linux-kernel - Re: [PATCH] vfs: avoid spurious dentry ref/unref cycle on open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240807124348.GY5334@ZenIV>
Date: Wed, 7 Aug 2024 13:43:48 +0100
From: Al Viro <viro@...iv.linux.org.uk>
To: Mateusz Guzik <mjguzik@...il.com>
Cc: brauner@...nel.org, jack@...e.cz, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH] vfs: avoid spurious dentry ref/unref cycle on open

On Wed, Aug 07, 2024 at 11:50:50AM +0200, Mateusz Guzik wrote:

> tripping ip:
> vfs_tmpfile+0x162/0x230:
> fsnotify_parent at include/linux/fsnotify.h:81
> (inlined by) fsnotify_file at include/linux/fsnotify.h:131
> (inlined by) fsnotify_open at include/linux/fsnotify.h:401
> (inlined by) vfs_tmpfile at fs/namei.c:3781

Try this for incremental; missed the fact that finish_open() is
used by ->tmpfile() instances, not just ->atomic_open().

Al, crawling back to sleep...

diff --git a/fs/namei.c b/fs/namei.c
index 95345a5beb3a..0536907e8e79 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3776,7 +3776,10 @@ int vfs_tmpfile(struct mnt_idmap *idmap,
 	file->f_path.dentry = child;
 	mode = vfs_prepare_mode(idmap, dir, mode, mode, mode);
 	error = dir->i_op->tmpfile(idmap, dir, file, mode);
-	dput(child);
+	if (file->f_mode & FMODE_OPENED)
+		mntget(parentpath->mnt);
+	else
+		dput(child);
 	if (file->f_mode & FMODE_OPENED)
 		fsnotify_open(file);
 	if (error)