linux-stable.git/fs/configfs, branch linux-3.4.y

configfs: fix race between dentry put and lookup

2013-11-29T18:50:37+00:00

commit 76ae281f6307331aa063288edb6422ae99f435f0 upstream.

A race window in configfs, it starts from one dentry is UNHASHED and end
before configfs_d_iput is called.  In this window, if a lookup happen,
since the original dentry was UNHASHED, so a new dentry will be
allocated, and then in configfs_attach_attr(), sd->s_dentry will be
updated to the new dentry.  Then in configfs_d_iput(),
BUG_ON(sd->s_dentry != dentry) will be triggered and system panic.

sys_open:                     sys_close:
 ...                           fput
                                dput
                                 dentry_kill
                                  __d_drop <--- dentry unhashed here,
                                           but sd->dentry still point
                                           to this dentry.

 lookup_real
  configfs_lookup
   configfs_attach_attr---> update sd->s_dentry
                            to new allocated dentry here.

                                   d_kill
                                     configfs_d_iput <--- BUG_ON(sd->s_dentry != dentry)
                                                     triggered here.

To fix it, change configfs_d_iput to not update sd->s_dentry if
sd->s_count > 2, that means there are another dentry is using the sd
beside the one that is going to be put.  Use configfs_dirent_lock in
configfs_attach_attr to sync with configfs_d_iput.

With the following steps, you can reproduce the bug.

1. enable ocfs2, this will mount configfs at /sys/kernel/config and
   fill configure in it.

2. run the following script.
	while [ 1 ]; do cat /sys/kernel/config/cluster/$your_cluster_name/idle_timeout_ms > /dev/null; done &
	while [ 1 ]; do cat /sys/kernel/config/cluster/$your_cluster_name/idle_timeout_ms > /dev/null; done &

Signed-off-by: Junxiao Bi 
Cc: Joel Becker 
Cc: Al Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

make configfs_pin_fs() return root dentry on success

2012-03-21T01:29:48+00:00

... and make configfs_mnt static

Signed-off-by: Al Viro

configfs: configfs_create_dir() has parent dentry in dentry->d_parent

2012-03-21T01:29:47+00:00

no need to play sick games with parent item, internal mount, etc.

Signed-off-by: Al Viro

configfs: sanitize configfs_create()

2012-03-21T01:29:47+00:00

Signed-off-by: Al Viro

configfs: kill configfs_sb

2012-03-21T01:29:47+00:00

Signed-off-by: Al Viro

configfs: don't bother with checks for mkdir/rmdir/unlink/symlink in root

2012-03-21T01:29:46+00:00

just give root directory separate inode_operations without all those
methods...

Signed-off-by: Al Viro

switch open-coded instances of d_make_root() to new helper

2012-03-21T01:29:35+00:00

Signed-off-by: Al Viro

configfs: convert to umode_t

2012-01-04T03:54:57+00:00

Signed-off-by: Al Viro

switch vfs_mkdir() and ->mkdir() to umode_t

2012-01-04T03:54:53+00:00

vfs_mkdir() gets int, but immediately drops everything that might not
fit into umode_t and that's the only caller of ->mkdir()...

Signed-off-by: Al Viro

vfs: live vfsmounts never have NULL ->mnt_sb

2012-01-04T03:52:42+00:00

Signed-off-by: Al Viro