linux-kernel - Re: [PATCH v8 01/10] kernfs: Remove reference counting for kernfs_open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 22 Apr 2022 06:03:17 -1000
From:   Tejun Heo <tj@...nel.org>
To:     Imran Khan <imran.f.khan@...cle.com>
Cc:     viro@...iv.linux.org.uk, gregkh@...uxfoundation.org,
        ebiederm@...ssion.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v8 01/10] kernfs: Remove reference counting for
 kernfs_open_node.

On Sun, Apr 10, 2022 at 12:37:10PM +1000, Imran Khan wrote:
> @@ -768,15 +765,15 @@ void kernfs_drain_open_files(struct kernfs_node *kn)
>  	if (!(kn->flags & (KERNFS_HAS_MMAP | KERNFS_HAS_RELEASE)))
>  		return;
>  
> -	spin_lock_irq(&kernfs_open_node_lock);
>  	on = kn->attr.open;
> -	if (on)
> -		atomic_inc(&on->refcnt);
> -	spin_unlock_irq(&kernfs_open_node_lock);
>  	if (!on)
>  		return;
>
>  	mutex_lock(&kernfs_open_file_mutex);
> +	if (!kn->attr.open) {
> +		mutex_unlock(&kernfs_open_file_mutex);
> +		return;
> +	}

What if @on got freed and new one got allocated between the lockless check
and the locked check? Is there a reason to keep the lockless check at all?

>  	list_for_each_entry(of, &on->files, list) {
>  		struct inode *inode = file_inode(of->file);

Thanks.

-- 
tejun