Linux-Fsdevel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH for linux 4.4.y/3.16.y] fs/dcache: move security_d_instantiate() behind attaching dentry to inode
@ 2019-11-06  9:43 zhangyi (F)
  2019-11-08 17:36 ` Greg KH
  0 siblings, 1 reply; 2+ messages in thread
From: zhangyi (F) @ 2019-11-06  9:43 UTC (permalink / raw)
  To: gregkh; +Cc: stable, viro, linux-fsdevel, yi.zhang

During backport 1e2e547a93a "do d_instantiate/unlock_new_inode
combinations safely", there was a error instantiating sequence of
attaching dentry to inode and calling security_d_instantiate().

Before commit ce23e640133 "->getxattr(): pass dentry and inode as
separate arguments" and b96809173e9 "security_d_instantiate(): move to
the point prior to attaching dentry to inode", security_d_instantiate()
should be called beind __d_instantiate(), otherwise it will trigger
below problem when CONFIG_SECURITY_SMACK on ext4 was enabled because
d_inode(dentry) used by ->getxattr() is NULL before __d_instantiate()
instantiate inode.

[   31.858026] BUG: unable to handle kernel paging request at ffffffffffffff70
...
[   31.882024] Call Trace:
[   31.882378]  [<ffffffffa347f75c>] ext4_xattr_get+0x8c/0x3e0
[   31.883195]  [<ffffffffa3489454>] ext4_xattr_security_get+0x24/0x40
[   31.884086]  [<ffffffffa336a56b>] generic_getxattr+0x5b/0x90
[   31.884907]  [<ffffffffa3700514>] smk_fetch+0xb4/0x150
[   31.885634]  [<ffffffffa3700772>] smack_d_instantiate+0x1c2/0x550
[   31.886508]  [<ffffffffa36f9a5a>] security_d_instantiate+0x3a/0x80
[   31.887389]  [<ffffffffa3353b26>] d_instantiate_new+0x36/0x130
[   31.888223]  [<ffffffffa342b1ef>] ext4_mkdir+0x4af/0x6a0
[   31.888928]  [<ffffffffa3343470>] vfs_mkdir+0x100/0x280
[   31.889536]  [<ffffffffa334b086>] SyS_mkdir+0xb6/0x170
[   31.890255]  [<ffffffffa307c855>] ? trace_do_page_fault+0x95/0x2b0
[   31.891134]  [<ffffffffa3c5e078>] entry_SYSCALL_64_fastpath+0x18/0x73

Cc: <stable@vger.kernel.org> # 3.16, 4.4
Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
---
 fs/dcache.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/dcache.c b/fs/dcache.c
index 5a1c36dc5d65..baa00718d8d1 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1900,7 +1900,6 @@ void d_instantiate_new(struct dentry *entry, struct inode *inode)
 	BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
 	BUG_ON(!inode);
 	lockdep_annotate_inode_mutex_key(inode);
-	security_d_instantiate(entry, inode);
 	spin_lock(&inode->i_lock);
 	__d_instantiate(entry, inode);
 	WARN_ON(!(inode->i_state & I_NEW));
@@ -1908,6 +1907,7 @@ void d_instantiate_new(struct dentry *entry, struct inode *inode)
 	smp_mb();
 	wake_up_bit(&inode->i_state, __I_NEW);
 	spin_unlock(&inode->i_lock);
+	security_d_instantiate(entry, inode);
 }
 EXPORT_SYMBOL(d_instantiate_new);
 
-- 
2.17.2


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH for linux 4.4.y/3.16.y] fs/dcache: move security_d_instantiate() behind attaching dentry to inode
  2019-11-06  9:43 [PATCH for linux 4.4.y/3.16.y] fs/dcache: move security_d_instantiate() behind attaching dentry to inode zhangyi (F)
@ 2019-11-08 17:36 ` Greg KH
  0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2019-11-08 17:36 UTC (permalink / raw)
  To: zhangyi (F); +Cc: stable, viro, linux-fsdevel

On Wed, Nov 06, 2019 at 05:43:52PM +0800, zhangyi (F) wrote:
> During backport 1e2e547a93a "do d_instantiate/unlock_new_inode
> combinations safely", there was a error instantiating sequence of
> attaching dentry to inode and calling security_d_instantiate().
> 
> Before commit ce23e640133 "->getxattr(): pass dentry and inode as
> separate arguments" and b96809173e9 "security_d_instantiate(): move to
> the point prior to attaching dentry to inode", security_d_instantiate()
> should be called beind __d_instantiate(), otherwise it will trigger
> below problem when CONFIG_SECURITY_SMACK on ext4 was enabled because
> d_inode(dentry) used by ->getxattr() is NULL before __d_instantiate()
> instantiate inode.
> 
> [   31.858026] BUG: unable to handle kernel paging request at ffffffffffffff70
> ...
> [   31.882024] Call Trace:
> [   31.882378]  [<ffffffffa347f75c>] ext4_xattr_get+0x8c/0x3e0
> [   31.883195]  [<ffffffffa3489454>] ext4_xattr_security_get+0x24/0x40
> [   31.884086]  [<ffffffffa336a56b>] generic_getxattr+0x5b/0x90
> [   31.884907]  [<ffffffffa3700514>] smk_fetch+0xb4/0x150
> [   31.885634]  [<ffffffffa3700772>] smack_d_instantiate+0x1c2/0x550
> [   31.886508]  [<ffffffffa36f9a5a>] security_d_instantiate+0x3a/0x80
> [   31.887389]  [<ffffffffa3353b26>] d_instantiate_new+0x36/0x130
> [   31.888223]  [<ffffffffa342b1ef>] ext4_mkdir+0x4af/0x6a0
> [   31.888928]  [<ffffffffa3343470>] vfs_mkdir+0x100/0x280
> [   31.889536]  [<ffffffffa334b086>] SyS_mkdir+0xb6/0x170
> [   31.890255]  [<ffffffffa307c855>] ? trace_do_page_fault+0x95/0x2b0
> [   31.891134]  [<ffffffffa3c5e078>] entry_SYSCALL_64_fastpath+0x18/0x73
> 
> Cc: <stable@vger.kernel.org> # 3.16, 4.4
> Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
> ---
>  fs/dcache.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Now queued up for 4.4.y, thanks.

greg k-h

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-06  9:43 [PATCH for linux 4.4.y/3.16.y] fs/dcache: move security_d_instantiate() behind attaching dentry to inode zhangyi (F)
2019-11-08 17:36 ` Greg KH

Linux-Fsdevel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-fsdevel/0 linux-fsdevel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-fsdevel linux-fsdevel/ https://lore.kernel.org/linux-fsdevel \
		linux-fsdevel@vger.kernel.org
	public-inbox-index linux-fsdevel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-fsdevel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git