* [PATCH for linux 4.4.y/3.16.y] fs/dcache: move security_d_instantiate() behind attaching dentry to inode
@ 2019-11-06 9:43 zhangyi (F)
2019-11-08 17:36 ` Greg KH
2019-12-17 0:27 ` Ben Hutchings
0 siblings, 2 replies; 3+ messages in thread
From: zhangyi (F) @ 2019-11-06 9:43 UTC (permalink / raw)
To: gregkh; +Cc: stable, viro, linux-fsdevel, yi.zhang
During backport 1e2e547a93a "do d_instantiate/unlock_new_inode
combinations safely", there was a error instantiating sequence of
attaching dentry to inode and calling security_d_instantiate().
Before commit ce23e640133 "->getxattr(): pass dentry and inode as
separate arguments" and b96809173e9 "security_d_instantiate(): move to
the point prior to attaching dentry to inode", security_d_instantiate()
should be called beind __d_instantiate(), otherwise it will trigger
below problem when CONFIG_SECURITY_SMACK on ext4 was enabled because
d_inode(dentry) used by ->getxattr() is NULL before __d_instantiate()
instantiate inode.
[ 31.858026] BUG: unable to handle kernel paging request at ffffffffffffff70
...
[ 31.882024] Call Trace:
[ 31.882378] [<ffffffffa347f75c>] ext4_xattr_get+0x8c/0x3e0
[ 31.883195] [<ffffffffa3489454>] ext4_xattr_security_get+0x24/0x40
[ 31.884086] [<ffffffffa336a56b>] generic_getxattr+0x5b/0x90
[ 31.884907] [<ffffffffa3700514>] smk_fetch+0xb4/0x150
[ 31.885634] [<ffffffffa3700772>] smack_d_instantiate+0x1c2/0x550
[ 31.886508] [<ffffffffa36f9a5a>] security_d_instantiate+0x3a/0x80
[ 31.887389] [<ffffffffa3353b26>] d_instantiate_new+0x36/0x130
[ 31.888223] [<ffffffffa342b1ef>] ext4_mkdir+0x4af/0x6a0
[ 31.888928] [<ffffffffa3343470>] vfs_mkdir+0x100/0x280
[ 31.889536] [<ffffffffa334b086>] SyS_mkdir+0xb6/0x170
[ 31.890255] [<ffffffffa307c855>] ? trace_do_page_fault+0x95/0x2b0
[ 31.891134] [<ffffffffa3c5e078>] entry_SYSCALL_64_fastpath+0x18/0x73
Cc: <stable@vger.kernel.org> # 3.16, 4.4
Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
---
fs/dcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/dcache.c b/fs/dcache.c
index 5a1c36dc5d65..baa00718d8d1 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1900,7 +1900,6 @@ void d_instantiate_new(struct dentry *entry, struct inode *inode)
BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
BUG_ON(!inode);
lockdep_annotate_inode_mutex_key(inode);
- security_d_instantiate(entry, inode);
spin_lock(&inode->i_lock);
__d_instantiate(entry, inode);
WARN_ON(!(inode->i_state & I_NEW));
@@ -1908,6 +1907,7 @@ void d_instantiate_new(struct dentry *entry, struct inode *inode)
smp_mb();
wake_up_bit(&inode->i_state, __I_NEW);
spin_unlock(&inode->i_lock);
+ security_d_instantiate(entry, inode);
}
EXPORT_SYMBOL(d_instantiate_new);
--
2.17.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH for linux 4.4.y/3.16.y] fs/dcache: move security_d_instantiate() behind attaching dentry to inode
2019-11-06 9:43 [PATCH for linux 4.4.y/3.16.y] fs/dcache: move security_d_instantiate() behind attaching dentry to inode zhangyi (F)
@ 2019-11-08 17:36 ` Greg KH
2019-12-17 0:27 ` Ben Hutchings
1 sibling, 0 replies; 3+ messages in thread
From: Greg KH @ 2019-11-08 17:36 UTC (permalink / raw)
To: zhangyi (F); +Cc: stable, viro, linux-fsdevel
On Wed, Nov 06, 2019 at 05:43:52PM +0800, zhangyi (F) wrote:
> During backport 1e2e547a93a "do d_instantiate/unlock_new_inode
> combinations safely", there was a error instantiating sequence of
> attaching dentry to inode and calling security_d_instantiate().
>
> Before commit ce23e640133 "->getxattr(): pass dentry and inode as
> separate arguments" and b96809173e9 "security_d_instantiate(): move to
> the point prior to attaching dentry to inode", security_d_instantiate()
> should be called beind __d_instantiate(), otherwise it will trigger
> below problem when CONFIG_SECURITY_SMACK on ext4 was enabled because
> d_inode(dentry) used by ->getxattr() is NULL before __d_instantiate()
> instantiate inode.
>
> [ 31.858026] BUG: unable to handle kernel paging request at ffffffffffffff70
> ...
