All of
 help / color / mirror / Atom feed
From: Al Viro <>
To: Steve French <>
	Linus Torvalds <>,
	Christian Brauner <>,
	Miklos Szeredi <>,
Subject: Re: [PATCH 12/13] cifs_get_link(): bail out in unsafe case
Date: Sun, 4 Feb 2024 16:25:58 +0000	[thread overview]
Message-ID: <20240204162558.GJ2087318@ZenIV> (raw)
In-Reply-To: <>

On Sun, Feb 04, 2024 at 09:45:42AM -0600, Steve French wrote:
> I may be missing some additional change or proposed future change -
> but it looks like the patch to add check for null dentry in
> cifs_get_link causes
> an extra call to cifs_get_link in pick_link() (in namei.c - see
> below), so would be slightly slower than leaving code as is in
> cifs_get_link
>                 if (nd->flags & LOOKUP_RCU) {
>                         res = get(NULL, inode, &last->done);
>                         if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd))
>                                 res = get(link->dentry, inode, &last->done);
> cifs.ko doesn't use or check the dentry in cifs_get_link since the
> symlink target is stored in the cifs inode, not  accessed via the
> dentry, so wasn't clear to me
> from the patch description why we would care if dentry is null in
> cifs_get_link()

The very first thing you do in there is a GFP_KERNEL allocation.
You can't do that under rcu_read_lock(), for obvious reasons.

So if you ever get there (and it takes a somewhat convoluted setup -
you need to bind a cifs symlink over a file on a local filesystem),
you need to
	* carefully grab references to all dentries involved,
verify that they are still valid, etc.
	* drop rcu_read_lock()
before you can get on with fetching the symlink target.

That's precisely what try_to_unlazy() in the fragment you've
quoted is doing.

NULL dentry argument passed to ->get_link() is the way it is told
that we are in RCU pathwalk mode; anyone who can't handle that
should just return ERR_PTR(-ECHILD) and be done with that.  The
caller will switch to the non-RCU mode (with references pinned,
etc.) and call again.

*IF* you can tell the symlink body without blocking (e.g. you
have some cached information from the last time you've asked
the server and have reasons to trust it to be still valid),
sure, you can return it without dropping out of RCU mode.

It would be fairly useless for CIFS, since ->d_revalidate() of
CIFS dentries would reject RCU mode anyway.  That's what normally
saves you from having ->get_link() called that way, but it's not
guaranteed - there are convoluted setups that avoid having
->d_revalidate() called first.

See the description of RCU mode filesystem exposure in the
last posting in this thread for more details.

  reply	other threads:[~2024-02-04 16:26 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-02-04  2:14 [PATCHES] RCU pathwalk race fixes Al Viro
2024-02-04  2:17 ` [PATCH 01/13] fs/super.c: don't drop ->s_user_ns until we free struct super_block itself Al Viro
2024-02-04  2:17   ` [PATCH 02/13] rcu pathwalk: prevent bogus hard errors from may_lookup() Al Viro
2024-02-05 12:26     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 03/13] affs: free affs_sb_info with kfree_rcu() Al Viro
2024-02-05 12:26     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 04/13] exfat: move freeing sbi, upcase table and dropping nls into rcu-delayed helper Al Viro
2024-02-05 12:27     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 05/13] hfsplus: switch to rcu-delayed unloading of nls and freeing ->s_fs_info Al Viro
2024-02-05 12:27     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 06/13] afs: fix __afs_break_callback() / afs_drop_open_mmap() race Al Viro
2024-02-05 12:28     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 07/13] nfs: make nfs_set_verifier() safe for use in RCU pathwalk Al Viro
2024-02-05 12:29     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 08/13] nfs: fix UAF on pathwalk running into umount Al Viro
2024-02-05 12:29     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 09/13] procfs: move dropping pde and pid from ->evict_inode() to ->free_inode() Al Viro
2024-02-05 12:30     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 10/13] procfs: make freeing proc_fs_info rcu-delayed Al Viro
2024-02-05 12:31     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 11/13] fuse: fix UAF in rcu pathwalks Al Viro
2024-02-05 12:31     ` Christian Brauner
2024-02-05 13:51       ` Miklos Szeredi
2024-03-04 14:36         ` Amir Goldstein
2024-03-05 12:43           ` Miklos Szeredi
2024-03-06 10:18             ` Amir Goldstein
2024-03-06 10:21               ` Miklos Szeredi
2024-02-04  2:17   ` [PATCH 12/13] cifs_get_link(): bail out in unsafe case Al Viro
2024-02-04 15:45     ` Steve French
2024-02-04 16:25       ` Al Viro [this message]
2024-02-04 16:41         ` Al Viro
2024-02-04  2:17   ` [PATCH 13/13] ext4_get_link(): fix breakage in RCU mode Al Viro
2024-02-05 12:24   ` [PATCH 01/13] fs/super.c: don't drop ->s_user_ns until we free struct super_block itself Christian Brauner
2024-02-05 12:36   ` Jeff Layton
2024-02-04  2:27 ` RCU pathwalk audit notes Al Viro
2024-02-05 12:48 ` [PATCHES] RCU pathwalk race fixes Jeff Layton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240204162558.GJ2087318@ZenIV \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.