linux-kernel - Re: kernel BUG at fs/dcache.c:648! with v3.11-7890-ge5c832d

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 10 Sep 2013 12:01:22 -0700
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Al Viro <viro@...iv.linux.org.uk>
Cc:	Josh Boyer <jwboyer@...il.com>, Waiman Long <Waiman.Long@...com>,
	"Linux-Kernel@...r. Kernel. Org" <linux-kernel@...r.kernel.org>,
	Mace Moneta <moneta.mace@...il.com>
Subject: Re: kernel BUG at fs/dcache.c:648! with v3.11-7890-ge5c832d

On Tue, Sep 10, 2013 at 11:43 AM, Al Viro <viro@...iv.linux.org.uk> wrote:
>
> !LOOKUP_ROOT: we set nd->root the first time we need / (in the very
> beginning if it's an absolute pathname, on the first absolute symlink
> otherwise).  In non-RCU mode we hold a reference to it; in RCU mode
> we do not.  As the result, leaving RCU mode should either grab
> a reference to the damn thing (if we intend to go on) or zero it out.

Yeah, that was what I was thinking. But in particular, I was wondering
if we could simplify unlazy_walk() to _not_ take that root reference
at all, and just always zero it out even if we succeed.

IOW, doing the attached patch (_instead_ of the one I sent out).

Or is there something in path lookup retrying that might get uphappy
if we go back to a NULL root.mnt, and doesn't check it?

Because this patch actually simplifies that nasty/complex
unlazy_walk() a lot, and makes it much more understnadable, I think.
It always looked really odd to me how it used to do "if LOOKUP_ROOT is
_not_ set, let's take a reference count to the root"). With this patch
in place, I really like how straightforward unlazy_walk() is. That
used to be just about _the_ most subtle part of the whole
rcu-to-refcount thing (as demonstrated by the number of bugs it has
exposed in the patches), and now it looks almost trivial.

Mace - ignore this newer patch for now, the one I want you to test is
the minimal one you already have, not this cleanup one. But since you
clearly saw the problem I never did, if you get bored _after_ testing
the first patch, feel free to give this one a whirl too. But notice
that this patch is a replacement for - not in addition to - the first
one.

             Linus

Download attachment "patch.diff" of type "application/octet-stream" (1344 bytes)