| Message ID | 20230111161934.336743-1-code@siddh.me (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Headers | show |
| Series | [v4] kernel/watch_queue: NULL the dangling *pipe, and use it for clear check | expand |
Seems reasonable. Have you run it with the keyutils testsuite? David
On Wed, 11 Jan 2023 22:07:28 +0530, David Howells wrote: > Seems reasonable. Have you run it with the keyutils testsuite? > > David I had not, but I did now. I first ran all the keyctl tests with ./runtest.sh keyctl/**/* All of them passsed. Log: https://pastebin.com/PBm6h5E2 All tests in tests/ pass except features/builtin_trusted, which fails even without the patch. (Failure log: https://pastebin.com/SGgAbzXp) Thanks, Siddh
Siddh Raman Pant <code@siddh.me> wrote: > All tests in tests/ pass except features/builtin_trusted, which > fails even without the patch. (Failure log: https://pastebin.com/SGgAbzXp) Don't worry about that one. That requires some kernel preparation. David
On Wed, 11 Jan 2023 23:50:20 +0530, David Howells wrote: > Siddh Raman Pant code@siddh.me> wrote: > > > All tests in tests/ pass except features/builtin_trusted, which > > fails even without the patch. (Failure log: https://pastebin.com/SGgAbzXp) > > Don't worry about that one. That requires some kernel preparation. > > David Hello, Please let me know if any changes are required. Context: https://lore.kernel.org/all/20230111161934.336743-1-code@siddh.me/ Thanks, Siddh
diff --git a/include/linux/watch_queue.h b/include/linux/watch_queue.h index fc6bba20273b..45cd42f55d49 100644 --- a/include/linux/watch_queue.h +++ b/include/linux/watch_queue.h @@ -38,7 +38,7 @@ struct watch_filter { struct watch_queue { struct rcu_head rcu; struct watch_filter __rcu *filter; - struct pipe_inode_info *pipe; /* The pipe we're using as a buffer */ + struct pipe_inode_info *pipe; /* Pipe we use as a buffer, NULL if queue closed */ struct hlist_head watches; /* Contributory watches */ struct page **notes; /* Preallocated notifications */ unsigned long *notes_bitmap; /* Allocation bitmap for notes */ @@ -46,7 +46,6 @@ struct watch_queue { spinlock_t lock; unsigned int nr_notes; /* Number of notes */ unsigned int nr_pages; /* Number of pages in notes[] */ - bool defunct; /* T when queues closed */ }; /* diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c index a6f9bdd956c3..6ead921c15c0 100644 --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -43,7 +43,7 @@ MODULE_LICENSE("GPL"); static inline bool lock_wqueue(struct watch_queue *wqueue) { spin_lock_bh(&wqueue->lock); - if (unlikely(wqueue->defunct)) { + if (unlikely(!wqueue->pipe)) { spin_unlock_bh(&wqueue->lock); return false; } @@ -105,9 +105,6 @@ static bool post_one_notification(struct watch_queue *wqueue, unsigned int head, tail, mask, note, offset, len; bool done = false; - if (!pipe) - return false; - spin_lock_irq(&pipe->rd_wait.lock); mask = pipe->ring_size - 1; @@ -603,8 +600,11 @@ void watch_queue_clear(struct watch_queue *wqueue) rcu_read_lock(); spin_lock_bh(&wqueue->lock); - /* Prevent new notifications from being stored. */ - wqueue->defunct = true; + /* + * This pipe can be freed by callers like free_pipe_info(). + * Removing this reference also prevents new notifications. + */ + wqueue->pipe = NULL; while (!hlist_empty(&wqueue->watches)) { watch = hlist_entry(wqueue->watches.first, struct watch, queue_node);
NULL the dangling pipe reference while clearing watch_queue. If not done, a reference to a freed pipe remains in the watch_queue, as this function is called before freeing a pipe in free_pipe_info() (see line 834 of fs/pipe.c). The sole use of wqueue->defunct is for checking if the watch queue has been cleared, but wqueue->pipe is also NULLed while clearing. Thus, wqueue->defunct is superfluous, as wqueue->pipe can be checked for NULL. Hence, the former can be removed. Signed-off-by: Siddh Raman Pant <code@siddh.me> --- Changes in v4: - Drop preceeding kerneldoc-changes patch and change appropriately. Changes in v3 (8 Jan 2023): - Minor rephrase of comment before NULLing in watch_queue_clear(). Changes in v2 (6 Aug 2022): - Merged the NULLing and removing defunct patches. - Removed READ_ONCE barrier in lock_wqueue(). - Better commit messages. include/linux/watch_queue.h | 3 +-- kernel/watch_queue.c | 12 ++++++------ 2 files changed, 7 insertions(+), 8 deletions(-)