From b1853762ab8eb9af1224acc75662012dbb170043 Mon Sep 17 00:00:00 2001 From: Miklos Szeredi Date: Thu, 12 Jan 2012 17:59:46 +0100 Subject: [PATCH] --- yaml --- r: 284997 b: refs/heads/master c: fed474857efbed79cd390d0aee224231ca718f63 h: refs/heads/master i: 284995: 1126a14bda31e0c8db0f15a456c24d2dc5dbec0c v: v3 --- [refs] | 2 +- trunk/fs/notify/mark.c | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/[refs] b/[refs] index beac51377c56..0ed046087134 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 1e6c4dfdeb040b2dd5c4d6d803ab95c3971ad80c +refs/heads/master: fed474857efbed79cd390d0aee224231ca718f63 diff --git a/trunk/fs/notify/mark.c b/trunk/fs/notify/mark.c index e14587d55689..f104d565b682 100644 --- a/trunk/fs/notify/mark.c +++ b/trunk/fs/notify/mark.c @@ -135,9 +135,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark) mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE; - /* 1 from caller and 1 for being on i_list/g_list */ - BUG_ON(atomic_read(&mark->refcnt) < 2); - spin_lock(&group->mark_lock); if (mark->flags & FSNOTIFY_MARK_FLAG_INODE) { @@ -181,6 +178,11 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark) if (inode && (mark->flags & FSNOTIFY_MARK_FLAG_OBJECT_PINNED)) iput(inode); + /* + * We don't necessarily have a ref on mark from caller so the above iput + * may have already destroyed it. Don't touch from now on. + */ + /* * it's possible that this group tried to destroy itself, but this * this mark was simultaneously being freed by inode. If that's the