If the FAN_Q_OVERFLOW bit set in event->mask, the fanotify event
metadata will not contain a valid file descriptor, but
copy_event_to_user() didn't check for that, and unconditionally does a
fd_install() on the file descriptor.
Which in turn will cause a BUG_ON() in __fd_install().
Introduced by commit
|
||
|---|---|---|
| .. | ||
| fanotify.c | ||
| fanotify_user.c | ||
| Kconfig | ||
| Makefile | ||