubach <staubach@redhat.com> Red Hat BZ#: 453990 ------ Description: ltp test failure with inotify02 testcase ------------ RHEL Version Found: Red Hat Enterprise Linux Server 5.2 Red Hat MRG Kernel ------------------ Upstream Status: > From: Linux Kernel Mailing List <linux-kernel@...> > To: <git-commits-head@...> > Subject: A potential bug in inotify_user.c > Date: Wednesday, February 6, 2008 - 7:01 pm > > Gitweb: http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1c17d1... > Commit: 1c17d18e3775485bf1e0ce79575eb637a94494a2 > Parent: 19c561a60ffe52df88dd63de0bff480ca094efe4 > Author: Yan Zheng <yanzheng@21cn.com> > AuthorDate: Wed Feb 6 01:36:09 2008 -0800 > Committer: Linus Torvalds <torvalds@woody.linux-foundation.org> > CommitDate: Wed Feb 6 10:41:00 2008 -0800 > > A potential bug in inotify_user.c > > Following comment is at fs/inotify_user.c:287 > /* coalescing: drop this event if it is a dupe of the previous */ > > I think the previous event in the comment should be the last event in the > link list. But inotify_dev_get_event return the first event in the list. > In addition, it doesn't check whether the list is empty > > Signed-off-by: Yan Zheng<yanzheng@21cn.com> > Acked-by: Robert Love <rlove@rlove.org> > Cc: John McCutchan <ttb@tentacle.dhs.org> > Signed-off-by: Andrew Morton <akpm@linux-foundation.org> > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> ---------------- Test Status: Tested with RHEL5.2, 2.6.24-7.72.el5rt and 2.6.24-7.72.el5vanilla ------------ Test Case: http://ltp.cvs.sourceforge.net/ltp/ltp/testcases/kernel/syscalls/inotify/inotify02.c?view=log ---------- Actual results: Without patch - 2.6.24-7.72.el5rtvanilla Testcase Result Exit Value -------- ------ ---------- inotify01 FAIL 0 With patch - 2.6.24-7.72.el5rt Testcase Result Exit Value -------- ------ ---------- inotify01 PASS 0 Expected results: Test should pass all the time BREW scratch build: N/A Used realtime kernel for testing ------------------- Thanks, Jeff From: Yan Zheng <yanzheng@21cn.com> Date: Wed, 6 Feb 2008 09:36:09 +0000 (-0800) Subject: A potential bug in inotify_user.c X-Git-Tag: v2.6.25-rc1~775 X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=1c17d18e3775485bf1e0ce79575eb637a94494a2;hp=19c561a60ffe52df88dd63de0bff480ca094efe4 A potential bug in inotify_user.c Following comment is at fs/inotify_user.c:287 /* coalescing: drop this event if it is a dupe of the previous */ I think the previous event in the comment should be the last event in the link list. But inotify_dev_get_event return the first event in the list. In addition, it doesn't check whether the list is empty Signed-off-by: Yan Zheng<yanzheng@21cn.com> Acked-by: Robert Love <rlove@rlove.org> Cc: John McCutchan <ttb@tentacle.dhs.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> diff --git a/fs/inotify_user.c b/fs/inotify_user.c index 017cb0f..0f3889e 100644 --- a/fs/inotify_user.c +++ b/fs/inotify_user.c @@ -247,6 +247,19 @@ inotify_dev_get_event(struct inotify_device *dev) } /* + * inotify_dev_get_last_event - return the last event in the given dev's queue + * + * Caller must hold dev->ev_mutex. + */ +static inline struct inotify_kernel_event * +inotify_dev_get_last_event(struct inotify_device *dev) +{ + if (list_empty(&dev->events)) + return NULL; + return list_entry(dev->events.prev, struct inotify_kernel_event, list); +} + +/* * inotify_dev_queue_event - event handler registered with core inotify, adds * a new event to the given device * @@ -272,7 +285,7 @@ static void inotify_dev_queue_event(struct inotify_watch *w, u32 wd, u32 mask, put_inotify_watch(w); /* final put */ /* coalescing: drop this event if it is a dupe of the previous */ - last = inotify_dev_get_event(dev); + last = inotify_dev_get_last_event(dev); if (last && last->event.mask == mask && last->event.wd == wd && last->event.cookie == cookie) { const char *lastname = last->name;