linux-kernel - Re: BUG at fs/namei.c:405 (nameidata_drop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20110215170607.7a555b38@katamari>
Date:	Tue, 15 Feb 2011 17:06:07 -0500
From:	Chuck Ebbert <cebbert@...hat.com>
To:	Herton Ronaldo Krzesinski <herton.krzesinski@...onical.com>
Cc:	linux-kernel@...r.kernel.org, Nick Piggin <npiggin@...nel.dk>
Subject: Re: BUG at fs/namei.c:405 (nameidata_drop_rcu)

On Tue, 15 Feb 2011 18:17:08 -0200
Herton Ronaldo Krzesinski <herton.krzesinski@...onical.com> wrote:

> Em Sex, 2011-02-11 às 00:02 -0500, Chuck Ebbert escreveu:
> > Apparently hit this very early in nameidata_drop_rcu():
> > 
> >         BUG_ON(!(nd->flags & LOOKUP_RCU));
> > 
> > The user reports he ran "fuser /var/cache/yum" while logged in to
> > an X session with his home directory mounted via NFS4. Home dirs
> > are normally automounted, but manually mounting the dir still
> > reproduces the problem.
> 
> I got a similar report too, and was able to reproduce here with nfs4
> too.
> 
> We hit it at force_reval_path
> 
> From what I saw force_reval_path is never called with LOOKUP_RCU flag
> set. Who calls force_reval_path is __do_follow_link, and
> __do_follow_link is called from do_filp_open and do_follow_link. When
> do_filp_open calls it, it already dropped LOOKUP_RCU (if path rcu lookup
> didn't work). do_follow_link also calls it without LOOKUP_RCU set from
> what I'm seeing, as before each do_follow_link call
> nameidata_dentry_drop_rcu_maybe is called.
> 
> So simply removing again nameidata_drop_rcu from force_reval_path should
> do it. I'm running now on this change and didn't experience the same bug
> or other problems.
> 
> Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@...onical.com>
> 
> diff --git a/fs/namei.c b/fs/namei.c
> index ec4b2d0..7dcedbc 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -668,9 +668,7 @@ force_reval_path(struct path *path, struct nameidata *nd)
>  		return 0;
>  
>  	if (!status) {
> -		/* Don't d_invalidate in rcu-walk mode */
> -		if (nameidata_drop_rcu(nd))
> -			return -ECHILD;
> +		BUG_ON(nd->flags & LOOKUP_RCU);
>  		d_invalidate(dentry);
>  		status = -ESTALE;
>  	}
> 
> 

Looks like this is fixed today by commit 844a391799c25d9ba85cbce33e4697db06083ec6
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/