Re: [PATCH] ovl: restore vma->vm_file to old file

[Miklos Szeredi <miklos@szeredi.hu>]

On Wed, Apr 21, 2021 at 1:03 PM Christian König
<christian.koenig@amd.com> wrote:
>
> Am 21.04.21 um 11:47 schrieb Miklos Szeredi:
> > On Tue, Apr 20, 2021 at 4:08 AM Chengguang Xu <cgxu519@mykernel.net> wrote:
> >> In the error case of ->mmap() we should also restore vma->vm_file
> >> to old file in order to keep correct file reference in error path.
> >>
> >> Signed-off-by: Chengguang Xu <cgxu519@mykernel.net>
> >> ---
> >>   fs/overlayfs/file.c | 1 +
> >>   1 file changed, 1 insertion(+)
> >>
> >> diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
> >> index 6e454a294046..046a7adb02c5 100644
> >> --- a/fs/overlayfs/file.c
> >> +++ b/fs/overlayfs/file.c
> >> @@ -439,6 +439,7 @@ static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
> >>          if (ret) {
> >>                  /* Drop reference count from new vm_file value */
> >>                  fput(realfile);
> >> +               vma->vm_file = file;
> > That's interesting: commit 1527f926fd04 ("mm: mmap: fix fput in error
> > path v2") which went into 5.11-rc1 seems to have broke the refcounting
> > in overlayfs in the name of cleaning up a workaround.   Wondering if
> > there's any other damage done by this "fix"?
>
> Can you give wider context? In other words why did the patch broke the
> reference counting in overlayfs?

In the error case overlayfs would put the reference on realfile (which
is vma->vm_file at that point) and mmap_region() would put the
reference to the original file (which was vma->vm_file before being
overridden).

After your commit mmap_region() puts the ref on the override vm_file,
but not on the original file.

>
> > Changing refcounting rules in core kernel is no easy matter, a full
> > audit of ->mmap instances (>200) should have been done beforehand.
>
> Which is pretty much what was done, see the follow up commit:
>
> commit 295992fb815e791d14b18ef7cdbbaf1a76211a31 (able/vma_file)
> Author: Christian König <christian.koenig@amd.com>
> Date:   Mon Sep 14 15:09:33 2020 +0200
>
>      mm: introduce vma_set_file function v5
>
>      Add the new vma_set_file() function to allow changing
>      vma->vm_file with the necessary refcount dance.
>
> It just looks like I missed the case in overlayfs while doing this.

Yes.  And apparently a number of other cases where vm_file is assigned...

Thanks,
Miklos