* [PATCH v4] ovl: fix dentry leak in ovl_get_redirect
@ 2020-12-22 3:06 Liangyan
2020-12-22 3:26 ` Al Viro
2021-01-08 6:06 ` Liangyan
0 siblings, 2 replies; 6+ messages in thread
From: Liangyan @ 2020-12-22 3:06 UTC (permalink / raw)
To: Al Viro, Miklos Szeredi, linux-unionfs, linux-kernel, joseph.qi,
liangyan.peng
Cc: stable
We need to lock d_parent->d_lock before dget_dlock, or this may
have d_lockref updated parallelly like calltrace below which will
cause dentry->d_lockref leak and risk a crash.
CPU 0 CPU 1
ovl_set_redirect lookup_fast
ovl_get_redirect __d_lookup
dget_dlock
//no lock protection here spin_lock(&dentry->d_lock)
dentry->d_lockref.count++ dentry->d_lockref.count++
[ 49.799059] PGD 800000061fed7067 P4D 800000061fed7067 PUD 61fec5067 PMD 0
[ 49.799689] Oops: 0002 [#1] SMP PTI
[ 49.800019] CPU: 2 PID: 2332 Comm: node Not tainted 4.19.24-7.20.al7.x86_64 #1
[ 49.800678] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8a46cfe 04/01/2014
[ 49.801380] RIP: 0010:_raw_spin_lock+0xc/0x20
[ 49.803470] RSP: 0018:ffffac6fc5417e98 EFLAGS: 00010246
[ 49.803949] RAX: 0000000000000000 RBX: ffff93b8da3446c0 RCX: 0000000a00000000
[ 49.804600] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000088
[ 49.805252] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff993cf040
[ 49.805898] R10: ffff93b92292e580 R11: ffffd27f188a4b80 R12: 0000000000000000
[ 49.806548] R13: 00000000ffffff9c R14: 00000000fffffffe R15: ffff93b8da3446c0
[ 49.807200] FS: 00007ffbedffb700(0000) GS:ffff93b927880000(0000) knlGS:0000000000000000
[ 49.807935] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.808461] CR2: 0000000000000088 CR3: 00000005e3f74006 CR4: 00000000003606a0
[ 49.809113] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.809758] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 49.810410] Call Trace:
[ 49.810653] d_delete+0x2c/0xb0
[ 49.810951] vfs_rmdir+0xfd/0x120
[ 49.811264] do_rmdir+0x14f/0x1a0
[ 49.811573] do_syscall_64+0x5b/0x190
[ 49.811917] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 49.812385] RIP: 0033:0x7ffbf505ffd7
[ 49.814404] RSP: 002b:00007ffbedffada8 EFLAGS: 00000297 ORIG_RAX: 0000000000000054
[ 49.815098] RAX: ffffffffffffffda RBX: 00007ffbedffb640 RCX: 00007ffbf505ffd7
[ 49.815744] RDX: 0000000004449700 RSI: 0000000000000000 RDI: 0000000006c8cd50
[ 49.816394] RBP: 00007ffbedffaea0 R08: 0000000000000000 R09: 0000000000017d0b
[ 49.817038] R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000012
[ 49.817687] R13: 00000000072823d8 R14: 00007ffbedffb700 R15: 00000000072823d8
[ 49.818338] Modules linked in: pvpanic cirrusfb button qemu_fw_cfg atkbd libps2 i8042
[ 49.819052] CR2: 0000000000000088
[ 49.819368] ---[ end trace 4e652b8aa299aa2d ]---
[ 49.819796] RIP: 0010:_raw_spin_lock+0xc/0x20
[ 49.821880] RSP: 0018:ffffac6fc5417e98 EFLAGS: 00010246
[ 49.822363] RAX: 0000000000000000 RBX: ffff93b8da3446c0 RCX: 0000000a00000000
[ 49.823008] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000088
[ 49.823658] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff993cf040
[ 49.825404] R10: ffff93b92292e580 R11: ffffd27f188a4b80 R12: 0000000000000000
[ 49.827147] R13: 00000000ffffff9c R14: 00000000fffffffe R15: ffff93b8da3446c0
[ 49.828890] FS: 00007ffbedffb700(0000) GS:ffff93b927880000(0000) knlGS:0000000000000000
[ 49.830725] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 49.832359] CR2: 0000000000000088 CR3: 00000005e3f74006 CR4: 00000000003606a0
[ 49.834085] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 49.835792] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Cc: <stable@vger.kernel.org>
Fixes: a6c606551141 ("ovl: redirect on rename-dir")
Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
---
fs/overlayfs/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 28a075b5f5b2..d1efa3a5a503 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -992,8 +992,8 @@ static char *ovl_get_redirect(struct dentry *dentry, bool abs_redirect)
buflen -= thislen;
memcpy(&buf[buflen], name, thislen);
