linux-kernel - Re: [PATCH] md / procfs: avoid Oops if md-mod removed while /proc/mdstat is being polled.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140228100757.7dbd3dae@notabene.brown>
Date:	Fri, 28 Feb 2014 10:07:57 +1100
From:	NeilBrown <neilb@...e.de>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Alexander Viro <viro@...iv.linux.org.uk>,
	linux-fsdevel@...r.kernel.org,
	linux RAID <linux-raid@...r.kernel.org>,
	"majianpeng" <majianpeng@...il.com>,
	lkml <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] md / procfs: avoid Oops if md-mod removed while
 /proc/mdstat is being polled.

On Thu, 27 Feb 2014 13:51:25 -0800 Andrew Morton <akpm@...ux-foundation.org>
wrote:

> On Fri, 28 Feb 2014 08:34:43 +1100 NeilBrown <neilb@...e.de> wrote:
> 
> > On Thu, 27 Feb 2014 12:58:07 -0800 Andrew Morton <akpm@...ux-foundation.org>
> > wrote:
> > 
> > > On Thu, 27 Feb 2014 17:24:45 +1100 NeilBrown <neilb@...e.de> wrote:
> > > 
> > > > If poll or select is waiting on /proc/mdstat when md-mod is unloaded
> > > > an oops will ensure when the poll/select completes.
> > > > 
> > > > This is because the wait_queue_head which is registered with poll_wait()
> > > > is local to the module and no longer exists when the poll completes and
> > > > detaches that wait_queue_head (in poll_free_wait -> remove_wait_queue).
> > > > 
> > > > To fix this we need the wait_queue_head to have (at least) the same life
> > > > time as the proc_dir_entry.  So this patch places it in that structure.
> > > > 
> > > > We:
> > > >   - add pde_poll_wait to struct proc_dir_entry
> > > >   - call poll_wait() passing this when poll() is called on the proc file
> > > >   - export a function proc_wake_up which will call wake_up() on pde_poll_wait
> > > > 
> > > > and make use of all that in md.c
> > > 
> > > This sounds wrong.  If a userspace process is waiting on
> > > md_event_waiters then the md module is "busy" and the rmmod attempt
> > > should fail?
> > 
> > Al Viro says "no" quite firmly.
> > 
> > I think the core argument is that
> > 
> >   rmmod md-mod < /proc/mdstat
> > 
> > would deadlock.
> 
> Well, only if the rmmod hangs around waiting for the module to go idle.
> I'm thinking rmmod should fail.  EBUSY.
> 
> > http://marc.info/?l=linux-fsdevel&m=133024267507384
> 
> Why don't a billion blocking-procfs-read sites have this problem?
> 

This issue of a file in /proc (actually /proc/fs/nfsd which is a separate
filesystem) blocking came up on the NFS list recently.
Experiments suggested that no other files in /proc block reads
(though /proc/vmcore takes somewhat longer to 'cat' than most).
So the offending file was changed to never block.

i.e. I think your 'billion' estimate is a little high, by one billion.
:-)

NeilBrown

Download attachment "signature.asc" of type "application/pgp-signature" (829 bytes)