linux-kernel - Re: BUG at fs/namei.c:405 (nameidata_drop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 15 Feb 2011 18:17:08 -0200
From:	Herton Ronaldo Krzesinski <herton.krzesinski@...onical.com>
To:	Chuck Ebbert <cebbert@...hat.com>
Cc:	linux-kernel@...r.kernel.org, Nick Piggin <npiggin@...nel.dk>
Subject: Re: BUG at fs/namei.c:405 (nameidata_drop_rcu)

Em Sex, 2011-02-11 às 00:02 -0500, Chuck Ebbert escreveu:
> Apparently hit this very early in nameidata_drop_rcu():
> 
>         BUG_ON(!(nd->flags & LOOKUP_RCU));
> 
> The user reports he ran "fuser /var/cache/yum" while logged in to
> an X session with his home directory mounted via NFS4. Home dirs
> are normally automounted, but manually mounting the dir still
> reproduces the problem.

I got a similar report too, and was able to reproduce here with nfs4
too.

We hit it at force_reval_path

>From what I saw force_reval_path is never called with LOOKUP_RCU flag
set. Who calls force_reval_path is __do_follow_link, and
__do_follow_link is called from do_filp_open and do_follow_link. When
do_filp_open calls it, it already dropped LOOKUP_RCU (if path rcu lookup
didn't work). do_follow_link also calls it without LOOKUP_RCU set from
what I'm seeing, as before each do_follow_link call
nameidata_dentry_drop_rcu_maybe is called.

So simply removing again nameidata_drop_rcu from force_reval_path should
do it. I'm running now on this change and didn't experience the same bug
or other problems.

Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@...onical.com>

diff --git a/fs/namei.c b/fs/namei.c
index ec4b2d0..7dcedbc 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -668,9 +668,7 @@ force_reval_path(struct path *path, struct nameidata *nd)
 		return 0;
 
 	if (!status) {
-		/* Don't d_invalidate in rcu-walk mode */
-		if (nameidata_drop_rcu(nd))
-			return -ECHILD;
+		BUG_ON(nd->flags & LOOKUP_RCU);
 		d_invalidate(dentry);
 		status = -ESTALE;
 	}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/