From: Al Viro <viro@zeniv.linux.org.uk>
To: Olga Kornievskaia <kolga@netapp.com>
Cc: Alexey Gladkov <gladkov.alexey@gmail.com>,
"Eric W. Biederman" <ebiederm@xmission.com>,
syzbot <syzbot+c1af344512918c61362c@syzkaller.appspotmail.com>,
jmorris@namei.org, linux-kernel@vger.kernel.org,
linux-next@vger.kernel.org,
linux-security-module@vger.kernel.org, serge@hallyn.com,
sfr@canb.auug.org.au, syzkaller-bugs@googlegroups.com,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
".Tetsuo Handa" <penguin-kernel@i-love.sakura.ne.jp>
Subject: Re: linux-next boot error: general protection fault in tomoyo_get_local_path
Date: Fri, 15 May 2020 21:56:21 +0100 [thread overview]
Message-ID: <20200515205621.GH23230@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20200515201357.GG23230@ZenIV.linux.org.uk>
On Fri, May 15, 2020 at 09:13:57PM +0100, Al Viro wrote:
> On Sat, May 16, 2020 at 12:36:28AM +0900, Tetsuo Handa wrote:
> > On 2020/05/16 0:18, Tetsuo Handa wrote:
[snip]
> > A similar bug (racing inode destruction with open() on proc filesystem) was fixed as
> > commit 6f7c41374b62fd80 ("tomoyo: Don't use nifty names on sockets."). Then, it might
> > not be safe to replace dentry->d_sb->s_fs_info with dentry->d_inode->i_sb->s_fs_info .
>
> Could you explain why do you want to bother with d_inode() anyway? Anything that
> does dentry->d_inode->i_sb can bloody well use dentry->d_sb. And that's never
> changed over the struct dentry lifetime - ->d_sb is set on allocation and never
> modified afterwards.
Incidentally, this
r_ino = nfs_fhget(ss_mnt->mnt_root->d_inode->i_sb, src_fh, &fattr,
NULL);
(in nfs42_ssc_open()) is just plain weird.
1) d->d_inode->i_sb is equal to d->d_sb
2) m->mnt_root->d_sb is equal to m->mnt_sb
IOW, the whole thing should be
r_ino = nfs_fhget(ss_mnt->mnt_sb, src_fh, &fattr, NULL);
Moreover,
server = NFS_SERVER(ss_mnt->mnt_root->d_inode);
in the same function is again too convoluted for no good reason, seeing that
NFS_SERVER(inode) is NFS_SB(inode->i_sb).
Something along the lines of
nfs: don't obfuscate ->mnt_sb as ->mnt_root->d_inode->i_sb
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 8e5d6223ddd3..1e8ca45bc806 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -317,15 +317,14 @@ nfs42_ssc_open(struct vfsmount *ss_mnt, struct nfs_fh *src_fh,
{
struct nfs_fattr fattr;
struct file *filep, *res;
- struct nfs_server *server;
+ struct super_block *sb = ss_mnt->mnt_sb;
+ struct nfs_server *server = NFS_SB(sb);
struct inode *r_ino = NULL;
struct nfs_open_context *ctx;
struct nfs4_state_owner *sp;
char *read_name = NULL;
int len, status = 0;
- server = NFS_SERVER(ss_mnt->mnt_root->d_inode);
-
nfs_fattr_init(&fattr);
status = nfs4_proc_getattr(server, src_fh, &fattr, NULL, NULL);
@@ -341,8 +340,7 @@ nfs42_ssc_open(struct vfsmount *ss_mnt, struct nfs_fh *src_fh,
goto out;
snprintf(read_name, len, SSC_READ_NAME_BODY, read_name_gen++);
- r_ino = nfs_fhget(ss_mnt->mnt_root->d_inode->i_sb, src_fh, &fattr,
- NULL);
+ r_ino = nfs_fhget(sb, src_fh, &fattr, NULL);
if (IS_ERR(r_ino)) {
res = ERR_CAST(r_ino);
goto out_free_name;
next prev parent reply other threads:[~2020-05-15 20:56 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-15 14:46 linux-next boot error: general protection fault in tomoyo_get_local_path syzbot
2020-05-15 15:18 ` Tetsuo Handa
2020-05-15 15:36 ` Tetsuo Handa
2020-05-15 20:13 ` Al Viro
2020-05-15 20:36 ` Eric W. Biederman
2020-05-15 20:56 ` Al Viro [this message]
2020-05-15 18:16 ` Eric W. Biederman
2020-05-15 19:25 ` Alexey Gladkov
2020-05-17 17:11 ` [PATCH] proc: proc_pid_ns takes super_block as an argument Alexey Gladkov
2020-05-18 11:17 ` [PATCH v2] " Alexey Gladkov
2020-05-18 12:08 ` Eric W. Biederman
2020-05-18 12:56 ` Alexey Gladkov
2020-05-18 12:57 ` Eric W. Biederman
2020-05-18 15:08 ` [PATCH v3] " Alexey Gladkov
2020-05-18 15:36 ` Tetsuo Handa
2020-05-18 18:07 ` [PATCH v4] " Alexey Gladkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200515205621.GH23230@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=ebiederm@xmission.com \
--cc=gladkov.alexey@gmail.com \
--cc=jmorris@namei.org \
--cc=kolga@netapp.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-next@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=serge@hallyn.com \
--cc=sfr@canb.auug.org.au \
--cc=syzbot+c1af344512918c61362c@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.