linux-ext4 - Re: [PATCH] ext4: fix races in ext4_sync

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110728011129.GO22133@ZenIV.linux.org.uk>
Date:	Thu, 28 Jul 2011 02:11:29 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Ted Ts'o <tytso@....edu>
Cc:	Ext4 Developers List <linux-ext4@...r.kernel.org>
Subject: Re: [PATCH] ext4: fix races in ext4_sync_parent()

On Wed, Jul 27, 2011 at 08:34:22PM -0400, Ted Ts'o wrote:
> > > +		dentry = list_first_entry(&inode->i_dentry,
> > > +					  struct dentry, d_alias);
> > 
> > ... and what if you don't have a dentry for that inode anymore?
> 
> I thought you were complaining that dentry could never be NULL
> earlier?  We earlier checked for NULL, but I figured you knew
> something I didn't....

The pointer won't be NULL, of course, but what guarantees that inode->i_dentry
won't be *empty*?  IOW, you could get a perfectly non-NULL pointer, equal to
	(char *)inode + offsetof(struct inode, i_dentry)
	 - offsetof(struct dentry, d_alias)
and treating it as struct dentry * won't do you any good...

> > > +		next = igrab(dentry->d_parent->d_inode);
> > 
> > what protects you against rename() (OK, d_mode()) here?
> 
> Does it matter?  We'll get either the old or the new parent directory,
> but either way it will be a valid inode, right?  Or am I missing
> something?

Once d_move() has happened, there's nothing to protect the old parent
anymore...  Granted, it's a hell of a narrow race window, but you
need at least ->d_lock on your dentry...
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html