linux-kernel - Re: [PATCH 2/2] tracefs: Don't overlay 'struct inode'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240807114948.6d57af23@gandalf.local.home>
Date: Wed, 7 Aug 2024 11:49:48 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: Al Viro <viro@...iv.linux.org.uk>
Cc: Mathias Krause <minipli@...ecurity.net>, Masami Hiramatsu
 <mhiramat@...nel.org>, Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 Ajay Kaher <ajay.kaher@...adcom.com>, linux-trace-kernel@...r.kernel.org,
 linux-kernel@...r.kernel.org, Ilkka Naulapää
 <digirigawa@...il.com>, Brad Spengler <spender@...ecurity.net>
Subject: Re: [PATCH 2/2] tracefs: Don't overlay 'struct inode'

On Wed, 7 Aug 2024 14:44:53 +0100
Al Viro <viro@...iv.linux.org.uk> wrote:

> On Wed, Aug 07, 2024 at 09:35:45AM -0400, Steven Rostedt wrote:
> 
> > Perhaps:
> > 
> > diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h
> > index f704d8348357..ab6d6c3d835d 100644
> > --- a/fs/tracefs/internal.h
> > +++ b/fs/tracefs/internal.h
> > @@ -10,12 +10,12 @@ enum {
> >  };
> >  
> >  struct tracefs_inode {
> > +	struct inode            vfs_inode;
> > +	/* The below gets initialized with memset_after(ti, 0, vfs_inode) */
> >  	union {
> > -		struct inode            vfs_inode;
> > +		struct list_head	list;
> >  		struct rcu_head		rcu;
> >  	};
> > -	/* The below gets initialized with memset_after(ti, 0, vfs_inode) */
> > -	struct list_head	list;
> >  	unsigned long           flags;
> >  	void                    *private;
> >  };  
> 
> 	Your current variant gives you an RCU-delayed call of
> tracefs_free_inode(), which schedules an RCU-delayed call of
> tracefs_free_inode_rcu().
> 
> 	Do you really need that double RCU delay to start with?
> Because if you do not, just do that list_del_rcu() in ->destroy_inode()
> (which is called without an RCU delay) and have kmem_cache_free()
> in ->free_inode() (which is called *with* RCU delay started after
> the call of ->destroy_inode()).

Thanks, I didn't know about these.

So I could use destroy_inode() for the removing of the link list, and then
free_inode to free it. Something like:

diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index 1028ab6d9a74..ae2cb2221acd 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c
@@ -53,15 +53,14 @@ static struct inode *tracefs_alloc_inode(struct super_block *sb)
 	return &ti->vfs_inode;
 }
 
-static void tracefs_free_inode_rcu(struct rcu_head *rcu)
+static void tracefs_free_inode(struct inode *inode)
 {
-	struct tracefs_inode *ti;
+	struct tracefs_inode *ti = get_tracefs(inode);
 
-	ti = container_of(rcu, struct tracefs_inode, rcu);
 	kmem_cache_free(tracefs_inode_cachep, ti);
 }
 
-static void tracefs_free_inode(struct inode *inode)
+static void tracefs_destroy_inode(struct inode *inode)
 {
 	struct tracefs_inode *ti = get_tracefs(inode);
 	unsigned long flags;
@@ -69,8 +68,6 @@ static void tracefs_free_inode(struct inode *inode)
 	spin_lock_irqsave(&tracefs_inode_lock, flags);
 	list_del_rcu(&ti->list);
 	spin_unlock_irqrestore(&tracefs_inode_lock, flags);
-
-	call_rcu(&ti->rcu, tracefs_free_inode_rcu);
 }
 
 static ssize_t default_read_file(struct file *file, char __user *buf,
@@ -437,6 +434,7 @@ static int tracefs_drop_inode(struct inode *inode)
 static const struct super_operations tracefs_super_operations = {
 	.alloc_inode    = tracefs_alloc_inode,
 	.free_inode     = tracefs_free_inode,
+	.destroy_inode  = tracefs_destroy_inode,
 	.drop_inode     = tracefs_drop_inode,
 	.statfs		= simple_statfs,
 	.show_options	= tracefs_show_options,
diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h
index f704d8348357..d83c2a25f288 100644
--- a/fs/tracefs/internal.h
+++ b/fs/tracefs/internal.h
@@ -10,10 +10,7 @@ enum {
 };
 
 struct tracefs_inode {
-	union {
-		struct inode            vfs_inode;
-		struct rcu_head		rcu;
-	};
+	struct inode            vfs_inode;
 	/* The below gets initialized with memset_after(ti, 0, vfs_inode) */
 	struct list_head	list;
 	unsigned long           flags;


I'll run this under some more tests and see if it doesn't crash.

I'll apply the first patch of this series too, and then probably use this
one.

-- Steve