linux-kernel - [ceph] what's going on with d_rehash() in splice

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 26 Feb 2016 17:42:50 +0000
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Sage Weil <sweil@...hat.com>
Cc:	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org
Subject: [ceph] what's going on with d_rehash() in splice_dentry()?

You have, modulo printks and BUG_ON(),
{
        struct dentry *realdn;
        /* dn must be unhashed */
        if (!d_unhashed(dn))
                d_drop(dn);
        realdn = d_splice_alias(in, dn);
        if (IS_ERR(realdn)) {
                if (prehash)
                        *prehash = false; /* don't rehash on error */
                dn = realdn; /* note realdn contains the error */
                goto out;
        } else if (realdn) {
                dput(dn);
                dn = realdn;
        }
        if ((!prehash || *prehash) && d_unhashed(dn))
                d_rehash(dn);

When d_splice_alias() returns NULL it has hashed the dentry you'd given it;
when it returns a different dentry, that dentry is also returned hashed.
IOW, d_rehash(dn) in there should never be called.

If you have a case when it _is_ called, you've found a bug somewhere and
I'd like to see details.  AFAICS, the whole prehash thing appears to be
pointless - even the place where we modify *prehash, since in that case
we return ERR_PTR() and the only caller passing non-NULL prehash (&have_lease)
buggers off on such return value past all code that would look at have_lease
value.

One possible reading is that you want to prevent hashing in !have_lease
case of
                        dn = splice_dentry(dn, in, &have_lease);
If that's the case, you might have a problem, since it will be hashed no
matter what...

PS: the proof that d_splice_alias() always hashes is simple - if you exclude
the places where it returns ERR_PTR(), you are left with
        d_rehash(dentry);
        return NULL;
in the very end,
                                __d_move(new, dentry, false);
				...
			return new;
and
                                int err = __d_unalias(inode, dentry, new);
				...
				// err turned out to be zero
			return new;
The first one is obvious - we return NULL after an explicit d_rehash() of
the argument.  __d_move() is guaranteed to return with its first argument
hashed due to
        __d_drop(dentry);
        __d_rehash(dentry, d_hash(target->d_parent, target->d_name.hash));
(dentry here refers to the first argument of __d_move() - it's our 'new').
And zero-returning __d_unalias() ends up calling __d_move(), with the
third argument of __d_unalias() ending up as the first one of __d_move().
So in both remaining cases we return a dentry that has just been hashed.