linux-kernel - Re: [PATCH v3 2/4] SUNRPC: fix races on PipeFS UMOUNT notifications

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 25 Jun 2013 16:13:05 +0000
From:	"Myklebust, Trond" <Trond.Myklebust@...app.com>
To:	Stanislav Kinsbursky <skinsbursky@...allels.com>
CC:	"linux-nfs@...r.kernel.org" <linux-nfs@...r.kernel.org>,
	"devel@...nvz.org" <devel@...nvz.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"jlayton@...hat.com" <jlayton@...hat.com>
Subject: Re: [PATCH v3 2/4] SUNRPC: fix races on PipeFS UMOUNT notifications

On Mon, 2013-06-24 at 11:52 +0400, Stanislav Kinsbursky wrote:
> CPU#0                                   CPU#1
> -----------------------------           -----------------------------
> rpc_kill_sb
> sn->pipefs_sb = NULL                    rpc_release_client
> (UMOUNT_EVENT)                          rpc_free_auth
> rpc_pipefs_event
> rpc_get_client_for_event
> !atomic_inc_not_zero(cl_count)
> <skip the client>
>                                         atomic_inc(cl_count)
>                                         rpc_free_client
>                                         rpc_clnt_remove_pipedir
>                                         <skip client dir removing>
> 
> To fix this, this patch does the following:
> 
> 1) Calls RPC_PIPEFS_UMOUNT notification with sn->pipefs_sb_lock being held.
> 2) Removes SUNRPC client from the list AFTER pipes destroying.
> 3) Doesn't hold RPC client on notification: if client in the list, then it
> can't be destroyed while sn->pipefs_sb_lock in hold by notification caller.
> 
> Signed-off-by: Stanislav Kinsbursky <skinsbursky@...allels.com>
> Cc: stable@...r.kernel.org
> ---
>  net/sunrpc/clnt.c     |    5 +----
>  net/sunrpc/rpc_pipe.c |    2 +-
>  2 files changed, 2 insertions(+), 5 deletions(-)

<snip>

> diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
> index c512448..efca2f7 100644
> --- a/net/sunrpc/rpc_pipe.c
> +++ b/net/sunrpc/rpc_pipe.c
> @@ -1165,7 +1165,6 @@ static void rpc_kill_sb(struct super_block *sb)
>  		goto out;
>  	}
>  	sn->pipefs_sb = NULL;
> -	mutex_unlock(&sn->pipefs_sb_lock);
>  	dprintk("RPC:       sending pipefs UMOUNT notification for net %p%s\n",
>  		net, NET_NAME(net));
>  	blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
> @@ -1173,6 +1172,7 @@ static void rpc_kill_sb(struct super_block *sb)
>  					   sb);
>  	put_net(net);
>  out:
> +	mutex_unlock(&sn->pipefs_sb_lock);

Is this safe to do after the put_net()?

>  	kill_litter_super(sb);
>  }
>  
> 


-- 
Trond Myklebust
Linux NFS client maintainer

NetApp
Trond.Myklebust@...app.com
www.netapp.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/