All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] fix filp_cachep memory corruption
@ 2011-02-02 19:18 J. R. Okajima
  2011-02-10 22:57 ` Andrew Morton
  0 siblings, 1 reply; 3+ messages in thread
From: J. R. Okajima @ 2011-02-02 19:18 UTC (permalink / raw)
  To: Nick Piggin; +Cc: linux-kernel, linux-fsdevel


commit e1ddf5b0dd3e8234581c78c3cadd6e2adfe6e2d4
Author: J. R. Okajima <hooanon05@yahoo.co.jp>
Date:   Thu Feb 3 03:38:12 2011 +0900

    fix filp_cachep memory corruption
    
    By the commit
    	31e6b01 2011-01-07 fs: rcu-walk for path lookup
    the condition "-ESTALE && !LOOKUP_REVAL" is added to "goto reval" in
    do_filp_open(), and it lookup again with LOOKUP_REVAL _after_
    release_open_intent(). Since release_open_intent() is called by
    do_last() and finish_open() too, add the same condition to all of them.
    
    Signed-off-by: J. R. Okajima <hooanon05@yahoo.co.jp>

diff --git a/fs/namei.c b/fs/namei.c
index 084be4d..1f62d6a 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2269,7 +2269,8 @@ static struct file *finish_open(struct nameidata *nd,
 	return filp;
 
 exit:
-	if (!IS_ERR(nd->intent.open.file))
+	if (!(error == -ESTALE && !(nd->flags & LOOKUP_REVAL))
+	    && !IS_ERR(nd->intent.open.file))
 		release_open_intent(nd);
 	path_put(&nd->path);
 	return ERR_PTR(error);
@@ -2393,7 +2394,8 @@ exit_mutex_unlock:
 exit_dput:
 	path_put_conditional(path, nd);
 exit:
-	if (!IS_ERR(nd->intent.open.file))
+	if (!(error == -ESTALE && !(nd->flags & LOOKUP_REVAL))
+	    && !IS_ERR(nd->intent.open.file))
 		release_open_intent(nd);
 	path_put(&nd->path);
 	return ERR_PTR(error);
@@ -2564,7 +2566,8 @@ exit_dput:
 out_path:
 	path_put(&nd.path);
 out_filp:
-	if (!IS_ERR(nd.intent.open.file))
+	if (!(error == -ESTALE && !(flags & LOOKUP_REVAL))
+	    && !IS_ERR(nd.intent.open.file))
 		release_open_intent(&nd);
 	filp = ERR_PTR(error);
 	goto out;

^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [PATCH] fix filp_cachep memory corruption
  2011-02-02 19:18 [PATCH] fix filp_cachep memory corruption J. R. Okajima
@ 2011-02-10 22:57 ` Andrew Morton
  2011-02-13  2:05   ` J. R. Okajima
  0 siblings, 1 reply; 3+ messages in thread
From: Andrew Morton @ 2011-02-10 22:57 UTC (permalink / raw)
  To: J. R. Okajima; +Cc: Nick Piggin, linux-kernel, linux-fsdevel

On Thu, 03 Feb 2011 04:18:58 +0900
"J. R. Okajima" <hooanon05@yahoo.co.jp> wrote:

> 
> commit e1ddf5b0dd3e8234581c78c3cadd6e2adfe6e2d4
> Author: J. R. Okajima <hooanon05@yahoo.co.jp>
> Date:   Thu Feb 3 03:38:12 2011 +0900
> 
>     fix filp_cachep memory corruption
>     
>     By the commit
>     	31e6b01 2011-01-07 fs: rcu-walk for path lookup
>     the condition "-ESTALE && !LOOKUP_REVAL" is added to "goto reval" in
>     do_filp_open(), and it lookup again with LOOKUP_REVAL _after_
>     release_open_intent(). Since release_open_intent() is called by
>     do_last() and finish_open() too, add the same condition to all of them.
>     
>     Signed-off-by: J. R. Okajima <hooanon05@yahoo.co.jp>
> 
> diff --git a/fs/namei.c b/fs/namei.c
> index 084be4d..1f62d6a 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -2269,7 +2269,8 @@ static struct file *finish_open(struct nameidata *nd,
>  	return filp;
>  
>  exit:
> -	if (!IS_ERR(nd->intent.open.file))
> +	if (!(error == -ESTALE && !(nd->flags & LOOKUP_REVAL))
> +	    && !IS_ERR(nd->intent.open.file))
>  		release_open_intent(nd);
>  	path_put(&nd->path);
>  	return ERR_PTR(error);
> @@ -2393,7 +2394,8 @@ exit_mutex_unlock:
>  exit_dput:
>  	path_put_conditional(path, nd);
>  exit:
> -	if (!IS_ERR(nd->intent.open.file))
> +	if (!(error == -ESTALE && !(nd->flags & LOOKUP_REVAL))
> +	    && !IS_ERR(nd->intent.open.file))
>  		release_open_intent(nd);
>  	path_put(&nd->path);
>  	return ERR_PTR(error);
> @@ -2564,7 +2566,8 @@ exit_dput:
>  out_path:
>  	path_put(&nd.path);
>  out_filp:
> -	if (!IS_ERR(nd.intent.open.file))
> +	if (!(error == -ESTALE && !(flags & LOOKUP_REVAL))
> +	    && !IS_ERR(nd.intent.open.file))
>  		release_open_intent(&nd);
>  	filp = ERR_PTR(error);
>  	goto out;

The patch is pretty ugly.  It would be much nicer if we had a
well-named and documented helper function to replace that repeated
open-coded test.  Not just because the code looks better - a standalone
function is an opportunity to explain to readers what the code is
trying to do.


Anyway, as Nick appears to have done a dump-and-run on the kernel
project, I shall send your fix into Linus as-is.  Perhaps you or Nick
could look into cleaning things up later on?


^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [PATCH] fix filp_cachep memory corruption
  2011-02-10 22:57 ` Andrew Morton
@ 2011-02-13  2:05   ` J. R. Okajima
  0 siblings, 0 replies; 3+ messages in thread
From: J. R. Okajima @ 2011-02-13  2:05 UTC (permalink / raw)
  To: Andrew Morton
  Cc: Nick Piggin, linux-kernel, linux-fsdevel, Linus Torvalds, viro


Andrew Morton:
> Anyway, as Nick appears to have done a dump-and-run on the kernel
> project, I shall send your fix into Linus as-is.  Perhaps you or Nick
> could look into cleaning things up later on?

Before I say "I agree and will clean up", Linus did it and the refined
patch is already merged.
Reading his patch, I am afraid there exists a possibitily of a problem.
In creating a file (and in rcu-walk mode), if ->open returns ESTALE,
then the problem may happen in the next ref-walk mode because
intent.open.file is reset to NULL. But I don't know whether such ->open
exists currently or not.


J. R. Okajima

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-02-13  2:06 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-02-02 19:18 [PATCH] fix filp_cachep memory corruption J. R. Okajima
2011-02-10 22:57 ` Andrew Morton
2011-02-13  2:05   ` J. R. Okajima

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.