linux-kernel - Re: [PATCH] fs: assert on ->i_count in iput

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <zvd5obgxrkbqeifnuvvvhhjeh7t4cveziipwoii3hjaztxytpa@qlcxp4l2r5jg>
Date: Wed, 1 Oct 2025 14:06:56 +0200
From: Jan Kara <jack@...e.cz>
To: Mateusz Guzik <mjguzik@...il.com>
Cc: brauner@...nel.org, viro@...iv.linux.org.uk, jack@...e.cz, 
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH] fs: assert on ->i_count in iput_final()

On Wed 01-10-25 03:00:10, Mateusz Guzik wrote:
> Notably make sure the count is 0 after the return from ->drop_inode(),
> provided we are going to drop.
> 
> Inspired by suspicious games played by f2fs.

Whoo, those are indeed interesting.

> Signed-off-by: Mateusz Guzik <mjguzik@...il.com>
> ---
> 
> boots on ext4 without splats
> 
>  fs/inode.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/fs/inode.c b/fs/inode.c
> index ec9339024ac3..fa82cb810af4 100644
> --- a/fs/inode.c
> +++ b/fs/inode.c
> @@ -1879,6 +1879,7 @@ static void iput_final(struct inode *inode)
>  	int drop;
>  
>  	WARN_ON(inode->i_state & I_NEW);
> +	VFS_BUG_ON_INODE(atomic_read(&inode->i_count) != 0, inode);

This seems pointless given when iput_final() is called...

>  	if (op->drop_inode)
>  		drop = op->drop_inode(inode);
> @@ -1893,6 +1894,12 @@ static void iput_final(struct inode *inode)
>  		return;
>  	}
>  
> +	/*
> +	 * Re-check ->i_count in case the ->drop_inode() hooks played games.
> +	 * Note we only execute this if the verdict was to drop the inode.
> +	 */
> +	VFS_BUG_ON_INODE(atomic_read(&inode->i_count) != 0, inode);
> +

I'm not sure this can catch much but OK...

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR