All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jeff Layton <jlayton@kernel.org>
To: Al Viro <viro@zeniv.linux.org.uk>, linux-fsdevel@vger.kernel.org
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
	Christian Brauner <brauner@kernel.org>,
	linux-ext4@vger.kernel.org, linux-nfs@vger.kernel.org,
	 Miklos Szeredi <miklos@szeredi.hu>,
	linux-cifs@vger.kernel.org
Subject: Re: [PATCHES] RCU pathwalk race fixes
Date: Mon, 05 Feb 2024 07:48:17 -0500	[thread overview]
Message-ID: <c33d3939f30df5fb087c9dfd16ae6734eca1708f.camel@kernel.org> (raw)
In-Reply-To: <20240204021436.GH2087318@ZenIV>

On Sun, 2024-02-04 at 02:14 +0000, Al Viro wrote:
> 	We still have some races in filesystem methods when exposed
> to RCU pathwalk.  The series below is a result of code audit (the
> second round of it) and it should deal with most of that stuff.
> Exceptions: ntfs3 ->d_hash()/->d_compare() and ceph_d_revalidate().
> Up to maintainers (a note for NTFS folks - when documentation says
> that a method may not block, it *does* imply that blocking allocations
> are to be avoided.  Really).
> 
> 	Branch is 6.8-rc1-based; it lives in
> git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git fixes.pathwalk-rcu
> 
> Individual patches are in followups; ditto for code audit notes.  Beginning
> of the latter should probably be converted into docs; if anyone is willing
> to help with such conversion, please say so - I'll be glad to answer any
> questions, etc.
> 
> If somebody wants to grab bits and pieces of that series into individual
> filesystem git trees, please say so.  Same for any problems spotted in
> the patches, obviously.  If nothing shows up, that goes into #fixes and
> into mainline.
> 
> Shortlog:
>       fs/super.c: don't drop ->s_user_ns until we free struct super_block itself
>       rcu pathwalk: prevent bogus hard errors from may_lookup()
>       affs: free affs_sb_info with kfree_rcu()
>       exfat: move freeing sbi, upcase table and dropping nls into rcu-delayed helper
>       hfsplus: switch to rcu-delayed unloading of nls and freeing ->s_fs_info
>       afs: fix __afs_break_callback() / afs_drop_open_mmap() race
>       nfs: make nfs_set_verifier() safe for use in RCU pathwalk
>       nfs: fix UAF on pathwalk running into umount
>       procfs: move dropping pde and pid from ->evict_inode() to ->free_inode()
>       procfs: make freeing proc_fs_info rcu-delayed
>       fuse: fix UAF in rcu pathwalks
>       cifs_get_link(): bail out in unsafe case
>       ext4_get_link(): fix breakage in RCU mode
> 
> Diffstat:
>  fs/affs/affs.h            |  1 +
>  fs/affs/super.c           |  2 +-
>  fs/afs/file.c             |  8 ++++++--
>  fs/exfat/exfat_fs.h       |  1 +
>  fs/exfat/nls.c            | 14 ++++----------
>  fs/exfat/super.c          | 20 +++++++++++---------
>  fs/ext4/symlink.c         |  8 +++++---
>  fs/fuse/cuse.c            |  3 +--
>  fs/fuse/fuse_i.h          |  1 +
>  fs/fuse/inode.c           | 15 +++++++++++----
>  fs/hfsplus/hfsplus_fs.h   |  1 +
>  fs/hfsplus/super.c        | 12 +++++++++---
>  fs/namei.c                |  6 +++++-
>  fs/nfs/client.c           | 13 ++++++++++---
>  fs/nfs/dir.c              |  4 ++--
>  fs/proc/base.c            |  2 --
>  fs/proc/inode.c           | 19 ++++++++-----------
>  fs/proc/root.c            |  2 +-
>  fs/smb/client/cifsfs.c    |  3 +++
>  fs/super.c                | 13 ++++---------
>  include/linux/nfs_fs_sb.h |  2 ++
>  include/linux/proc_fs.h   |  1 +
>  22 files changed, 88 insertions(+), 63 deletions(-)
> 

Reviewed-by: Jeff Layton <jlayton@kernel.org>

      parent reply	other threads:[~2024-02-05 12:48 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-02-04  2:14 [PATCHES] RCU pathwalk race fixes Al Viro
2024-02-04  2:17 ` [PATCH 01/13] fs/super.c: don't drop ->s_user_ns until we free struct super_block itself Al Viro
2024-02-04  2:17   ` [PATCH 02/13] rcu pathwalk: prevent bogus hard errors from may_lookup() Al Viro
2024-02-05 12:26     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 03/13] affs: free affs_sb_info with kfree_rcu() Al Viro
2024-02-05 12:26     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 04/13] exfat: move freeing sbi, upcase table and dropping nls into rcu-delayed helper Al Viro
2024-02-05 12:27     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 05/13] hfsplus: switch to rcu-delayed unloading of nls and freeing ->s_fs_info Al Viro
2024-02-05 12:27     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 06/13] afs: fix __afs_break_callback() / afs_drop_open_mmap() race Al Viro
2024-02-05 12:28     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 07/13] nfs: make nfs_set_verifier() safe for use in RCU pathwalk Al Viro
2024-02-05 12:29     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 08/13] nfs: fix UAF on pathwalk running into umount Al Viro
2024-02-05 12:29     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 09/13] procfs: move dropping pde and pid from ->evict_inode() to ->free_inode() Al Viro
2024-02-05 12:30     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 10/13] procfs: make freeing proc_fs_info rcu-delayed Al Viro
2024-02-05 12:31     ` Christian Brauner
2024-02-04  2:17   ` [PATCH 11/13] fuse: fix UAF in rcu pathwalks Al Viro
2024-02-05 12:31     ` Christian Brauner
2024-02-05 13:51       ` Miklos Szeredi
2024-03-04 14:36         ` Amir Goldstein
2024-03-05 12:43           ` Miklos Szeredi
2024-03-06 10:18             ` Amir Goldstein
2024-03-06 10:21               ` Miklos Szeredi
2024-02-04  2:17   ` [PATCH 12/13] cifs_get_link(): bail out in unsafe case Al Viro
2024-02-04 15:45     ` Steve French
2024-02-04 16:25       ` Al Viro
2024-02-04 16:41         ` Al Viro
2024-02-04  2:17   ` [PATCH 13/13] ext4_get_link(): fix breakage in RCU mode Al Viro
2024-02-05 12:24   ` [PATCH 01/13] fs/super.c: don't drop ->s_user_ns until we free struct super_block itself Christian Brauner
2024-02-05 12:36   ` Jeff Layton
2024-02-04  2:27 ` RCU pathwalk audit notes Al Viro
2024-02-05 12:48 ` Jeff Layton [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=c33d3939f30df5fb087c9dfd16ae6734eca1708f.camel@kernel.org \
    --to=jlayton@kernel.org \
    --cc=brauner@kernel.org \
    --cc=linux-cifs@vger.kernel.org \
    --cc=linux-ext4@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-nfs@vger.kernel.org \
    --cc=miklos@szeredi.hu \
    --cc=torvalds@linux-foundation.org \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.