linux-kernel - Re: Race inotify_rm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4F567D23.9040309@canonical.com>
Date:	Tue, 06 Mar 2012 16:09:55 -0500
From:	Joseph Salisbury <joseph.salisbury@...onical.com>
To:	viro@...iv.linux.org.uk, eparis@...hat.com
CC:	hirofumi@...l.parknet.co.jp, john@...nmccutchan.com,
	rlove@...ve.org, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org
Subject: Re: Race inotify_rm_watch vs umount

On 03/06/2012 04:02 PM, Joseph Salisbury wrote:
>
>
> Forwarded conversation
> Subject: *Race inotify_rm_watch vs umount*
> ------------------------
>
> From: *OGAWA Hirofumi* <hirofumi@...l.parknet.co.jp
> <mailto:hirofumi@...l.parknet.co.jp>>
> Date: Fri, Jun 10, 2011 at 7:20 AM
> To: John McCutchan <john@...nmccutchan.com
> <mailto:john@...nmccutchan.com>>, Robert Love <rlove@...ve.org
> <mailto:rlove@...ve.org>>, Eric Paris <eparis@...hat.com
> <mailto:eparis@...hat.com>>
> Cc: linux-kernel@...r.kernel.org <mailto:linux-kernel@...r.kernel.org>,
> linux-fsdevel@...r.kernel.org <mailto:linux-fsdevel@...r.kernel.org>
>
>
> Hi,
>
> I'm looking the race inotify_rm_watch() vs umount(). This race become the
> cause of Oops. You can see the oops at
>
> https://bugzilla.kernel.org/show_bug.cgi?id=22602
>
> So, what race?
>
> umount                               inotify_rm_watch
>   ...                                  fsnotify_destroy_mark()
>                                          fsnotify_destroy_inode_mark()
>                                            /* removed from
> i_fsnotify_marks */
>     generic_shutdown_super()
>       fsnotify_unmount_inodes()
>         put_super()
>                                            iput()
>                                              iput_final()
>                                                /* this is after
> put_super() */
>
> Like above, inotify doesn't guarantee to call final iput() before
> put_super(). With this violation, FS driver can oops.
>
> Well, so, what are requested for inotify?  We can't simply take
> sb->s_umount in inotify_rm_watch()?
>
> Any ideas?
>
> Thanks.
> --
> OGAWA Hirofumi <hirofumi@...l.parknet.co.jp
> <mailto:hirofumi@...l.parknet.co.jp>>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> <mailto:majordomo@...r.kernel.org>
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
> ----------
> From: *Eric Paris* <eparis@...hat.com <mailto:eparis@...hat.com>>
> Date: Fri, Jun 10, 2011 at 9:46 AM
> To: OGAWA Hirofumi <hirofumi@...l.parknet.co.jp
> <mailto:hirofumi@...l.parknet.co.jp>>
> Cc: John McCutchan <john@...nmccutchan.com
> <mailto:john@...nmccutchan.com>>, Robert Love <rlove@...ve.org
> <mailto:rlove@...ve.org>>, linux-kernel@...r.kernel.org
> <mailto:linux-kernel@...r.kernel.org>, linux-fsdevel@...r.kernel.org
> <mailto:linux-fsdevel@...r.kernel.org>
>
>
> Ok, I see what you are saying, I'll see what I can do.  I'm a little
> scared to call something like iput() under a lock though.  I might be
> able to make the bigest lock a mutex and fix this....
>
> I'll add this to my test suite.
>
> -Eric
>  >
>  > umount                               inotify_rm_watch
>  >   ...                                  fsnotify_destroy_mark()
>  >                                          fsnotify_destroy_inode_mark()
>  >                                            /* removed from
> i_fsnotify_marks */
>  >     generic_shutdown_super()
>  >       fsnotify_unmount_inodes()
>  >         put_super()
>  >                                            iput()
>  >                                              iput_final()
>  >                                                /* this is after
> put_super() */
>  >
>  > Like above, inotify doesn't guarantee to call final iput() before
>  > put_super(). With this violation, FS driver can oops.
>  >
>  > Well, so, what are requested for inotify?  We can't simply take
>  > sb->s_umount in inotify_rm_watch()?
>  >
>  > Any ideas?
>  >
>  > Thanks.
>
>
> --
>
> ----------
> From: *Al Viro* <viro@...iv.linux.org.uk <mailto:viro@...iv.linux.org.uk>>
> Date: Fri, Jun 10, 2011 at 10:35 AM
> To: Eric Paris <eparis@...hat.com <mailto:eparis@...hat.com>>
> Cc: OGAWA Hirofumi <hirofumi@...l.parknet.co.jp
> <mailto:hirofumi@...l.parknet.co.jp>>, John McCutchan
> <john@...nmccutchan.com <mailto:john@...nmccutchan.com>>, Robert Love
> <rlove@...ve.org <mailto:rlove@...ve.org>>, linux-kernel@...r.kernel.org
> <mailto:linux-kernel@...r.kernel.org>, linux-fsdevel@...r.kernel.org
> <mailto:linux-fsdevel@...r.kernel.org>
>
>
> Which lock would that be?  I don't see any good candidates in there...
>
>

Hello,

It appears this bug still exists in the 3.2 kernel[0].  There was some 
discussion about this bug in this thread and in the bug[1].  However, 
there haven't been any updates in a while.

Has there been any further findings on this issue?

Thanks,

Joe


[0] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/922906
[1] https://bugzilla.kernel.org/show_bug.cgi?id=22602
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/