> [ 31.882024] Call Trace:
> [ 31.882378] [<ffffffffa347f75c>] ext4_xattr_get+0x8c/0x3e0
> [ 31.883195] [<ffffffffa3489454>] ext4_xattr_security_get+0x24/0x40
> [ 31.884086] [<ffffffffa336a56b>] generic_getxattr+0x5b/0x90
> [ 31.884907] [<ffffffffa3700514>] smk_fetch+0xb4/0x150
> [ 31.885634] [<ffffffffa3700772>] smack_d_instantiate+0x1c2/0x550
> [ 31.886508] [<ffffffffa36f9a5a>] security_d_instantiate+0x3a/0x80
> [ 31.887389] [<ffffffffa3353b26>] d_instantiate_new+0x36/0x130
> [ 31.888223] [<ffffffffa342b1ef>] ext4_mkdir+0x4af/0x6a0
> [ 31.888928] [<ffffffffa3343470>] vfs_mkdir+0x100/0x280
> [ 31.889536] [<ffffffffa334b086>] SyS_mkdir+0xb6/0x170
> [ 31.890255] [<ffffffffa307c855>] ? trace_do_page_fault+0x95/0x2b0
> [ 31.891134] [<ffffffffa3c5e078>] entry_SYSCALL_64_fastpath+0x18/0x73
>
> Cc: <stable@vger.kernel.org> # 3.16, 4.4
> Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
> ---
> fs/dcache.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Now queued up for 4.4.y, thanks.
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH for linux 4.4.y/3.16.y] fs/dcache: move security_d_instantiate() behind attaching dentry to inode
2019-11-06 9:43 [PATCH for linux 4.4.y/3.16.y] fs/dcache: move security_d_instantiate() behind attaching dentry to inode zhangyi (F)
2019-11-08 17:36 ` Greg KH
@ 2019-12-17 0:27 ` Ben Hutchings
1 sibling, 0 replies; 3+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:27 UTC (permalink / raw)
To: zhangyi (F), gregkh; +Cc: stable, viro, linux-fsdevel
[-- Attachment #1: Type: text/plain, Size: 2747 bytes --]
On Wed, 2019-11-06 at 17:43 +0800, zhangyi (F) wrote:
> During backport 1e2e547a93a "do d_instantiate/unlock_new_inode
> combinations safely", there was a error instantiating sequence of
> attaching dentry to inode and calling security_d_instantiate().
>
> Before commit ce23e640133 "->getxattr(): pass dentry and inode as
> separate arguments" and b96809173e9 "security_d_instantiate(): move to
> the point prior to attaching dentry to inode", security_d_instantiate()
> should be called beind __d_instantiate(), otherwise it will trigger
> below problem when CONFIG_SECURITY_SMACK on ext4 was enabled because
> d_inode(dentry) used by ->getxattr() is NULL before __d_instantiate()
> instantiate inode.
Thanks, I've queued this up for 3.16.
Ben.
> [ 31.858026] BUG: unable to handle kernel paging request at ffffffffffffff70
> ...
> [ 31.882024] Call Trace:
> [ 31.882378] [<ffffffffa347f75c>] ext4_xattr_get+0x8c/0x3e0
> [ 31.883195] [<ffffffffa3489454>] ext4_xattr_security_get+0x24/0x40
> [ 31.884086] [<ffffffffa336a56b>] generic_getxattr+0x5b/0x90
> [ 31.884907] [<ffffffffa3700514>] smk_fetch+0xb4/0x150
> [ 31.885634] [<ffffffffa3700772>] smack_d_instantiate+0x1c2/0x550
> [ 31.886508] [<ffffffffa36f9a5a>] security_d_instantiate+0x3a/0x80
> [ 31.887389] [<ffffffffa3353b26>] d_instantiate_new+0x36/0x130
> [ 31.888223] [<ffffffffa342b1ef>] ext4_mkdir+0x4af/0x6a0
> [ 31.888928] [<ffffffffa3343470>] vfs_mkdir+0x100/0x280
> [ 31.889536] [<ffffffffa334b086>] SyS_mkdir+0xb6/0x170
> [ 31.890255] [<ffffffffa307c855>] ? trace_do_page_fault+0x95/0x2b0
> [ 31.891134] [<ffffffffa3c5e078>] entry_SYSCALL_64_fastpath+0x18/0x73
>
> Cc: <stable@vger.kernel.org> # 3.16, 4.4
> Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
> ---
> fs/dcache.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/dcache.c b/fs/dcache.c
> index 5a1c36dc5d65..baa00718d8d1 100644
> --- a/fs/dcache.c
> +++ b/fs/dcache.c
> @@ -1900,7 +1900,6 @@ void d_instantiate_new(struct dentry *entry, struct inode *inode)
> BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
> BUG_ON(!inode);
> lockdep_annotate_inode_mutex_key(inode);
> - security_d_instantiate(entry, inode);
> spin_lock(&inode->i_lock);
> __d_instantiate(entry, inode);
> WARN_ON(!(inode->i_state & I_NEW));
> @@ -1908,6 +1907,7 @@ void d_instantiate_new(struct dentry *entry, struct inode *inode)
> smp_mb();
> wake_up_bit(&inode->i_state, __I_NEW);
> spin_unlock(&inode->i_lock);
> + security_d_instantiate(entry, inode);
> }
> EXPORT_SYMBOL(d_instantiate_new);
>
--
Ben Hutchings
If the facts do not conform to your theory, they must be disposed of.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-12-17 0:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-06 9:43 [PATCH for linux 4.4.y/3.16.y] fs/dcache: move security_d_instantiate() behind attaching dentry to inode zhangyi (F)
2019-11-08 17:36 ` Greg KH
2019-12-17 0:27 ` Ben Hutchings
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).