linux-kernel - Re: [PATCH 2/2] tracefs: Don't overlay 'struct inode'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240807134453.GZ5334@ZenIV>
Date: Wed, 7 Aug 2024 14:44:53 +0100
From: Al Viro <viro@...iv.linux.org.uk>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: Mathias Krause <minipli@...ecurity.net>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	Ajay Kaher <ajay.kaher@...adcom.com>,
	linux-trace-kernel@...r.kernel.org, linux-kernel@...r.kernel.org,
	Ilkka Naulapää <digirigawa@...il.com>,
	Brad Spengler <spender@...ecurity.net>
Subject: Re: [PATCH 2/2] tracefs: Don't overlay 'struct inode'

On Wed, Aug 07, 2024 at 09:35:45AM -0400, Steven Rostedt wrote:

> Perhaps:
> 
> diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h
> index f704d8348357..ab6d6c3d835d 100644
> --- a/fs/tracefs/internal.h
> +++ b/fs/tracefs/internal.h
> @@ -10,12 +10,12 @@ enum {
>  };
>  
>  struct tracefs_inode {
> +	struct inode            vfs_inode;
> +	/* The below gets initialized with memset_after(ti, 0, vfs_inode) */
>  	union {
> -		struct inode            vfs_inode;
> +		struct list_head	list;
>  		struct rcu_head		rcu;
>  	};
> -	/* The below gets initialized with memset_after(ti, 0, vfs_inode) */
> -	struct list_head	list;
>  	unsigned long           flags;
>  	void                    *private;
>  };

	Your current variant gives you an RCU-delayed call of
tracefs_free_inode(), which schedules an RCU-delayed call of
tracefs_free_inode_rcu().

	Do you really need that double RCU delay to start with?
Because if you do not, just do that list_del_rcu() in ->destroy_inode()
(which is called without an RCU delay) and have kmem_cache_free()
in ->free_inode() (which is called *with* RCU delay started after
the call of ->destroy_inode()).