linux-kernel - Re: [PATCH 2/2] tracefs: Don't overlay 'struct inode'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <400f3e4f-551e-4f7a-9751-84d711c6572b@grsecurity.net>
Date: Wed, 7 Aug 2024 22:27:57 +0200
From: Mathias Krause <minipli@...ecurity.net>
To: Steven Rostedt <rostedt@...dmis.org>, Al Viro <viro@...iv.linux.org.uk>
Cc: Masami Hiramatsu <mhiramat@...nel.org>,
 Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 Ajay Kaher <ajay.kaher@...adcom.com>, linux-trace-kernel@...r.kernel.org,
 linux-kernel@...r.kernel.org, Ilkka Naulapää
 <digirigawa@...il.com>, Brad Spengler <spender@...ecurity.net>
Subject: Re: [PATCH 2/2] tracefs: Don't overlay 'struct inode'

On 07.08.24 17:49, Steven Rostedt wrote:
> [...]
> 
> So I could use destroy_inode() for the removing of the link list, and then
> free_inode to free it. Something like:
> 
> diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
> index 1028ab6d9a74..ae2cb2221acd 100644
> --- a/fs/tracefs/inode.c
> +++ b/fs/tracefs/inode.c
> @@ -53,15 +53,14 @@ static struct inode *tracefs_alloc_inode(struct super_block *sb)
>  	return &ti->vfs_inode;
>  }
>  
> -static void tracefs_free_inode_rcu(struct rcu_head *rcu)
> +static void tracefs_free_inode(struct inode *inode)
>  {
> -	struct tracefs_inode *ti;
> +	struct tracefs_inode *ti = get_tracefs(inode);
>  
> -	ti = container_of(rcu, struct tracefs_inode, rcu);
>  	kmem_cache_free(tracefs_inode_cachep, ti);
>  }
>  
> -static void tracefs_free_inode(struct inode *inode)
> +static void tracefs_destroy_inode(struct inode *inode)
>  {
>  	struct tracefs_inode *ti = get_tracefs(inode);
>  	unsigned long flags;
> @@ -69,8 +68,6 @@ static void tracefs_free_inode(struct inode *inode)
>  	spin_lock_irqsave(&tracefs_inode_lock, flags);
>  	list_del_rcu(&ti->list);
>  	spin_unlock_irqrestore(&tracefs_inode_lock, flags);
> -
> -	call_rcu(&ti->rcu, tracefs_free_inode_rcu);
>  }
>  
>  static ssize_t default_read_file(struct file *file, char __user *buf,
> @@ -437,6 +434,7 @@ static int tracefs_drop_inode(struct inode *inode)
>  static const struct super_operations tracefs_super_operations = {
>  	.alloc_inode    = tracefs_alloc_inode,
>  	.free_inode     = tracefs_free_inode,
> +	.destroy_inode  = tracefs_destroy_inode,
>  	.drop_inode     = tracefs_drop_inode,
>  	.statfs		= simple_statfs,
>  	.show_options	= tracefs_show_options,
> diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h
> index f704d8348357..d83c2a25f288 100644
> --- a/fs/tracefs/internal.h
> +++ b/fs/tracefs/internal.h
> @@ -10,10 +10,7 @@ enum {
>  };
>  
>  struct tracefs_inode {
> -	union {
> -		struct inode            vfs_inode;
> -		struct rcu_head		rcu;
> -	};
> +	struct inode            vfs_inode;
>  	/* The below gets initialized with memset_after(ti, 0, vfs_inode) */
>  	struct list_head	list;
>  	unsigned long           flags;
> 
> 
> I'll run this under some more tests and see if it doesn't crash.
> 
> I'll apply the first patch of this series too, and then probably use this
> one.

LGTM, will give it some testing here too.

Thanks,
Mathias