- tmp = dget_dlock(d->d_parent);
spin_unlock(&d->d_lock);
+ tmp = dget_parent(d);
dput(d);
d = tmp;
--
2.14.4.44.g2045bb6
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v4] ovl: fix dentry leak in ovl_get_redirect
2020-12-22 3:06 [PATCH v4] ovl: fix dentry leak in ovl_get_redirect Liangyan
@ 2020-12-22 3:26 ` Al Viro
2020-12-23 6:19 ` Liangyan
2021-01-22 5:59 ` Joseph Qi
2021-01-08 6:06 ` Liangyan
1 sibling, 2 replies; 6+ messages in thread
From: Al Viro @ 2020-12-22 3:26 UTC (permalink / raw)
To: Liangyan; +Cc: Miklos Szeredi, linux-unionfs, linux-kernel, joseph.qi, stable
On Tue, Dec 22, 2020 at 11:06:26AM +0800, Liangyan wrote:
> Cc: <stable@vger.kernel.org>
> Fixes: a6c606551141 ("ovl: redirect on rename-dir")
> Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com>
> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Fine by me... I can put it through vfs.git#fixes, but IMO
that would be better off in overlayfs tree.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v4] ovl: fix dentry leak in ovl_get_redirect
2020-12-22 3:26 ` Al Viro
@ 2020-12-23 6:19 ` Liangyan
2021-01-22 5:59 ` Joseph Qi
1 sibling, 0 replies; 6+ messages in thread
From: Liangyan @ 2020-12-23 6:19 UTC (permalink / raw)
To: Al Viro, Miklos Szeredi; +Cc: linux-unionfs, linux-kernel, joseph.qi, stable
Thanks Viro.
@Miklos, can you please advise?
On 20/12/22 上午11:26, Al Viro wrote:
> On Tue, Dec 22, 2020 at 11:06:26AM +0800, Liangyan wrote:
>
>> Cc: <stable@vger.kernel.org>
>> Fixes: a6c606551141 ("ovl: redirect on rename-dir")
>> Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com>
>> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
>> Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
>
> Fine by me... I can put it through vfs.git#fixes, but IMO
> that would be better off in overlayfs tree.
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v4] ovl: fix dentry leak in ovl_get_redirect
2020-12-22 3:06 [PATCH v4] ovl: fix dentry leak in ovl_get_redirect Liangyan
2020-12-22 3:26 ` Al Viro
@ 2021-01-08 6:06 ` Liangyan
1 sibling, 0 replies; 6+ messages in thread
From: Liangyan @ 2021-01-08 6:06 UTC (permalink / raw)
To: Miklos Szeredi, Al Viro, linux-unionfs, linux-kernel, joseph.qi; +Cc: stable
ping
On 20/12/22 上午11:06, Liangyan wrote:
> We need to lock d_parent->d_lock before dget_dlock, or this may
> have d_lockref updated parallelly like calltrace below which will
> cause dentry->d_lockref leak and risk a crash.
>
> CPU 0 CPU 1
> ovl_set_redirect lookup_fast
> ovl_get_redirect __d_lookup
> dget_dlock
> //no lock protection here spin_lock(&dentry->d_lock)
> dentry->d_lockref.count++ dentry->d_lockref.count++
>
> [ 49.799059] PGD 800000061fed7067 P4D 800000061fed7067 PUD 61fec5067 PMD 0
> [ 49.799689] Oops: 0002 [#1] SMP PTI
> [ 49.800019] CPU: 2 PID: 2332 Comm: node Not tainted 4.19.24-7.20.al7.x86_64 #1
> [ 49.800678] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8a46cfe 04/01/2014
> [ 49.801380] RIP: 0010:_raw_spin_lock+0xc/0x20
> [ 49.803470] RSP: 0018:ffffac6fc5417e98 EFLAGS: 00010246
> [ 49.803949] RAX: 0000000000000000 RBX: ffff93b8da3446c0 RCX: 0000000a00000000
> [ 49.804600] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000088
> [ 49.805252] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff993cf040
> [ 49.805898] R10: ffff93b92292e580 R11: ffffd27f188a4b80 R12: 0000000000000000
> [ 49.806548] R13: 00000000ffffff9c R14: 00000000fffffffe R15: ffff93b8da3446c0
> [ 49.807200] FS: 00007ffbedffb700(0000) GS:ffff93b927880000(0000) knlGS:0000000000000000
> [ 49.807935] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 49.808461] CR2: 0000000000000088 CR3: 00000005e3f74006 CR4: 00000000003606a0
> [ 49.809113] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 49.809758] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 49.810410] Call Trace:
> [ 49.810653] d_delete+0x2c/0xb0
> [ 49.810951] vfs_rmdir+0xfd/0x120
> [ 49.811264] do_rmdir+0x14f/0x1a0
> [ 49.811573] do_syscall_64+0x5b/0x190
> [ 49.811917] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ 49.812385] RIP: 0033:0x7ffbf505ffd7
