History

Merge branch 'stable-fodder' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs stable fodder fixes from Al Viro: - acct_on() fix for deadlock caught by overlayfs folks - autofs RCU use-after-free SNAFU (->d_manage() can be called locklessly, so we need to RCU-delay freeing the objects it looks at) - (hopefully) the end of "do we need freeing this dentry RCU-delayed" whack-a-mole. * 'stable-fodder' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: autofs: fix use-after-free in lockless ->d_manage() dcache: sort the freeing-without-RCU-delay mess for good. acct_on(): don't mess with freeze protection

Linus Torvalds committed 7 years ago

Commit 78438ce2 parents 168e153 ce285c29 files · +26 −19Browse files

Unified · Split

9 files
  1. Documentation/filesystems/porting +5 −0
  2. fs/autofs/autofs_i.h +1 −0
  3. fs/autofs/inode.c +1 −1
  4. fs/dcache.c +13 −11
  5. fs/internal.h +0 −2
  6. fs/nsfs.c +1 −2
  7. include/linux/dcache.h +1 −1
  8. include/linux/mount.h +2 −0
  9. kernel/acct.c +2 −2
Documentation/filesystems/porting+5−0
@@ -663,3 +663,8 @@ in your dentry operations instead. · 662 unmodified lines
663663 there, but that's it. Freeing memory in the callback is fine; doing
664664 more than that is possible, but requires a lot of care and is best
665665 avoided.
666+--
667+[mandatory]
668+ DCACHE_RCUACCESS is gone; having an RCU delay on dentry freeing is the
669+ default. DCACHE_NORCU opts out, and only d_alloc_pseudo() has any
670+ business doing so.
fs/autofs/autofs_i.h+1−0
@@ -71,6 +71,7 @@ struct autofs_info { · 70 unmodified lines
7171
7272 kuid_t uid;
7373 kgid_t gid;
74+ struct rcu_head rcu;
7475 };
7576
7677 #define AUTOFS_INF_EXPIRING (1<<0) /* dentry in the process of expiring */
fs/autofs/inode.c+1−1
@@ -36,7 +36,7 @@ void autofs_clean_ino(struct autofs_info *ino) · 35 unmodified lines
3636
3737 void autofs_free_ino(struct autofs_info *ino)
3838 {
39− kfree(ino);
39+ kfree_rcu(ino, rcu);
4040 }
4141
4242 void autofs_kill_sb(struct super_block *sb)
fs/dcache.c+13−11
@@ -344,7 +344,7 @@ static void dentry_free(struct dentry *dentry) · 343 unmodified lines
344344 }
345345 }
346346 /* if dentry was never visible to RCU, immediate free is OK */
347− if (!(dentry->d_flags & DCACHE_RCUACCESS))
347+ if (dentry->d_flags & DCACHE_NORCU)
348348 __d_free(&dentry->d_u.d_rcu);
349349 else
350350 call_rcu(&dentry->d_u.d_rcu, __d_free);
@@ -1701,7 +1701,6 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name) · 1350 unmodified lines
17011701 struct dentry *dentry = __d_alloc(parent->d_sb, name);
17021702 if (!dentry)
17031703 return NULL;
1704− dentry->d_flags |= DCACHE_RCUACCESS;
17051704 spin_lock(&parent->d_lock);
17061705 /*
17071706 * don't need child lock because it is not subject
@@ -1726,7 +1725,7 @@ struct dentry *d_alloc_cursor(struct dentry * parent) · 18 unmodified lines
17261725 {
17271726 struct dentry *dentry = d_alloc_anon(parent->d_sb);
17281727 if (dentry) {
1729− dentry->d_flags |= DCACHE_RCUACCESS | DCACHE_DENTRY_CURSOR;
1728+ dentry->d_flags |= DCACHE_DENTRY_CURSOR;
17301729 dentry->d_parent = dget(parent);
17311730 }
17321731 return dentry;
@@ -1739,10 +1738,17 @@ struct dentry *d_alloc_cursor(struct dentry * parent) · 6 unmodified lines
17391738 *
17401739 * For a filesystem that just pins its dentries in memory and never
17411740 * performs lookups at all, return an unhashed IS_ROOT dentry.
1741+ * This is used for pipes, sockets et.al. - the stuff that should
1742+ * never be anyone's children or parents. Unlike all other
1743+ * dentries, these will not have RCU delay between dropping the
1744+ * last reference and freeing them.
17421745 */
17431746 struct dentry *d_alloc_pseudo(struct super_block *sb, const struct qstr *name)
17441747 {
