linux-kernel - Re: v4.2-rc dcache regression, probably 75a6f82a0d10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 31 Jul 2015 17:20:58 -0700 (PDT)
From:	Hugh Dickins <hughd@...gle.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
cc:	Dominique Martinet <asmadeus@...ewreck.org>,
	Hugh Dickins <hughd@...gle.com>,
	"J. Bruce Fields" <bfields@...ldses.org>,
	Dominique Martinet <dominique.martinet@....fr>,
	Al Viro <viro@...iv.linux.org.uk>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	linux-fsdevel <linux-fsdevel@...r.kernel.org>,
	David Howells <dhowells@...hat.com>
Subject: Re: v4.2-rc dcache regression, probably 75a6f82a0d10

On Fri, 31 Jul 2015, Linus Torvalds wrote:
> 
> I'd be more suspicious about other effects. For example, iot's not at
> all obvious that the commit in question just changes the order of the
> flags/inode field accesses, there are potentialy bigger changes there.
> For example, this part (in __d_obtain_alias):
> 
> -       tmp->d_inode = inode;
> -       tmp->d_flags |= add_flags;
> +       __d_set_inode_and_type(tmp, inode, add_flags);
> 
> looks a bit off, because it *used* to just add those flags, but now,
> through __d_set_inode_and_type, it does
> 
> +       dentry->d_inode = inode;
> +       smp_wmb();
> +       flags = READ_ONCE(dentry->d_flags);
> +       flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU);
> +       flags |= type_flags;
> +       WRITE_ONCE(dentry->d_flags, flags);
> 
> so it clears DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU.
> 
> Is that correct? Maybe, I haven't checked. And maybe it's a big bad
> bug. Regardless, it sure as hell isn't just changing the order of the
> access to those fields. That "DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU"
> clearing came from __d_instantiate(), but now it hits __d_obtain_alias
> too.
> 
> There may be other changes like that for all I know. I didn't look

Yes, the one which grabbed my attention is:

@@ -311,7 +346,7 @@ static void dentry_iput(struct dentry * dentry)
 {
 	struct inode *inode = dentry->d_inode;
 	if (inode) {
-		dentry->d_inode = NULL;
+		__d_clear_type_and_inode(dentry);
 		hlist_del_init(&dentry->d_u.d_alias);
 		spin_unlock(&dentry->d_lock);
 		spin_unlock(&inode->i_lock);

which I think clears the DCACHE_ENTRY_TYPE i.e. makes it DCACHE_MISS_TYPE,
when it was left as is before.  While there might be an RCU lookup in
progress, suddenly finding this to be a negative dentry.  Perhaps -
this is not an area I've visited for years, and I've not followed up
the sequence count protection.

Hugh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/