linux-kernel - Re: [Suggestion] fs/namespace.c: the direct cause of the warning for: "ida_remove called for id=0 which is not allocated" with mnt_release_group

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20130523161805.1faa0f8c59bfc8ee728d8c7f@linux-foundation.org>
Date:	Thu, 23 May 2013 16:18:05 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Chen Gang <gang.chen@...anux.com>
Cc:	Al Viro <viro@...iv.linux.org.uk>, linux-fsdevel@...r.kernel.org,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Takashi Iwai <tiwai@...e.de>
Subject: Re: [Suggestion] fs/namespace.c: the direct cause of the warning
 for: "ida_remove called for id=0 which is not allocated" with
 mnt_release_group_id()

On Tue, 14 May 2013 17:06:30 +0800 Chen Gang <gang.chen@...anux.com> wrote:

> After call collect_mounts(), then call drop_collected_mounts(), it will
> report an warning: "ida_remove called for id=0 which is not allocated"
> (one sample is audit_add_tree_rule() in kernel/audit_tree.c).
> 
> The direct cause (maybe also be the root cause):
>   collect_mounts() passs 'CL_PRIVATE' to copy_tree() -> clone_mnt().
>   it will set "mnt->mnt_group_id = 0" in clone_mnt().
>   when drop_collected_mounts() -> mnt_release_group_id(), 'mnt->mnt_group_id == 0'.

I expect this patch also addresses the bug.  Can you please review and test it?


From: Takashi Iwai <tiwai@...e.de>
Subject: vfs: fix invalid ida_remove() call

When the group id of a shared mount is not allocated, the umount still
tries to call mnt_release_group_id(), which eventually hits a kernel
warning at ida_remove() spewing a message like:

  ida_remove called for id=0 which is not allocated.

This patch fixes the bug simply checking the group id in the caller.

Signed-off-by: Takashi Iwai <tiwai@...e.de>
Reported-by: Cristian Rodríguez <crrodriguez@...nsuse.org>
Cc: Al Viro <viro@...iv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 fs/pnode.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff -puN fs/pnode.c~vfs-fix-invalid-ida_remove-call fs/pnode.c
--- a/fs/pnode.c~vfs-fix-invalid-ida_remove-call
+++ a/fs/pnode.c
@@ -83,7 +83,8 @@ static int do_make_slave(struct mount *m
 		if (peer_mnt == mnt)
 			peer_mnt = NULL;
 	}
-	if (IS_MNT_SHARED(mnt) && list_empty(&mnt->mnt_share))
+	if (mnt->mnt_group_id && IS_MNT_SHARED(mnt) &&
+	    list_empty(&mnt->mnt_share))
 		mnt_release_group_id(mnt);
 
 	list_del_init(&mnt->mnt_share);
_

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/