1745− return __d_alloc(sb, name);
1748+ struct dentry *dentry = __d_alloc(sb, name);
1749+ if (likely(dentry))
1750+ dentry->d_flags |= DCACHE_NORCU;
1751+ return dentry;
17461752 }
17471753 EXPORT_SYMBOL(d_alloc_pseudo);
17481754
@@ -1911,12 +1917,10 @@ struct dentry *d_make_root(struct inode *root_inode) · 162 unmodified lines
19111917
19121918 if (root_inode) {
19131919 res = d_alloc_anon(root_inode->i_sb);
1914− if (res) {
1915− res->d_flags |= DCACHE_RCUACCESS;
1920+ if (res)
19161921 d_instantiate(res, root_inode);
1917− } else {
1922+ else
19181923 iput(root_inode);
1919− }
19201924 }
19211925 return res;
19221926 }
@@ -2781,9 +2785,7 @@ static void __d_move(struct dentry *dentry, struct dentry *target, · 858 unmodified lines
27812785 copy_name(dentry, target);
27822786 target->d_hash.pprev = NULL;
27832787 dentry->d_parent->d_lockref.count++;
2784− if (dentry == old_parent)
2785− dentry->d_flags |= DCACHE_RCUACCESS;
2786− else
2788+ if (dentry != old_parent) /* wasn't IS_ROOT */
27872789 WARN_ON(!--old_parent->d_lockref.count);
27882790 } else {
27892791 target->d_parent = old_parent;
fs/internal.h+0−2
@@ -89,9 +89,7 @@ extern int sb_prepare_remount_readonly(struct super_block *); · 88 unmodified lines
8989
9090 extern void __init mnt_init(void);
9191
92−extern int __mnt_want_write(struct vfsmount *);
9392 extern int __mnt_want_write_file(struct file *);
94−extern void __mnt_drop_write(struct vfsmount *);
9593 extern void __mnt_drop_write_file(struct file *);
9694
9795 /*
fs/nsfs.c+1−2
@@ -85,13 +85,12 @@ slow: · 84 unmodified lines
8585 inode->i_fop = &ns_file_operations;
8686 inode->i_private = ns;
8787
88− dentry = d_alloc_pseudo(mnt->mnt_sb, &empty_name);
88+ dentry = d_alloc_anon(mnt->mnt_sb);
8989 if (!dentry) {
9090 iput(inode);
9191 return ERR_PTR(-ENOMEM);
9292 }
9393 d_instantiate(dentry, inode);
94− dentry->d_flags |= DCACHE_RCUACCESS;
9594 dentry->d_fsdata = (void *)ns->ops;
9695 d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
9796 if (d) {
include/linux/dcache.h+1−1
@@ -176,7 +176,6 @@ struct dentry_operations { · 175 unmodified lines
176176 * typically using d_splice_alias. */
177177
178178 #define DCACHE_REFERENCED 0x00000040 /* Recently used, don't discard. */
179−#define DCACHE_RCUACCESS 0x00000080 /* Entry has ever been RCU-visible */
180179
181180 #define DCACHE_CANT_MOUNT 0x00000100
182181 #define DCACHE_GENOCIDE 0x00000200
@@ -217,6 +216,7 @@ struct dentry_operations { · 34 unmodified lines
217216
218217 #define DCACHE_PAR_LOOKUP 0x10000000 /* being looked up (with parent locked shared) */
219218 #define DCACHE_DENTRY_CURSOR 0x20000000
219+#define DCACHE_NORCU 0x40000000 /* No RCU delay for freeing */
220220
221221 extern seqlock_t rename_lock;
222222
include/linux/mount.h+2−0
@@ -87,6 +87,8 @@ extern bool mnt_may_suid(struct vfsmount *mnt); · 86 unmodified lines
8787
8888 struct path;
8989 extern struct vfsmount *clone_private_mount(const struct path *path);
90+extern int __mnt_want_write(struct vfsmount *);
91+extern void __mnt_drop_write(struct vfsmount *);
9092
9193 struct file_system_type;
9294 extern struct vfsmount *fc_mount(struct fs_context *fc);
kernel/acct.c+2−2
@@ -227,7 +227,7 @@ static int acct_on(struct filename *pathname) · 226 unmodified lines
227227 filp_close(file, NULL);
228228 return PTR_ERR(internal);
229229 }
230− err = mnt_want_write(internal);
230+ err = __mnt_want_write(internal);
231231 if (err) {
232232 mntput(internal);
233233 kfree(acct);
@@ -252,7 +252,7 @@ static int acct_on(struct filename *pathname) · 18 unmodified lines
252252 old = xchg(&ns->bacct, &acct->pin);
253253 mutex_unlock(&acct->lock);
254254 pin_kill(old);
255− mnt_drop_write(mnt);
255+ __mnt_drop_write(mnt);
256256 mntput(mnt);
257257 return 0;
258258 }