From ec976a53a3f28f0b55d79d8fd71e50a1d6880d4c Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Sun, 22 Jun 2014 16:45:23 +0200 Subject: [PATCH] inotify.7: BUGS: Note possible bug triggered by watch descriptor reuse Watch descriptor IDs are returned by inotify_add_watch(). When calling inotify_rm_watch() an IN_IGNORE is placed on the inotify queue pointing to the ID of the removed watch. inotify_add_watchi() should not return a watch descriptor ID for which events are still on the queue but should return an unused ID. Unfortunately, the existing Kernel code does not provide such a guarantee. Actually, in rare cases watch descriptor IDs are returned by inotify_add_watch() for which events are still on the inotify queue. See https://bugzilla.kernel.org/show_bug.cgi?id=77111 Cowritten-by: Michael Kerrisk Signed-off-by: Heinrich Schuchardt Signed-off-by: Michael Kerrisk --- man7/inotify.7 | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/man7/inotify.7 b/man7/inotify.7 index 1fc83f8f9..d64523f23 100644 --- a/man7/inotify.7 +++ b/man7/inotify.7 @@ -754,6 +754,24 @@ if the older had not yet been read) instead checked if the most recent event could be coalesced with the .I oldest unread event. + +As of Linux 3.15.1, the following bug exists: +.\" FIXME https://bugzilla.kernel.org/show_bug.cgi?id=77111 +When a watch descriptor is removed by calling +.BR inotify_rm_watch (2), +any pending unread events for that watch descriptor remain available to read. +As watch descriptors are subsequently allocated with +.BR inotify_add_watch (2), +the kernel cycles through the range of possible watch descriptors (0 to +.BR INT_MAX ) +incrementally. +When allocating a free watch descriptor, no check is made to see whether that +watch descriptor number has any pending unread events in the inotify queue. +Thus, it can happen that a watch descriptor is reallocated even +when pending unread events exist for a previous incarnation of +that watch descriptor number, with the result that the application +might then read those events and interpret them as belonging to +the file associated with the newly recycled watch descriptor. .SH EXAMPLE The following program demonstrates the usage of the inotify API. It marks the directories passed as a command-line arguments