lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 26 Oct 2014 03:57:05 +0000 From: Al Viro <viro@...IV.linux.org.uk> To: Linus Torvalds <torvalds@...ux-foundation.org> Cc: Sasha Levin <sasha.levin@...cle.com>, linux-fsdevel <linux-fsdevel@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>, Dave Jones <davej@...hat.com>, "Eric W. Biederman" <ebiederm@...ssion.com> Subject: Re: fs: lockup on rename_mutex in fs/dcache.c:1035 [context for Linus] Fuzzer has triggered deadlock in d_walk() with rename_lock taken twice. AFAICS, the plausible scenario is (child->d_flags & DCACHE_DENTRY_KILLED) || triggering while ascending to parent, on the pass with rename_lock already held exclusive. In that case we go to rename_retry and either return without unlocking rename_lock, or try to take in exclusive one more time, again without unlocking it first. > Hmm... Actually, the comment in there is simply wrong - if the child > got killed between unlocking the child and locking the parent, it's > not ascending to the wrong parent, it's having no way to find the next > sibling. > > OK, so basically it came from Nick's "fs: dcache avoid starvation in dcache > multi-step operations" and mistake was in the assumption that once we > hold rename_lock, nothing is going to need rename_retry. Which isn't > true - dentry_kill() on child while we are trying to get ->d_lock on > parent requires a restart and that isn't excluded by rename_lock at > all. > > Well, brute-force fix would be this, but I wonder if it's going to > create livelocks... > > diff --git a/fs/dcache.c b/fs/dcache.c > index 3ffef7f..e3d8499 100644 > --- a/fs/dcache.c > +++ b/fs/dcache.c > @@ -1118,6 +1118,7 @@ out_unlock: > return; > > rename_retry: > + done_seqretry(&rename_lock, seq); > if (!retry) > return; > seq = 1; > -- > To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in > the body of a message to majordomo@...r.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists