linux-ext4 - Re: [PATCH 01/13] fs/super.c: don't drop ->s_user_ns until we free struct super

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bc36104e67120e6e86423fe2e83f9745380c8575.camel@kernel.org>
Date: Mon, 05 Feb 2024 07:36:42 -0500
From: Jeff Layton <jlayton@...nel.org>
To: Al Viro <viro@...iv.linux.org.uk>, linux-fsdevel@...r.kernel.org
Cc: Linus Torvalds <torvalds@...ux-foundation.org>, Christian Brauner
 <brauner@...nel.org>, linux-ext4@...r.kernel.org,
 linux-nfs@...r.kernel.org,  Miklos Szeredi <miklos@...redi.hu>,
 linux-cifs@...r.kernel.org
Subject: Re: [PATCH 01/13] fs/super.c: don't drop ->s_user_ns until we free
 struct super_block itself

On Sun, 2024-02-04 at 02:17 +0000, Al Viro wrote:
> Avoids fun races in RCU pathwalk...  Same goes for freeing LSM shite
> hanging off super_block's arse.
> 
> Signed-off-by: Al Viro <viro@...iv.linux.org.uk>
> ---
>  fs/super.c | 13 ++++---------
>  1 file changed, 4 insertions(+), 9 deletions(-)
> 
> diff --git a/fs/super.c b/fs/super.c
> index d35e85295489..d6efeba0d0ce 100644
> --- a/fs/super.c
> +++ b/fs/super.c
> @@ -274,9 +274,10 @@ static void destroy_super_work(struct work_struct *work)
>  {
>  	struct super_block *s = container_of(work, struct super_block,
>  							destroy_work);
> -	int i;
> -
> -	for (i = 0; i < SB_FREEZE_LEVELS; i++)
> +	security_sb_free(s);
> +	put_user_ns(s->s_user_ns);
> +	kfree(s->s_subtype);
> +	for (int i = 0; i < SB_FREEZE_LEVELS; i++)
>  		percpu_free_rwsem(&s->s_writers.rw_sem[i]);

nit: put_user_ns can call __put_user_ns which ends up queueing yet
another workqueue job. It might be nice in the future to come up with a
way to do the work that __put_user_ns does directly here instead of
queueing it.

OTOH, maybe it's not worth the effort...

>  	kfree(s);
>  }
> @@ -296,9 +297,6 @@ static void destroy_unused_super(struct super_block *s)
>  	super_unlock_excl(s);
>  	list_lru_destroy(&s->s_dentry_lru);
>  	list_lru_destroy(&s->s_inode_lru);
> -	security_sb_free(s);
> -	put_user_ns(s->s_user_ns);
> -	kfree(s->s_subtype);
>  	shrinker_free(s->s_shrink);
>  	/* no delays needed */
>  	destroy_super_work(&s->destroy_work);
> @@ -409,9 +407,6 @@ static void __put_super(struct super_block *s)
>  		WARN_ON(s->s_dentry_lru.node);
>  		WARN_ON(s->s_inode_lru.node);
>  		WARN_ON(!list_empty(&s->s_mounts));
> -		security_sb_free(s);
> -		put_user_ns(s->s_user_ns);
> -		kfree(s->s_subtype);
>  		call_rcu(&s->rcu, destroy_super_rcu);
>  	}
>  }

Reviewed-by: Jeff Layton <jlayton@...nel.org>