linux-kernel - Re: fs/namei.c: Misuse of sequence counts?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20141011234635.GL7996@ZenIV.linux.org.uk>
Date:	Sun, 12 Oct 2014 00:46:35 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Eric Biggers <ebiggers3@...il.com>
Cc:	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: fs/namei.c: Misuse of sequence counts?

On Sat, Oct 11, 2014 at 05:58:08PM -0500, Eric Biggers wrote:

> In follow_dotdot_rcu(), said commit moved loads of the inode to just before
> read_seqcount_begin(), in several instances.  I don't think this is correct,
> because (as I understand it) read_seqcount_begin() is opening a seq-read
> critical section on the new dentry.  So the inode load should come *after* it,
> as in the original, to ensure the inode pointer is correctly matched with the
> sequence count.

Nope.  What we do is
	* pick parent inode and seqcount (in whatever order)
	* THEN check that child is still unchanged.
The second part guarantees that parent dentry had been the parent of
child all along, since the moment we'd first fetched _child's_ seqcount.
And since a pinned positive dentry can't have its ->d_inode changed,
we know that the value of parent's inode we'd fetched remained valid
at least until we'd checked the child's seqcount and found it unchanged.
Which means that we had it valid at some point after we'd fetched parent's
seqcount.

The crucial part is that dentry cannot change its ->d_inode for as long as
there are references to it.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/