linux-kernel - Re: 2.6.35-rc4 - include/linux/fdtable.h:85 invoked rcu_dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 07 Jul 2010 06:37:28 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Miles Lane <miles.lane@...il.com>
Cc:	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: 2.6.35-rc4 - include/linux/fdtable.h:85 invoked
 rcu_dereference_check()  without protection!

Le mercredi 07 juillet 2010 à 06:34 +0200, Eric Dumazet a écrit :

> Miles, you already posted this three times, and a fix is known.
> 
> BTW, I dont know why it's not already in, Paul submitted it several
> times, but nobody cares.
> 
> http://kerneltrap.org/mailarchive/linux-kernel/2010/6/17/4584014
> 
> I am going to Ack it, maybe some other guys can help to.
> 

Ah, its in Andrew tree since 6 days, it should be sent to Linus promptly
now...

The patch titled
     vfs: fix RCU-lockdep false positive due to /proc
has been added to the -mm tree.  Its filename is
     vfs-fix-rcu-lockdep-false-positive-due-to-proc.patch

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/SubmitChecklist when testing your code
***

See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find
out what to do about this

The current -mm tree may be found at
http://userweb.kernel.org/~akpm/mmotm/

------------------------------------------------------
Subject: vfs: fix RCU-lockdep false positive due to /proc
From: "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>

If a single-threaded process does a file-descriptor operation, and some
other process accesses that same file descriptor via /proc, the current
rcu_dereference_check_fdtable() can give a false-positive RCU-lockdep
splat due to the reference count being increased by the /proc access
after
the reference-count check in fget_light() but before the check in
rcu_dereference_check_fdtable().

This commit prevents this false positive by checking for a
single-threaded
process.  To avoid #include hell, this commit uses the wrapper for
thread_group_empty(current) defined by rcu_my_thread_group_empty()
provided in a separate commit.

Located-by: Miles Lane <miles.lane@...il.com>
Located-by: Eric Dumazet <eric.dumazet@...il.com>
Signed-off-by: Paul E. McKenney <paulmck@...ux.vnet.ibm.com>
Cc: Al Viro <viro@...IV.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 include/linux/fdtable.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff -puN
include/linux/fdtable.h~vfs-fix-rcu-lockdep-false-positive-due-to-proc
include/linux/fdtable.h
---
a/include/linux/fdtable.h~vfs-fix-rcu-lockdep-false-positive-due-to-proc
+++ a/include/linux/fdtable.h
@@ -62,7 +62,8 @@ struct files_struct {
        (rcu_dereference_check((fdtfd), \
                               rcu_read_lock_held() || \
                               lockdep_is_held(&(files)->file_lock) || \
-                              atomic_read(&(files)->count) == 1))
+                              atomic_read(&(files)->count) == 1 || \
+                              rcu_my_thread_group_empty()))
 
 #define files_fdtable(files) \
                (rcu_dereference_check_fdtable((files), (files)->fdt))
_

Patches currently in -mm which might be from
paulmck@...ux.vnet.ibm.com are

origin.patch
fs-fcntlc-kill_fasync_rcu-fa_lock-must-be-irq-safe.patch
linux-next.patch
vfs-fix-rcu-lockdep-false-positive-due-to-proc.patch
vfs-use-kmalloc-to-allocate-fdmem-if-possible.patch




--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/