From: Amy Griffis While doing some inotify stress testing, I hit the following race. In inotify_release(), it's possible for a watch to be removed from the lists in between dropping dev->mutex and taking inode->inotify_mutex. The reference we hold prevents the watch from being freed, but not from being removed. Checking the dev's idr mapping will prevent a double list_del of the same watch. Signed-off-by: Amy Griffis Acked-by: John McCutchan Cc: Robert Love Signed-off-by: Andrew Morton --- fs/inotify.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletion(-) diff -puN fs/inotify.c~fix-race-in-inotify_release fs/inotify.c --- 25/fs/inotify.c~fix-race-in-inotify_release Tue May 16 13:55:58 2006 +++ 25-akpm/fs/inotify.c Tue May 16 13:55:58 2006 @@ -848,7 +848,11 @@ static int inotify_release(struct inode inode = watch->inode; mutex_lock(&inode->inotify_mutex); mutex_lock(&dev->mutex); - remove_watch_no_event(watch, dev); + + /* make sure we didn't race with another list removal */ + if (likely(idr_find(&dev->idr, watch->wd))) + remove_watch_no_event(watch, dev); + mutex_unlock(&dev->mutex); mutex_unlock(&inode->inotify_mutex); put_inotify_watch(watch); _