[PATCH] fix NULL dereference in inotify_ignore

Don't reassign to watch. If idr_find() returns NULL, then put_inotify_watch() will choke. Signed-off-by: Amy Griffis <[email protected]> Cc: John McCutchan <[email protected]> Cc: Robert Love <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
chewitt · May 21, 2006 · d66fd90 · d66fd90
1 parent 66055a4
commit d66fd90
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/fs/inotify.c b/fs/inotify.c
@@ -894,8 +894,7 @@ static int inotify_ignore(struct inotify_device *dev, s32 wd)
 	mutex_lock(&dev->mutex);
 
 	/* make sure that we did not race */
-	watch = idr_find(&dev->idr, wd);
-	if (likely(watch))
+	if (likely(idr_find(&dev->idr, wd) == watch))
 		remove_watch(watch, dev);
 
 	mutex_unlock(&dev->mutex);