linux-kernel - Re: Race condition between iget_locked() and evict

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 29 Sep 2016 14:38:45 +0100
From:   Al Viro <viro@...IV.linux.org.uk>
To:     Anton Altaparmakov <anton@...era.com>
Cc:     linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: Race condition between iget_locked() and evict_inodes()

On Thu, Sep 29, 2016 at 12:56:49PM +0000, Anton Altaparmakov wrote:
> Hi Al,
> 
> > On 29 Sep 2016, at 13:17, Al Viro <viro@...IV.linux.org.uk> wrote:
> > 
> > On Thu, Sep 29, 2016 at 11:53:21AM +0000, Anton Altaparmakov wrote:
> >> Thus if the events happen in this order:
> >> 
> >> evict_inodes()				iget_locked() in find_inode_fast()
> > 
> > ... you are buggered, because somebody is trying to grab a reference
> > to inode on a filesystem that is being shut down.  Look at evict_inode()
> > caller...
> 
> But what if that somebody is simply the file system being shutdown trying to flush some dirty metadata to disk which is stored in a file and thus accessed via an inode and thus iget on the inode is needed?  Surely that is allowed even during shutdown.  Once the write is complete iput() is called which then immediately evicts the inode as MS_ACTIVE is clear...

If it's a per-superblock inode, just keep it referenced until ->put_super()
and be done with that.  Besides, the caller has just done sync_filesystem()
there, so any dirty metadata would better be already flushed.