linux-kernel - Re: [PATCH RFC] sysfs: fix the race of "parent deleted before child added"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 1 Aug 2014 22:31:00 +0800
From:	Jianyu Zhan <nasa4836@...il.com>
To:	Tejun Heo <tj@...nel.org>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Jianyu Zhan <Jianyu.Zhan@....com>
Subject: Re: [PATCH RFC] sysfs: fix the race of "parent deleted before child added"

Hi, tj,

On Fri, Aug 1, 2014 at 8:50 PM, Tejun Heo <tj@...nel.org> wrote:
> The *only* reason we have the warning at all is because the driver
> model wants to enforce that destruction is performed in the proper
> order and what you're doing is just circumventing the detection logic.
> We might as well just remove it.  Please track down why the specific
> warning that you saw happened.  We wanna learn about them and fix
> them.

The problem I met is in an old kernel, in sysfs_create_dir(),  at thie line:

   sysfs_create_dir()
       if (kobj->parent)
            parent = kobj->parent->sd;

I found kobj->parent is valid, so parent == kobj->parent->sd,
then it is passed into create_dir() function, in which it is dereferenced,
however  the parent passed in is NULL, so a panic.

Apprently, there is a race, as my case is a test of fast removal and plugging
of a block device.

The race is that the kerfs_node(was sysfs_dirent) is disassociated with
parent kobject, but parent kobject is still alive, so we saw it.

And the commit 3a198886 ("sysfs: handle 'parent deleted before child added'")
add a parent NULLness check before calling into create_dir(),  but I think this
isn't the real fix, it just narrow down the racy window.

Thanks,
Jianyu Zhan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/