linux-kernel - [PATCH][v3.2 stable tree] dcache: Balance rcu_read_lock in have

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 17 Jan 2015 10:38:06 -0500
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Ben Hutchings <ben@...adent.org.uk>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	stable <stable@...r.kernel.org>,
	Al Viro <viro@...IV.linux.org.uk>
Subject: [PATCH][v3.2 stable tree] dcache: Balance rcu_read_lock in
 have_submounts()


Porting -rt to the latest 3.2 stable tree I triggered this bug:

=====================================
[ BUG: bad unlock balance detected! ]
-------------------------------------
rm/1638 is trying to release lock (rcu_read_lock) at:
[<c04fde6c>] rcu_read_unlock+0x0/0x23
but there are no more locks to release!

other info that might help us debug this:
2 locks held by rm/1638:
 #0:  (&sb->s_type->i_mutex_key#9/1){+.+.+.}, at: [<c04f93eb>] do_rmdir+0x5f/0xd2
 #1:  (&sb->s_type->i_mutex_key#9){+.+.+.}, at: [<c04f9329>] vfs_rmdir+0x49/0xac

stack backtrace:
Pid: 1638, comm: rm Not tainted 3.2.66-test-rt96+ #2
Call Trace:
 [<c083f390>] ? printk+0x1d/0x1f
 [<c0463cdf>] print_unlock_inbalance_bug+0xc3/0xcd
 [<c04653a8>] lock_release_non_nested+0x98/0x1ec
 [<c046228d>] ? trace_hardirqs_off_caller+0x18/0x90
 [<c0456f1c>] ? local_clock+0x2d/0x50
 [<c04fde6c>] ? d_hash+0x2f/0x2f
 [<c04fde6c>] ? d_hash+0x2f/0x2f
 [<c046568e>] lock_release+0x192/0x1ad
 [<c04fde83>] rcu_read_unlock+0x17/0x23
 [<c04ff344>] shrink_dcache_parent+0x227/0x270
 [<c04f9348>] vfs_rmdir+0x68/0xac
 [<c04f9424>] do_rmdir+0x98/0xd2
 [<c04f03ad>] ? fput+0x1a3/0x1ab
 [<c084dd42>] ? sysenter_exit+0xf/0x1a
 [<c0465b58>] ? trace_hardirqs_on_caller+0x118/0x149
 [<c04fa3e0>] sys_unlinkat+0x2b/0x35
 [<c084dd13>] sysenter_do_call+0x12/0x12




There's a path to calling rcu_read_unlock() without calling
rcu_read_lock() in have_submounts().

	goto positive;

positive:
	if (!locked && read_seqretry(&rename_lock, seq))
		goto rename_retry;

rename_retry:
	rcu_read_unlock();

in the above path, rcu_read_lock() is never done before calling
rcu_read_unlock();

Signed-off-by: Steven Rostedt <rostedt@...dmis.org>
---
 fs/dcache.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/dcache.c b/fs/dcache.c
index 98cc4508e140..0d0ba5b2a8ae 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1035,8 +1035,10 @@ ascend:
 		write_sequnlock(&rename_lock);
 	return 0; /* No mount points found in tree */
 positive:
-	if (!locked && read_seqretry(&rename_lock, seq))
+	if (!locked && read_seqretry(&rename_lock, seq)) {
+		rcu_read_lock();
 		goto rename_retry;
+	}
 	if (locked)
 		write_sequnlock(&rename_lock);
 	return 1;
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/