linux-kernel - Re: [PATCH] vfs: avoid spurious dentry ref/unref cycle on open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240807033820.GS5334@ZenIV>
Date: Wed, 7 Aug 2024 04:38:20 +0100
From: Al Viro <viro@...iv.linux.org.uk>
To: Mateusz Guzik <mjguzik@...il.com>
Cc: brauner@...nel.org, jack@...e.cz, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH] vfs: avoid spurious dentry ref/unref cycle on open

On Tue, Aug 06, 2024 at 06:09:43PM +0200, Mateusz Guzik wrote:

> It is supposed to indicate that both nd->path.mnt and nd->path.dentry
> are no longer usable and must not even be looked at. Ideally code
> which *does* look at them despite the flag (== there is a bug) traps.
> 
> However, I did not find a handy macro or anything of the sort to
> "poison" these pointers. Instead I found tons of NULL checks all over,
> including in lookup clean up.

Unless I'm misreading you, those existing NULLs have nothing to do with
poisoning of any sort.  Or any kind of defensive programming, while we are
at it.  Those are about the cleanups on failed transition from lazy mode;
if we have already legitimized some of the references (i.e. bumped the
refcounts there) by the time we'd run into a stale one, we need to drop
the ones we'd grabbed on the way out.  And the easiest way to do that
is to leave that until terminate_walk(), when we'll be out of RCU mode.
The references that were *NOT* grabbed obviously should be left alone
rather than dropped.  Which is where those NULL assignments come from.