linux-kernel - Re: [PATCH] devtmpfs: don't use vfs_getattr_nosec to query i

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250425-stehlen-koexistieren-c0f650dcccec@brauner>
Date: Fri, 25 Apr 2025 12:12:36 +0200
From: Christian Brauner <brauner@...nel.org>
To: Heiko Carstens <hca@...ux.ibm.com>, Christoph Hellwig <hch@....de>
Cc: gregkh@...uxfoundation.org, rafael@...nel.org, dakr@...nel.org, 
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org, 
	Shin'ichiro Kawasaki <shinichiro.kawasaki@....com>, Xiao Ni <xni@...hat.com>
Subject: Re: [PATCH] devtmpfs: don't use vfs_getattr_nosec to query i_mode

On Fri, Apr 25, 2025 at 12:03:04PM +0200, Heiko Carstens wrote:
> On Wed, Apr 23, 2025 at 06:59:41AM +0200, Christoph Hellwig wrote:
> > The recent move of the bdev_statx call to the low-level vfs_getattr_nosec
> > helper caused it being used by devtmpfs, which leads to deadlocks in
> > md teardown due to the block device lookup and put interfering with the
> > unusual lifetime rules in md.
> > 
> > But as handle_remove only works on inodes created and owned by devtmpfs
> > itself there is no need to use vfs_getattr_nosec vs simply reading the
> > mode from the inode directly.  Switch to that to avoid the bdev lookup
> > or any other unintentional side effect.
> > 
> > Reported-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@....com>
> > Reported-by: Xiao Ni <xni@...hat.com>
> > Fixes: 777d0961ff95 ("fs: move the bdex_statx call to vfs_getattr_nosec")
> > Signed-off-by: Christoph Hellwig <hch@....de>
> > Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@....com>
> > Tested-by: Xiao Ni <xni@...hat.com>
> > ---
> >  drivers/base/devtmpfs.c | 20 ++++++++------------
> >  1 file changed, 8 insertions(+), 12 deletions(-)
> 
> ...
> 
> > @@ -330,11 +329,8 @@ static int handle_remove(const char *nodename, struct device *dev)
> >  	if (IS_ERR(dentry))
> >  		return PTR_ERR(dentry);
> >  
> > -	p.mnt = parent.mnt;
> > -	p.dentry = dentry;
> > -	err = vfs_getattr(&p, &stat, STATX_TYPE | STATX_MODE,
> > -			  AT_STATX_SYNC_AS_STAT);
> > -	if (!err && dev_mynode(dev, d_inode(dentry), &stat)) {
> > +	inode = d_inode(dentry);
> > +	if (dev_mynode(dev, inode)) {
> 
> clang rightfully complains:
> 
>     CC      drivers/base/devtmpfs.o
>       drivers/base/devtmpfs.c:333:6: warning: variable 'err' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized]
>         333 |         if (dev_mynode(dev, inode)) {
>             |             ^~~~~~~~~~~~~~~~~~~~~~
>       drivers/base/devtmpfs.c:358:9: note: uninitialized use occurs here
>         358 |         return err;
>             |                ^~~
>       drivers/base/devtmpfs.c:333:2: note: remove the 'if' if its condition is always true
>         333 |         if (dev_mynode(dev, inode)) {
>             |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~
>       drivers/base/devtmpfs.c:326:9: note: initialize the variable 'err' to silence this warning
>         326 |         int err;
>             |                ^
>             |                 = 0
> 
> That is: if dev_mynode(dev, inode) is not true some random value will be returned.

Don't bother resending, Christoph.
I've already fixed this with int err = 0 in the tree.