* [PATCH] kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
@ 2024-01-27 23:46 Neel Natu
2024-01-28 0:02 ` Greg Kroah-Hartman
0 siblings, 1 reply; 3+ messages in thread
From: Neel Natu @ 2024-01-27 23:46 UTC (permalink / raw)
To: Greg Kroah-Hartman, Tejun Heo; +Cc: linux-kernel, Neel Natu
Prior to this change 'on->nr_mmapped' tracked the total number of
mmaps across all of its associated open files via kernfs_fop_mmap().
Thus if the file descriptor associated with a kernfs_open_file was
mmapped 10 times then we would have: 'of->mmapped = true' and
'of_on(of)->nr_mmapped = 10'.
The problem is that closing or draining a 'of->mmapped' file would
only decrement one from the 'of_on(of)->nr_mmapped' counter.
For e.g. we have this from kernfs_unlink_open_file():
if (of->mmapped)
on->nr_mmapped--;
The WARN_ON_ONCE(on->nr_mmapped) in kernfs_drain_open_files() is
easy to reproduce by:
1. opening a (mmap-able) kernfs file.
2. mmap-ing that file more than once (mapping just once masks the issue).
3. trigger a drain of that kernfs file.
Modulo out-of-tree patches I was able to trigger this reliably by
identifying pci device nodes in sysfs that have resource regions
that are mmap-able and that don't have any driver attached to them
(steps 1 and 2). For step 3 we can "echo 1 > remove" to trigger a
kernfs_drain.
Signed-off-by: Neel Natu <neelnatu@google.com>
---
fs/kernfs/file.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index ffa4565c275a..e9df2f87072c 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -483,9 +483,11 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma)
goto out_put;
rc = 0;
- of->mmapped = true;
- of_on(of)->nr_mmapped++;
- of->vm_ops = vma->vm_ops;
+ if (!of->mmapped) {
+ of->mmapped = true;
+ of_on(of)->nr_mmapped++;
+ of->vm_ops = vma->vm_ops;
+ }
vma->vm_ops = &kernfs_vm_ops;
out_put:
kernfs_put_active(of->kn);
--
2.43.0.429.g432eaa2c6b-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
2024-01-27 23:46 [PATCH] kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files Neel Natu
@ 2024-01-28 0:02 ` Greg Kroah-Hartman
2024-01-29 17:33 ` Neel Natu
0 siblings, 1 reply; 3+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-28 0:02 UTC (permalink / raw)
To: Neel Natu; +Cc: Tejun Heo, linux-kernel
On Sat, Jan 27, 2024 at 03:46:36PM -0800, Neel Natu wrote:
> Prior to this change 'on->nr_mmapped' tracked the total number of
> mmaps across all of its associated open files via kernfs_fop_mmap().
> Thus if the file descriptor associated with a kernfs_open_file was
> mmapped 10 times then we would have: 'of->mmapped = true' and
> 'of_on(of)->nr_mmapped = 10'.
>
> The problem is that closing or draining a 'of->mmapped' file would
> only decrement one from the 'of_on(of)->nr_mmapped' counter.
>
> For e.g. we have this from kernfs_unlink_open_file():
> if (of->mmapped)
> on->nr_mmapped--;
>
> The WARN_ON_ONCE(on->nr_mmapped) in kernfs_drain_open_files() is
> easy to reproduce by:
> 1. opening a (mmap-able) kernfs file.
> 2. mmap-ing that file more than once (mapping just once masks the issue).
> 3. trigger a drain of that kernfs file.
>
> Modulo out-of-tree patches I was able to trigger this reliably by
> identifying pci device nodes in sysfs that have resource regions
> that are mmap-able and that don't have any driver attached to them
> (steps 1 and 2). For step 3 we can "echo 1 > remove" to trigger a
> kernfs_drain.
>
> Signed-off-by: Neel Natu <neelnatu@google.com>
> ---
> fs/kernfs/file.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
> index ffa4565c275a..e9df2f87072c 100644
> --- a/fs/kernfs/file.c
> +++ b/fs/kernfs/file.c
> @@ -483,9 +483,11 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma)
> goto out_put;
>
> rc = 0;
> - of->mmapped = true;
> - of_on(of)->nr_mmapped++;
> - of->vm_ops = vma->vm_ops;
> + if (!of->mmapped) {
> + of->mmapped = true;
> + of_on(of)->nr_mmapped++;
> + of->vm_ops = vma->vm_ops;
> + }
> vma->vm_ops = &kernfs_vm_ops;
> out_put:
> kernfs_put_active(of->kn);
What commit id does this fix?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
2024-01-28 0:02 ` Greg Kroah-Hartman
@ 2024-01-29 17:33 ` Neel Natu
0 siblings, 0 replies; 3+ messages in thread
From: Neel Natu @ 2024-01-29 17:33 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: Tejun Heo, linux-kernel
Hi,
On Sat, Jan 27, 2024 at 4:02 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Sat, Jan 27, 2024 at 03:46:36PM -0800, Neel Natu wrote:
> > Prior to this change 'on->nr_mmapped' tracked the total number of
> > mmaps across all of its associated open files via kernfs_fop_mmap().
> > Thus if the file descriptor associated with a kernfs_open_file was
> > mmapped 10 times then we would have: 'of->mmapped = true' and
> > 'of_on(of)->nr_mmapped = 10'.
> >
> > The problem is that closing or draining a 'of->mmapped' file would
> > only decrement one from the 'of_on(of)->nr_mmapped' counter.
> >
> > For e.g. we have this from kernfs_unlink_open_file():
> > if (of->mmapped)
> > on->nr_mmapped--;
> >
> > The WARN_ON_ONCE(on->nr_mmapped) in kernfs_drain_open_files() is
> > easy to reproduce by:
> > 1. opening a (mmap-able) kernfs file.
> > 2. mmap-ing that file more than once (mapping just once masks the issue).
> > 3. trigger a drain of that kernfs file.
> >
> > Modulo out-of-tree patches I was able to trigger this reliably by
> > identifying pci device nodes in sysfs that have resource regions
> > that are mmap-able and that don't have any driver attached to them
> > (steps 1 and 2). For step 3 we can "echo 1 > remove" to trigger a
> > kernfs_drain.
> >
> > Signed-off-by: Neel Natu <neelnatu@google.com>
> > ---
> > fs/kernfs/file.c | 8 +++++---
> > 1 file changed, 5 insertions(+), 3 deletions(-)
> >
> > diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
> > index ffa4565c275a..e9df2f87072c 100644
> > --- a/fs/kernfs/file.c
> > +++ b/fs/kernfs/file.c
> > @@ -483,9 +483,11 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma)
> > goto out_put;
> >
> > rc = 0;
> > - of->mmapped = true;
> > - of_on(of)->nr_mmapped++;
> > - of->vm_ops = vma->vm_ops;
> > + if (!of->mmapped) {
> > + of->mmapped = true;
> > + of_on(of)->nr_mmapped++;
> > + of->vm_ops = vma->vm_ops;
> > + }
> > vma->vm_ops = &kernfs_vm_ops;
> > out_put:
> > kernfs_put_active(of->kn);
>
> What commit id does this fix?
bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72
kernfs: Skip kernfs_drain_open_files() more aggressively
best
Neel
>
> thanks,
>
> greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-01-29 17:33 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-01-27 23:46 [PATCH] kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files Neel Natu
2024-01-28 0:02 ` Greg Kroah-Hartman
2024-01-29 17:33 ` Neel Natu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).