Bug 439754 (CVE-2008-1375)

Description of problem:

Alexander Viro has reported the following serious Linux kernel issue:

<cite>

 fcntl_dirnotify() adds an element to inode->i_dnotify. It contains
a reference to struct file and to struct files_struct (both not contributing
to refcounts). filp_close() (called when reference to file is removed
from descriptor table) purges element with file/descriptor table in question
from ->i_dnotify. The problem is, fcntl() can race with close() from another
thread, inserting element *after* close() is finished. If that happens,
the sucker is stuck there forever, long after the struct file it refers
to had been freed/reused/etc. Actually, even having the (in-core) inode
freed and reused doesn't clean it up - "->i_dnotify is empty on allocated
inode" is guaranteed by slab constructor; freeing and reallocating won't
touch it at all, since the list must have been emptied before we'd dropped
the final reference to inode.

</cite>

NOTE:  Please note this issue is NOT public yet, so handle each information
=====  about this one as confidential.