> [ 49.814404] RSP: 002b:00007ffbedffada8 EFLAGS: 00000297 ORIG_RAX: 0000000000000054
> [ 49.815098] RAX: ffffffffffffffda RBX: 00007ffbedffb640 RCX: 00007ffbf505ffd7
> [ 49.815744] RDX: 0000000004449700 RSI: 0000000000000000 RDI: 0000000006c8cd50
> [ 49.816394] RBP: 00007ffbedffaea0 R08: 0000000000000000 R09: 0000000000017d0b
> [ 49.817038] R10: 0000000000000000 R11: 0000000000000297 R12: 0000000000000012
> [ 49.817687] R13: 00000000072823d8 R14: 00007ffbedffb700 R15: 00000000072823d8
> [ 49.818338] Modules linked in: pvpanic cirrusfb button qemu_fw_cfg atkbd libps2 i8042
> [ 49.819052] CR2: 0000000000000088
> [ 49.819368] ---[ end trace 4e652b8aa299aa2d ]---
> [ 49.819796] RIP: 0010:_raw_spin_lock+0xc/0x20
> [ 49.821880] RSP: 0018:ffffac6fc5417e98 EFLAGS: 00010246
> [ 49.822363] RAX: 0000000000000000 RBX: ffff93b8da3446c0 RCX: 0000000a00000000
> [ 49.823008] RDX: 0000000000000001 RSI: 000000000000000a RDI: 0000000000000088
> [ 49.823658] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff993cf040
> [ 49.825404] R10: ffff93b92292e580 R11: ffffd27f188a4b80 R12: 0000000000000000
> [ 49.827147] R13: 00000000ffffff9c R14: 00000000fffffffe R15: ffff93b8da3446c0
> [ 49.828890] FS: 00007ffbedffb700(0000) GS:ffff93b927880000(0000) knlGS:0000000000000000
> [ 49.830725] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 49.832359] CR2: 0000000000000088 CR3: 00000005e3f74006 CR4: 00000000003606a0
> [ 49.834085] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 49.835792] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>
> Cc: <stable@vger.kernel.org>
> Fixes: a6c606551141 ("ovl: redirect on rename-dir")
> Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com>
> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
> ---
> fs/overlayfs/dir.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
> index 28a075b5f5b2..d1efa3a5a503 100644
> --- a/fs/overlayfs/dir.c
> +++ b/fs/overlayfs/dir.c
> @@ -992,8 +992,8 @@ static char *ovl_get_redirect(struct dentry *dentry, bool abs_redirect)
>
> buflen -= thislen;
> memcpy(&buf[buflen], name, thislen);
> - tmp = dget_dlock(d->d_parent);
> spin_unlock(&d->d_lock);
> + tmp = dget_parent(d);
>
> dput(d);
> d = tmp;
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v4] ovl: fix dentry leak in ovl_get_redirect
2020-12-22 3:26 ` Al Viro
2020-12-23 6:19 ` Liangyan
@ 2021-01-22 5:59 ` Joseph Qi
2021-01-22 11:37 ` Miklos Szeredi
1 sibling, 1 reply; 6+ messages in thread
From: Joseph Qi @ 2021-01-22 5:59 UTC (permalink / raw)
To: Miklos Szeredi; +Cc: linux-unionfs, linux-kernel, Al Viro, Liangyan
Hi Miklos,
Any comments on this patch?
Thanks,
Joseph
On 12/22/20 11:26 AM, Al Viro wrote:
> On Tue, Dec 22, 2020 at 11:06:26AM +0800, Liangyan wrote:
>
>> Cc: <stable@vger.kernel.org>
>> Fixes: a6c606551141 ("ovl: redirect on rename-dir")
>> Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com>
>> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
>> Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
>
> Fine by me... I can put it through vfs.git#fixes, but IMO
> that would be better off in overlayfs tree.
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v4] ovl: fix dentry leak in ovl_get_redirect
2021-01-22 5:59 ` Joseph Qi
@ 2021-01-22 11:37 ` Miklos Szeredi
0 siblings, 0 replies; 6+ messages in thread
From: Miklos Szeredi @ 2021-01-22 11:37 UTC (permalink / raw)
To: Joseph Qi; +Cc: overlayfs, linux-kernel, Al Viro, Liangyan
On Fri, Jan 22, 2021 at 6:59 AM Joseph Qi <joseph.qi@linux.alibaba.com> wrote:
>
> Hi Miklos,
>
> Any comments on this patch?
Queued for 5.11. Thanks.
Miklos
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-01-22 11:39 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-22 3:06 [PATCH v4] ovl: fix dentry leak in ovl_get_redirect Liangyan
2020-12-22 3:26 ` Al Viro
2020-12-23 6:19 ` Liangyan
2021-01-22 5:59 ` Joseph Qi
2021-01-22 11:37 ` Miklos Szeredi
2021-01-08 6:06 ` Liangyan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).