linux-kernel - [RFC, PATCH] filesystem freeze: fix sys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4A94C151.8020900@oss.ntt.co.jp>
Date:	Wed, 26 Aug 2009 14:00:01 +0900
From:	Fernando Luis Vázquez Cao 
	<fernando@....ntt.co.jp>
To:	t-sato@...jp.nec.com, m-hamaguchi@...jp.nec.com
CC:	Christoph Hellwig <hch@....de>, Al Viro <viro@...iv.linux.org.uk>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Eric Sandeen <sandeen@...hat.com>
Subject: [RFC, PATCH] filesystem freeze: fix sys_umount induced perpetual
 freeze

The current locking scheme for filesystem freeze avoids races between
freeze_bdev() and do_umount() by taking the s_umount semaphore.

If freeze_bdev() wins the race the process that invoked sys_umount
will sleep until thaw_bdev releases the semaphore. Unfortunately, this
will never happen because thaw_bdev bails out early the
bd_fsfreeze_count check having failed (the count is 0).

The problem is that the block_device that ioctl_fsthaw() passes to
thaw_bdev() is not the one that we freezed because before sleeping in
deactivate_super() do_umount() released the dentry (dput()) and freed
the vfs mount (free_vfsmnt()).

This patch works around this issue by checking the freeze level in
do_umount().

Signed-off-by: Fernando Luis Vazquez Cao <fernando@....ntt.co.jp>
---

diff -urNp linux-2.6.31-rc7-orig/fs/namespace.c linux-2.6.31-rc7/fs/namespace.c
--- linux-2.6.31-rc7-orig/fs/namespace.c	2009-08-25 16:39:46.000000000 +0900
+++ linux-2.6.31-rc7/fs/namespace.c	2009-08-26 11:30:10.000000000 +0900
@@ -1033,6 +1033,8 @@ static int do_umount(struct vfsmount *mn
  	if (retval)
  		return retval;

+	vfs_check_frozen(sb, SB_FREEZE_WRITE);
+
  	/*
  	 * Allow userspace to request a mountpoint be expired rather than
  	 * unmounting unconditionally. Unmount only happens if:
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/