linux-kernel - Re: Race condition between iget_locked() and evict

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 29 Sep 2016 12:56:49 +0000
From:   Anton Altaparmakov <anton@...era.com>
To:     Al Viro <viro@...IV.linux.org.uk>
CC:     linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: Race condition between iget_locked() and evict_inodes()

Hi Al,

> On 29 Sep 2016, at 13:17, Al Viro <viro@...IV.linux.org.uk> wrote:
> 
> On Thu, Sep 29, 2016 at 11:53:21AM +0000, Anton Altaparmakov wrote:
>> Thus if the events happen in this order:
>> 
>> evict_inodes()				iget_locked() in find_inode_fast()
> 
> ... you are buggered, because somebody is trying to grab a reference
> to inode on a filesystem that is being shut down.  Look at evict_inode()
> caller...

But what if that somebody is simply the file system being shutdown trying to flush some dirty metadata to disk which is stored in a file and thus accessed via an inode and thus iget on the inode is needed?  Surely that is allowed even during shutdown.  Once the write is complete iput() is called which then immediately evicts the inode as MS_ACTIVE is clear...

Best regards,

	Anton
-- 
Anton Altaparmakov <anton at tuxera.com> (replace at with @)
Lead in File System Development, Tuxera Inc., http://www.tuxera.com/
Linux NTFS maintainer