dnotify: Handle errors from fsnotify_add_mark_locked() in fcntl_dirnotify()

commit b3a0066005821acdc0cdb092cb72587182ab583f upstream.

fsnotify_add_mark_locked() can fail but we do not check its return
value. This didn't matter before commit 9dd813c15b2c "fsnotify: Move
mark list head from object into dedicated structure" as none of possible
failures could happen for dnotify but after that commit -ENOMEM can be
returned. Handle this error properly in fcntl_dirnotify() as
otherwise we just hit BUG_ON(dn_mark->dn) in dnotify_free_mark().

Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Reported-by: syzkaller
Fixes: 9dd813c15b2c101168808d4f5941a29985758973
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
index cba32831592952b750ebea310b002c7a27b5cb6e..63a1ca4b9deee22a786822229b8421bcdcf74e31 100644 (file)
--- a/fs/notify/dnotify/dnotify.c
+++ b/fs/notify/dnotify/dnotify.c
@@ -319,7 +319,11 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
                dn_mark = container_of(fsn_mark, struct dnotify_mark, fsn_mark);
                spin_lock(&fsn_mark->lock);
        } else {
-               fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0);
+               error = fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0);
+               if (error) {
+                       mutex_unlock(&dnotify_group->mark_mutex);
+                       goto out_err;
+               }
                spin_lock(&new_fsn_mark->lock);
                fsn_mark = new_fsn_mark;
                dn_mark = new_dn_mark;
@@ -345,6 +349,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
                 */
                if (dn_mark == new_dn_mark)
                        destroy = 1;
+               error = 0;
                goto out;
        }