From: "Liu, Chuansheng" <chuansheng.liu@intel.com>
To: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Eric Dumazet <eric.dumazet@gmail.com>,
"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"Liu, Chuansheng" <chuansheng.liu@intel.com>
Subject: RE: [PATCH] Fix the race between the fget() and close()
Date: Sat, 31 Aug 2013 05:53:11 +0000 [thread overview]
Message-ID: <27240C0AC20F114CBF8149A2696CBE4A01AF6CFE@SHSMSX101.ccr.corp.intel.com> (raw)
In-Reply-To: <20130827004852.GH27005@ZenIV.linux.org.uk>
Hello Al,
> -----Original Message-----
> From: Al Viro [mailto:viro@ftp.linux.org.uk] On Behalf Of Al Viro
> Sent: Tuesday, August 27, 2013 8:49 AM
> To: Liu, Chuansheng
> Cc: Eric Dumazet; linux-fsdevel@vger.kernel.org; linux-kernel@vger.kernel.org
> Subject: Re: [PATCH] Fix the race between the fget() and close()
>
> On Tue, Aug 27, 2013 at 01:42:47AM +0100, Al Viro wrote:
> > Might be buggered refcounting on struct file somewhere (i.e. extra fput()
> done,
> > getting the file freed *before* close(), leaving a dangling pointer in
> > descriptor table). Might be memory corruption of some kind, slapping junk
> > pointer into descriptor table. Might be buggered refcounting on struct
> > dentry - if extra dput() is done somewhere, dentry might get freed under
> > us or become negative.
> >
> > Hell, might be buggered refcounting on descriptor table - binder is playing
> > interesting games there. Try to reproduce that with
> CONFIG_DEBUG_KMEMLEAK
> > and slab debugging turned on, see if you hit anything from those; if it's
> > more or less readily reproducible, I would start with that - too many
> > scenarios involve broken refcounting of one sort or another.
>
> Nevermind dentry refcounting - you get NULL dentry, not NULL inode.
> Other scenarios still remain, so I'd really recommend slab/kmemleak
> debugging turned on.
I think I found one of possible race here(two processes P1 and P2):
P1 has the the files_struct pointer FILES1, P2 has the files_struct pointer FILES2,
When P1 open file, the new struct file pointer SHARE_FILE will be installed into FILES1,
and file refcount is 1;
And in P1, we can get P2's files_struct FILES2, and thru _fd_install(), we can add SHARE_FILE
into P2's FILES2.
Then the same file pointer SHARE_FILE stayed in both P1 and P2's files_struct, and the panic case
will happen:
P1 P2
Open the SHARE_FILE
Installed SHARE_FILE into P2's file_struct FILES2
Ioctl(SHARE_FILE) When P2 exiting,
fget_light()
due to FILES1->refcount is 1, put_files_struct will be called,
there will be no RCU and SHARE_FILE refcount increasing will close all files including SHARE_FILE
But at this time, P1 is still operate SHARE_FILE without the refcount safety.
Then the panic will happen at vfs_ioctl() due to the SHARE_FILE has been freed.
Is it allowable that installing one file pointer into another FILES_STRUCT? Seems binder is doing the similar things.
In fact, if in ioctl function, we can call fget() instead of fget_light(), this panic can be avoided.
Is it making sense?
next prev parent reply other threads:[~2013-08-31 5:53 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-26 16:12 [PATCH] Fix the race between the fget() and close() Chuansheng Liu
2013-08-26 11:29 ` Al Viro
2013-08-26 23:56 ` Liu, Chuansheng
2013-08-27 0:42 ` Al Viro
2013-08-27 0:48 ` Al Viro
2013-08-31 5:53 ` Liu, Chuansheng [this message]
2013-08-31 6:48 ` Al Viro
2013-08-31 7:01 ` Liu, Chuansheng
2013-08-31 7:35 ` Al Viro
2013-08-31 7:44 ` Liu, Chuansheng
2013-08-27 0:53 ` Liu, Chuansheng
2013-08-26 15:14 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=27240C0AC20F114CBF8149A2696CBE4A01AF6CFE@SHSMSX101.ccr.corp.intel.com \
--to=chuansheng.liu@intel.com \
--cc=eric.dumazet@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).