linux-kernel - Re: [PATCH 03/34] teach move_mount(2) to work with OPEN_TREE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 19 Oct 2018 22:35:09 +0100
From:   David Howells <dhowells@...hat.com>
To:     Alan Jenkins <alan.christopher.jenkins@...il.com>
Cc:     dhowells@...hat.com, viro@...iv.linux.org.uk,
        torvalds@...ux-foundation.org, ebiederm@...ssion.com,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        mszeredi@...hat.com
Subject: Re: [PATCH 03/34] teach move_mount(2) to work with OPEN_TREE_CLONE [ver #12]

Alan Jenkins <alan.christopher.jenkins@...il.com> wrote:

> And the first sequence I mentioned - close the FD, then mount+unmount - 
> seems to be unchanged.

Unchanged in what sense?  Still breaks?  I thought I'd fixed that - or are we
talking about a different first sequence?

Sorry, I'm losing track of how many different ways of breaking open_tree() and
move_mount() you've posted.  I don't suppose you could post a checklist?

> I guess this tries to fix the second of the two sequences I mentioned - 
> mount+unmount, then close the FD.  It doesn't seem to work.
> 
> # open_tree_clone 3</mnt 3 sh
> # cd /proc/self/fd/3
> # mount --move . /mnt
> [   41.747831] mnt_flags=1020 umount=0
> # cd /
> # umount /mnt
> umount: /mnt: target is busy
> 
> ^ a newly introduced bug? I do not remember having this problem before.
> 
> # umount -l /mnt

Sigh, so I see.  I have the attached trace from this sequence.

David
----
Command "open_tree_clone 3</mnt 3 sh"

              sh-3614  M=421a9872 u=1 ALC sp=clone_mnt+0x31/0x30a
              sh-3614  M=421a9872 u=2 GET sp=do_dentry_open+0x24/0x2d3
              sh-3614  M=421a9872 u=1 PUT sp=__se_sys_open_tree+0x195/0x1da
              sh-3614  M=421a9872 u=2 GET sp=proc_fd_link+0x106/0x124
              sh-3614  M=421a9872 u=1 PUT sp=vfs_statx+0x95/0xcc

Command "cd /proc/self/fd/3":

              sh-3614  M=421a9872 u=2 GET sp=proc_fd_link+0x106/0x124
              sh-3614  M=421a9872 u=3 GET sp=set_fs_pwd+0x37/0xdb
              sh-3614  M=421a9872 u=2 PUT sp=ksys_chdir+0x88/0xbd

              sh-3614  M=421a9872 u=3 GET sp=legitimize_path.isra.7+0x16/0x50
              sh-3614  M=421a9872 u=2 PUT sp=vfs_statx+0x95/0xcc

Command "mount --move . /mnt":

              sh-3614  M=421a9872 u=3 GET sp=copy_fs_struct+0xcc/0xde
           mount-3615  M=421a9872 u=4 GET sp=legitimize_path.isra.7+0x16/0x50
           mount-3615  M=421a9872 u=3 PUT sp=vfs_statx+0x95/0xcc
           mount-3615  M=421a9872 u=4 GET sp=legitimize_path.isra.7+0x16/0x50
           mount-3615  M=421a9872 u=5 GET sp=do_dentry_open+0x24/0x2d3
           mount-3615  M=421a9872 u=4 PUT sp=terminate_walk+0x20/0xda
           mount-3615  M=421a9872 u=5 GET sp=legitimize_path.isra.7+0x16/0x50
           mount-3615  M=421a9872 u=4 PUT sp=vfs_statx+0x95/0xcc
           mount-3615  M=421a9872 u=3 PUT sp=__fput+0x180/0x1c1
           mount-3615  M=421a9872 u=4 GET sp=legitimize_path.isra.7+0x16/0x50
           mount-3615  M=421a9872 u=4 0x4e sp=          (null)
           mount-3615  M=421a9872 u=5 GET sp=do_move_mount+0x216/0x298
           mount-3615  M=421a9872 u=4 PUT sp=do_mount+0x715/0x929
           mount-3615  M=421a9872 u=3 PUT sp=free_fs_struct+0x1e/0x2e

Command "cd /":

              sh-3614  M=421a9872 u=2 PUT sp=set_fs_pwd+0xb8/0xdb

Command "umount /mnt":

          umount-3616  M=421a9872 u=3 GET sp=legitimize_path.isra.7+0x16/0x50
          umount-3616  M=421a9872 u=2 PUT sp=vfs_statx+0x95/0xcc
          umount-3616  M=421a9872 u=3 GET sp=legitimize_path.isra.7+0x16/0x50
          umount-3616  M=421a9872 u=2 PUT sp=vfs_statx+0x95/0xcc
          umount-3616  M=421a9872 u=3 GET sp=legitimize_path.isra.7+0x16/0x50
          umount-3616  M=421a9872 u=2 PUT sp=user_statfs+0x61/0x98
          umount-3616  M=421a9872 u=3 GET sp=legitimize_mnt+0x12/0x108
          umount-3616  M=421a9872 u=2 PUT sp=ksys_umount+0x3e8/0x40e

(Fails, -EBUSY).

Command "umount -l /mnt":

          umount-3617  M=421a9872 u=3 GET sp=legitimize_mnt+0x12/0x108
          umount-3617  M=421a9872 u=2 PUT sp=pin_kill+0x11c/0x325
          umount-3617  M=421a9872 u=1 PUT sp=ksys_umount+0x3e8/0x40e

Command "exec 3<&-":

(Goes weird: bash still responds, but trying to run a command locks up that
shell; can still log in with ssh, but can't then run commands).

David