From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2541DC433DF for ; Wed, 10 Jun 2020 21:52:20 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id C291A2072E for ; Wed, 10 Jun 2020 21:52:19 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C291A2072E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 294418D0033; Wed, 10 Jun 2020 17:52:19 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 26A186B00B1; Wed, 10 Jun 2020 17:52:19 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 180918D0033; Wed, 10 Jun 2020 17:52:19 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0099.hostedemail.com [216.40.44.99]) by kanga.kvack.org (Postfix) with ESMTP id 010606B00B0 for ; Wed, 10 Jun 2020 17:52:18 -0400 (EDT) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id B50FC802DB2C for ; Wed, 10 Jun 2020 21:52:18 +0000 (UTC) X-FDA: 76914651156.17.drop88_5b135e426dce Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin17.hostedemail.com (Postfix) with ESMTP id 7486618000DA3 for ; Wed, 10 Jun 2020 21:52:18 +0000 (UTC) X-HE-Tag: drop88_5b135e426dce X-Filterd-Recvd-Size: 4849 Received: from mail-pf1-f194.google.com (mail-pf1-f194.google.com [209.85.210.194]) by imf07.hostedemail.com (Postfix) with ESMTP for ; Wed, 10 Jun 2020 21:52:17 +0000 (UTC) Received: by mail-pf1-f194.google.com with SMTP id a127so1687649pfa.12 for ; Wed, 10 Jun 2020 14:52:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=eRf6W4oVEmwpsh0h+K1sCW7NaH3bq1FpwEBiNryS1Wo=; b=T008AHVCG7tZ70bBB1CW+jSyR/BaiA8mKteqMWJgpAOiW1W8wjsGQO4Oug4LGT0QsL kcp/uPdamXG5dUyn0FHpBpqZnswWBFLH2x3TRzcXZ88j7zLrZLqjgtwVQA7AoSQUNdwE n8+XXWZp1KveYQZi6TbR3SHfgsFfPQqdotCeZSLhelZs8cHvCDJtrNhQozd278q79kha FyGSPlYc1/AJz69CuzkEcVzvOycumJsOWlgnQ3KfVNPx9cWJcQ+rfIUE4oFqbbdqnukp u4zZoiMLnTVO5v2qHt292pVOQ9c95NqHBAklCOSfIx8CkajPqarU52zSCHWZ7VLhy7wJ EiNg== X-Gm-Message-State: AOAM5324eGSSi//fmiovDkf+7hGhe/Q+2Nb0Bt3cdEKVZOKVCuG9xuNY vA64w7KaNpXpxpVHgKEaTik= X-Google-Smtp-Source: ABdhPJy992mUv5U8bhwojNTbIZ80dvsxUMVUFbzemXqKRntKpx7DGKHGnQxvq9NILxqv4J2ZE+scdw== X-Received: by 2002:a63:4d5a:: with SMTP id n26mr4421932pgl.85.1591825936625; Wed, 10 Jun 2020 14:52:16 -0700 (PDT) Received: from 42.do-not-panic.com (42.do-not-panic.com. [157.230.128.187]) by smtp.gmail.com with ESMTPSA id n69sm854031pfd.171.2020.06.10.14.52.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 Jun 2020 14:52:14 -0700 (PDT) Received: by 42.do-not-panic.com (Postfix, from userid 1000) id 038B5403AB; Wed, 10 Jun 2020 21:52:13 +0000 (UTC) Date: Wed, 10 Jun 2020 21:52:13 +0000 From: Luis Chamberlain To: Christoph Hellwig Cc: Jan Kara , axboe@kernel.dk, viro@zeniv.linux.org.uk, bvanassche@acm.org, gregkh@linuxfoundation.org, rostedt@goodmis.org, mingo@redhat.com, ming.lei@redhat.com, nstange@suse.de, akpm@linux-foundation.org, mhocko@suse.com, yukuai3@huawei.com, martin.petersen@oracle.com, jejb@linux.ibm.com, linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Omar Sandoval , Hannes Reinecke , Michal Hocko , syzbot+603294af2d01acfdd6da@syzkaller.appspotmail.com Subject: Re: [PATCH v6 6/6] blktrace: fix debugfs use after free Message-ID: <20200610215213.GH13911@42.do-not-panic.com> References: <20200608170127.20419-1-mcgrof@kernel.org> <20200608170127.20419-7-mcgrof@kernel.org> <20200609150602.GA7111@infradead.org> <20200609172922.GP11244@42.do-not-panic.com> <20200609173218.GA7968@infradead.org> <20200609175359.GR11244@42.do-not-panic.com> <20200610064234.GB24975@infradead.org> <20200610210917.GH11244@42.do-not-panic.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200610210917.GH11244@42.do-not-panic.com> X-Rspamd-Queue-Id: 7486618000DA3 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam01 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: So, upon updating the commit log, and moving the empty directory check into another patch, I realized we might be able to simplify this now even further still. Patch below. The key of the issue was that the use after free happens when a recursive removal happens, and then later a specific dentry removal happens. This happened for make_request block drivers when using the whole disk, but since we *don't* have any other users of the directory for the others cases, this in theory shuld not happen for them either. I'll try to shoot some bullets at this. diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index 7ff2ea5cd05e..5cea04c05e09 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -524,10 +524,16 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, if (!bt->msg_data) goto err; - ret = -ENOENT; - - dir = debugfs_lookup(buts->name, blk_debugfs_root); - if (!dir) + /* + * When tracing whole make_request drivers (multiqueue) block devices, + * reuse the existing debugfs directory created by the block layer on + * init. For request-based block devices, all partitions block devices, + * and scsi-generic block devices we create a temporary new debugfs + * directory that will be removed once the trace ends. + */ + if (queue_is_mq(q)) + dir = q->debugfs_dir; + else bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root); bt->dev = dev; @@ -565,8 +571,6 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, ret = 0; err: - if (dir && !bt->dir) - dput(dir); if (ret) blk_trace_free(bt); return ret;