* [PATCH] tracefs/eventfs: Use dput to free the toplevel events directory
@ 2023-09-05 22:33 Steven Rostedt
2023-09-06 2:52 ` kernel test robot
0 siblings, 1 reply; 2+ messages in thread
From: Steven Rostedt @ 2023-09-05 22:33 UTC (permalink / raw)
To: LKML, Linux Trace Kernel
Cc: Masami Hiramatsu, Mark Rutland, Ajay Kaher, Zheng Yejian
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
Currently when rmdir on an instance is done, eventfs_remove_events_dir()
is called and it does a dput on the dentry and then frees the
eventfs_inode that represents the events directory.
But there's no protection against a reader reading the top level events
directory at the same time and we can get a use after free error. Instead,
use the dput() associated to the dentry to also free the eventfs_inode
associated to the events directory, as that will get called when the last
reference to the directory is released.
Link: https://lore.kernel.org/all/1cb3aee2-19af-c472-e265-05176fe9bd84@huawei.com/
Fixes: 5bdcd5f5331a2 eventfs: ("Implement removal of meta data from eventfs")
Reported-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
---
fs/tracefs/event_inode.c | 15 ++++++++++++---
fs/tracefs/inode.c | 2 +-
fs/tracefs/internal.h | 5 +++--
3 files changed, 16 insertions(+), 6 deletions(-)
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index fa1a1679a886..f4ceae9eac19 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -185,17 +185,27 @@ static struct dentry *create_dir(const char *name, struct dentry *parent, void *
/**
* eventfs_set_ef_status_free - set the ef->status to free
+ * @ti: the tracefs_inode of the dentry
* @dentry: dentry who's status to be freed
*
* eventfs_set_ef_status_free will be called if no more
* references remain
*/
-void eventfs_set_ef_status_free(struct dentry *dentry)
+void eventfs_set_ef_status_free(struct tracefs_inode *ti, struct dentry *dentry)
{
struct tracefs_inode *ti_parent;
+ struct eventfs_inode *ei;
struct eventfs_file *ef;
mutex_lock(&eventfs_mutex);
+
+ /* The top level events directory may be freed by this */
+ if (unlikely(ti->flags & TRACEFS_EVENT_TOP_INODE)) {
+ ei = ti->private;
+ kfree(ei);
+ goto out;
+ }
+
ti_parent = get_tracefs(dentry->d_parent->d_inode);
if (!ti_parent || !(ti_parent->flags & TRACEFS_EVENT_INODE))
goto out;
@@ -510,7 +520,7 @@ struct dentry *eventfs_create_events_dir(const char *name,
INIT_LIST_HEAD(&ei->e_top_files);
ti = get_tracefs(inode);
- ti->flags |= TRACEFS_EVENT_INODE;
+ ti->flags |= TRACEFS_EVENT_INODE | TRACEFS_EVENT_TOP_INODE;
ti->private = ei;
inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
@@ -818,5 +828,4 @@ void eventfs_remove_events_dir(struct dentry *dentry)
ei = ti->private;
d_invalidate(dentry);
dput(dentry);
- kfree(ei);
}
diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index 3b8dd938b1c8..891653ba9cf3 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c
@@ -385,7 +385,7 @@ static void tracefs_dentry_iput(struct dentry *dentry, struct inode *inode)
ti = get_tracefs(inode);
if (ti && ti->flags & TRACEFS_EVENT_INODE)
- eventfs_set_ef_status_free(dentry);
+ eventfs_set_ef_status_free(ti, dentry);
iput(inode);
}
diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h
index 69c2b1d87c46..4f2e49e2197b 100644
--- a/fs/tracefs/internal.h
+++ b/fs/tracefs/internal.h
@@ -3,7 +3,8 @@
#define _TRACEFS_INTERNAL_H
enum {
- TRACEFS_EVENT_INODE = BIT(1),
+ TRACEFS_EVENT_INODE = BIT(1),
+ TRACEFS_EVENT_TOP_INODE = BIT(2),
};
struct tracefs_inode {
@@ -24,6 +25,6 @@ struct inode *tracefs_get_inode(struct super_block *sb);
struct dentry *eventfs_start_creating(const char *name, struct dentry *parent);
struct dentry *eventfs_failed_creating(struct dentry *dentry);
struct dentry *eventfs_end_creating(struct dentry *dentry);
-void eventfs_set_ef_status_free(struct dentry *dentry);
+void eventfs_set_ef_status_free(struct tracefs_inode *ti, struct dentry *dentry);
#endif /* _TRACEFS_INTERNAL_H */
--
2.40.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] tracefs/eventfs: Use dput to free the toplevel events directory
2023-09-05 22:33 [PATCH] tracefs/eventfs: Use dput to free the toplevel events directory Steven Rostedt
@ 2023-09-06 2:52 ` kernel test robot
0 siblings, 0 replies; 2+ messages in thread
From: kernel test robot @ 2023-09-06 2:52 UTC (permalink / raw)
To: Steven Rostedt, LKML, Linux Trace Kernel
Cc: oe-kbuild-all, Masami Hiramatsu, Mark Rutland, Ajay Kaher, Zheng Yejian
Hi Steven,
kernel test robot noticed the following build warnings:
[auto build test WARNING on linus/master]
[also build test WARNING on next-20230905]
[cannot apply to v6.5]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Steven-Rostedt/tracefs-eventfs-Use-dput-to-free-the-toplevel-events-directory/20230906-063414
base: linus/master
patch link: https://lore.kernel.org/r/20230905183332.628d7cc0%40gandalf.local.home
patch subject: [PATCH] tracefs/eventfs: Use dput to free the toplevel events directory
config: sparc-allyesconfig (https://download.01.org/0day-ci/archive/20230906/202309061055.V08YOtla-lkp@intel.com/config)
compiler: sparc64-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20230906/202309061055.V08YOtla-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202309061055.V08YOtla-lkp@intel.com/
All warnings (new ones prefixed by >>):
fs/tracefs/event_inode.c: In function 'eventfs_remove_events_dir':
>> fs/tracefs/event_inode.c:804:31: warning: variable 'ei' set but not used [-Wunused-but-set-variable]
804 | struct eventfs_inode *ei;
| ^~
vim +/ei +804 fs/tracefs/event_inode.c
5bdcd5f5331a276 Ajay Kaher 2023-07-28 794
5bdcd5f5331a276 Ajay Kaher 2023-07-28 795 /**
5bdcd5f5331a276 Ajay Kaher 2023-07-28 796 * eventfs_remove_events_dir - remove eventfs dir or file from list
5bdcd5f5331a276 Ajay Kaher 2023-07-28 797 * @dentry: events's dentry to be removed.
5bdcd5f5331a276 Ajay Kaher 2023-07-28 798 *
5bdcd5f5331a276 Ajay Kaher 2023-07-28 799 * This function remove events main directory
5bdcd5f5331a276 Ajay Kaher 2023-07-28 800 */
5bdcd5f5331a276 Ajay Kaher 2023-07-28 801 void eventfs_remove_events_dir(struct dentry *dentry)
5bdcd5f5331a276 Ajay Kaher 2023-07-28 802 {
5bdcd5f5331a276 Ajay Kaher 2023-07-28 803 struct tracefs_inode *ti;
5bdcd5f5331a276 Ajay Kaher 2023-07-28 @804 struct eventfs_inode *ei;
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-09-06 2:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-09-05 22:33 [PATCH] tracefs/eventfs: Use dput to free the toplevel events directory Steven Rostedt
2023-09-06 2:52 ` kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.