| .. | .. |
|---|
| 64 | 64 | struct fsnotify_event *fsn_event; |
|---|
| 65 | 65 | struct fsnotify_group *group = inode_mark->group; |
|---|
| 66 | 66 | int ret; |
|---|
| 67 | | - int len = 0; |
|---|
| 67 | + int len = 0, wd; |
|---|
| 68 | 68 | int alloc_len = sizeof(struct inotify_event_info); |
|---|
| 69 | 69 | struct mem_cgroup *old_memcg; |
|---|
| 70 | 70 | |
|---|
| .. | .. |
|---|
| 79 | 79 | i_mark = container_of(inode_mark, struct inotify_inode_mark, |
|---|
| 80 | 80 | fsn_mark); |
|---|
| 81 | 81 | |
|---|
| 82 | + /* |
|---|
| 83 | + * We can be racing with mark being detached. Don't report event with |
|---|
| 84 | + * invalid wd. |
|---|
| 85 | + */ |
|---|
| 86 | + wd = READ_ONCE(i_mark->wd); |
|---|
| 87 | + if (wd == -1) |
|---|
| 88 | + return 0; |
|---|
| 82 | 89 | /* |
|---|
| 83 | 90 | * Whoever is interested in the event, pays for the allocation. Do not |
|---|
| 84 | 91 | * trigger OOM killer in the target monitoring memcg as it may have |
|---|
| .. | .. |
|---|
| 109 | 116 | fsn_event = &event->fse; |
|---|
| 110 | 117 | fsnotify_init_event(fsn_event, 0); |
|---|
| 111 | 118 | event->mask = mask; |
|---|
| 112 | | - event->wd = i_mark->wd; |
|---|
| 119 | + event->wd = wd; |
|---|
| 113 | 120 | event->sync_cookie = cookie; |
|---|
| 114 | 121 | event->name_len = len; |
|---|
| 115 | 122 | if (len) |
|---|