linux-kernel - Re: [PATCH 2/2] i915: do not leak module ref counter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190802134955.GA23032@tigerII.localdomain>
Date:   Fri, 2 Aug 2019 22:49:55 +0900
From:   Sergey Senozhatsky <sergey.senozhatsky@...il.com>
To:     Chris Wilson <chris@...is-wilson.co.uk>
Cc:     Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Jani Nikula <jani.nikula@...ux.intel.com>,
        Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
        Rodrigo Vivi <rodrigo.vivi@...el.com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        intel-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] i915: do not leak module ref counter

On (08/02/19 14:41), Chris Wilson wrote:
[..]
> struct vfsmount *kern_mount(struct file_system_type *type)
> {
>         struct vfsmount *mnt;
>         mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, NULL);
>         if (!IS_ERR(mnt)) {
>                 /*
>                  * it is a longterm mount, don't release mnt until
>                  * we unmount before file sys is unregistered
>                 */
>                 real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL;
>         }
>         return mnt;
> }
> 
> With the exception of fiddling with MNT_NS_INTERNAL, it seems
> amenable for our needs.

Sorry, not sure I understand. i915 use kern_mount() at the moment.

Since we still need to put_filesystem(), I'd probably add one more
patch
	- export put_filesystem()

so then we can put_filesystem() in i915. Wonder what would happen
if someone would do
		modprobe i915
		rmmod i916
In a loop.

So something like this (this is against current patch set).

---
 drivers/gpu/drm/i915/gem/i915_gemfs.c | 5 ++---
 fs/filesystems.c                      | 2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gemfs.c b/drivers/gpu/drm/i915/gem/i915_gemfs.c
index d437188d1736..4ea7a6f750f4 100644
--- a/drivers/gpu/drm/i915/gem/i915_gemfs.c
+++ b/drivers/gpu/drm/i915/gem/i915_gemfs.c
@@ -24,10 +24,9 @@ int i915_gemfs_init(struct drm_i915_private *i915)
 		return -ENODEV;
 
 	gemfs = kern_mount(type);
-	if (IS_ERR(gemfs)) {
-		put_filesystem(type);
+	put_filesystem(type);
+	if (IS_ERR(gemfs))
 		return PTR_ERR(gemfs);
-	}
 
 	/*
 	 * Enable huge-pages for objects that are at least HPAGE_PMD_SIZE, most
diff --git a/fs/filesystems.c b/fs/filesystems.c
index 9135646e41ac..4837eda748b5 100644
--- a/fs/filesystems.c
+++ b/fs/filesystems.c
@@ -45,6 +45,7 @@ void put_filesystem(struct file_system_type *fs)
 {
 	module_put(fs->owner);
 }
+EXPORT_SYMBOL(put_filesystem);
 
 static struct file_system_type **find_filesystem(const char *name, unsigned len)
 {
@@ -280,5 +281,4 @@ struct file_system_type *get_fs_type(const char *name)
 	}
 	return fs;
 }
-
 EXPORT_SYMBOL(get_fs_type);