* [PATCH 1/5] Safer nfsd_cross_mnt()
@ 2009-04-21 21:43 Al Viro
2009-04-22 18:06 ` J. Bruce Fields
0 siblings, 1 reply; 4+ messages in thread
From: Al Viro @ 2009-04-21 21:43 UTC (permalink / raw)
To: linux-nfs
AFAICS, we have a subtle bug there: if we have crossed mountpoint
*and* it got mount --move'd away, we'll be holding only one
reference to fs containing dentry - exp->ex_path.mnt. IOW, we
ought to dput() before exp_put().
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
fs/nfsd/vfs.c | 9 +++++++--
1 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index ab93fcf..46e6bd2 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -116,10 +116,15 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
}
if ((exp->ex_flags & NFSEXP_CROSSMOUNT) || EX_NOHIDE(exp2)) {
/* successfully crossed mount point */
- exp_put(exp);
- *expp = exp2;
+ /*
+ * This is subtle: dentry is *not* under mnt at this point.
+ * The only reason we are safe is that original mnt is pinned
+ * down by exp, so we should dput before putting exp.
+ */
dput(dentry);
*dpp = mounts;
+ exp_put(exp);
+ *expp = exp2;
} else {
exp_put(exp2);
dput(mounts);
--
1.5.6.5
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 1/5] Safer nfsd_cross_mnt()
2009-04-21 21:43 [PATCH 1/5] Safer nfsd_cross_mnt() Al Viro
@ 2009-04-22 18:06 ` J. Bruce Fields
2009-04-22 19:17 ` Al Viro
0 siblings, 1 reply; 4+ messages in thread
From: J. Bruce Fields @ 2009-04-22 18:06 UTC (permalink / raw)
To: Al Viro; +Cc: linux-nfs
On Tue, Apr 21, 2009 at 09:43:41PM +0000, Al Viro wrote:
>
> AFAICS, we have a subtle bug there: if we have crossed mountpoint
> *and* it got mount --move'd away, we'll be holding only one
> reference to fs containing dentry - exp->ex_path.mnt. IOW, we
> ought to dput() before exp_put().
OK. So a dentry of its own doesn't hold any reference on its
filesystem?
--b.
>
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
> ---
> fs/nfsd/vfs.c | 9 +++++++--
> 1 files changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
> index ab93fcf..46e6bd2 100644
> --- a/fs/nfsd/vfs.c
> +++ b/fs/nfsd/vfs.c
> @@ -116,10 +116,15 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
> }
> if ((exp->ex_flags & NFSEXP_CROSSMOUNT) || EX_NOHIDE(exp2)) {
> /* successfully crossed mount point */
> - exp_put(exp);
> - *expp = exp2;
> + /*
> + * This is subtle: dentry is *not* under mnt at this point.
> + * The only reason we are safe is that original mnt is pinned
> + * down by exp, so we should dput before putting exp.
> + */
> dput(dentry);
> *dpp = mounts;
> + exp_put(exp);
> + *expp = exp2;
> } else {
> exp_put(exp2);
> dput(mounts);
> --
> 1.5.6.5
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 1/5] Safer nfsd_cross_mnt()
2009-04-22 18:06 ` J. Bruce Fields
@ 2009-04-22 19:17 ` Al Viro
2009-04-22 19:20 ` J. Bruce Fields
0 siblings, 1 reply; 4+ messages in thread
From: Al Viro @ 2009-04-22 19:17 UTC (permalink / raw)
To: J. Bruce Fields; +Cc: Al Viro, linux-nfs
On Wed, Apr 22, 2009 at 02:06:41PM -0400, J. Bruce Fields wrote:
> On Tue, Apr 21, 2009 at 09:43:41PM +0000, Al Viro wrote:
> >
> > AFAICS, we have a subtle bug there: if we have crossed mountpoint
> > *and* it got mount --move'd away, we'll be holding only one
> > reference to fs containing dentry - exp->ex_path.mnt. IOW, we
> > ought to dput() before exp_put().
>
> OK. So a dentry of its own doesn't hold any reference on its
> filesystem?
Nope. That's why you want vfsmount or superblock reference.
And export *does* contain vfsmount reference, so everything's fine,
provided that you drop them in the right order.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 1/5] Safer nfsd_cross_mnt()
2009-04-22 19:17 ` Al Viro
@ 2009-04-22 19:20 ` J. Bruce Fields
0 siblings, 0 replies; 4+ messages in thread
From: J. Bruce Fields @ 2009-04-22 19:20 UTC (permalink / raw)
To: Al Viro; +Cc: Al Viro, linux-nfs
On Wed, Apr 22, 2009 at 08:17:19PM +0100, Al Viro wrote:
> On Wed, Apr 22, 2009 at 02:06:41PM -0400, J. Bruce Fields wrote:
> > On Tue, Apr 21, 2009 at 09:43:41PM +0000, Al Viro wrote:
> > >
> > > AFAICS, we have a subtle bug there: if we have crossed mountpoint
> > > *and* it got mount --move'd away, we'll be holding only one
> > > reference to fs containing dentry - exp->ex_path.mnt. IOW, we
> > > ought to dput() before exp_put().
> >
> > OK. So a dentry of its own doesn't hold any reference on its
> > filesystem?
>
> Nope. That's why you want vfsmount or superblock reference.
> And export *does* contain vfsmount reference, so everything's fine,
> provided that you drop them in the right order.
Got it, thanks.
--b.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2009-04-22 19:20 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-04-21 21:43 [PATCH 1/5] Safer nfsd_cross_mnt() Al Viro
2009-04-22 18:06 ` J. Bruce Fields
2009-04-22 19:17 ` Al Viro
2009-04-22 19:20 ` J. Bruce Fields
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.