Skip to content


Subversion checkout URL

You can clone with
Download ZIP
Browse files

fanotify: fix FAN_Q_OVERFLOW case of fanotify_read()

If the FAN_Q_OVERFLOW bit set in event->mask, the fanotify event
metadata will not contain a valid file descriptor, but
copy_event_to_user() didn't check for that, and unconditionally does a
fd_install() on the file descriptor.

Which in turn will cause a BUG_ON() in __fd_install().

Introduced by commit 352e3b2 ("fanotify: sanitize failure exits in

Mea culpa - missed that path ;-/

Reported-by: Alex Shi <>
Signed-off-by: Al Viro <>
Signed-off-by: Linus Torvalds <>
  • Loading branch information...
commit 3587b1b097d70c2eb9fee95ea7995d13c05f66e5 1 parent 8d93810
Al Viro authored torvalds committed
Showing with 2 additions and 1 deletion.
  1. +2 −1  fs/notify/fanotify/fanotify_user.c
3  fs/notify/fanotify/fanotify_user.c
@@ -258,7 +258,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
if (ret)
goto out_close_fd;
- fd_install(fd, f);
+ if (fd != FAN_NOFD)
+ fd_install(fd, f);
return fanotify_event_metadata.event_len;
Please sign in to comment.
Something went wrong with that request. Please try again.