From patchwork Wed Mar 19 19:06:46 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Herrmann X-Patchwork-Id: 3860361 Return-Path: X-Original-To: patchwork-dri-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 989289F334 for ; Wed, 19 Mar 2014 19:07:58 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 43E44201F5 for ; Wed, 19 Mar 2014 19:07:56 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 598EA20212 for ; Wed, 19 Mar 2014 19:07:55 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 3B9E489709; Wed, 19 Mar 2014 12:07:54 -0700 (PDT) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-bk0-f43.google.com (mail-bk0-f43.google.com [209.85.214.43]) by gabe.freedesktop.org (Postfix) with ESMTP id 290E689701 for ; Wed, 19 Mar 2014 12:07:51 -0700 (PDT) Received: by mail-bk0-f43.google.com with SMTP id v15so627969bkz.2 for ; Wed, 19 Mar 2014 12:07:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=NHbmhdKeK0StXPIRNIWdPmJhWbRanvvqI7KcQF4ZtdE=; b=GXGhsyTzUUhEUSuDu5p382uTdLd7NB1YRvtyg8FyZ6bN1fMFVOnYyAGQKwTyqqfeQY pEXHI6Mas/ggWEQi/JxsAuC2pyQff3pgFzgRgcjlheEv63vSOt5LRjzajC+nRCm7/R9P 6d5djHvn8OjhPRUea5WCStUu1Z+flcEilCGYkA31wyaJ5sTNte7t7q4xkPJdIz/2eQUt vy035qse5ADUyuDas5bLimGz0pNchnuDVhW+bvc86o+ZXkrRauE7CVum/IG8la8sOlwi rDLHSFM/UPA2uXmgUzu/s89CzhtcLULYN80VLp98uObU8pwkIDt5kt07TmDFX+me03Hs 7mbA== X-Received: by 10.205.36.133 with SMTP id ta5mr19043434bkb.28.1395256071214; Wed, 19 Mar 2014 12:07:51 -0700 (PDT) Received: from david-tp.localdomain (stgt-5f71aff2.pool.mediaWays.net. [95.113.175.242]) by mx.google.com with ESMTPSA id c15sm20566146bky.13.2014.03.19.12.07.48 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 19 Mar 2014 12:07:50 -0700 (PDT) From: David Herrmann To: linux-kernel@vger.kernel.org Subject: [PATCH 1/6] fs: fix i_writecount on shmem and friends Date: Wed, 19 Mar 2014 20:06:46 +0100 Message-Id: <1395256011-2423-2-git-send-email-dh.herrmann@gmail.com> X-Mailer: git-send-email 1.9.0 In-Reply-To: <1395256011-2423-1-git-send-email-dh.herrmann@gmail.com> References: <1395256011-2423-1-git-send-email-dh.herrmann@gmail.com> Cc: Matthew Wilcox , Ryan Lortie , Hugh Dickins , Johannes Weiner , Kay Sievers , dri-devel@lists.freedesktop.org, Daniel Mack , linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, Karol Lewandowski , Lennart Poettering , Greg Kroah-Hartman , Tejun Heo , "Michael Kerrisk \(man-pages\)" , Andrew Morton , Linus Torvalds , Alexander Viro X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP VM_DENYWRITE currently relies on i_writecount. Unless there's an active writable reference to an inode, VM_DENYWRITE is not allowed. Unfortunately, alloc_file() does not increase i_writecount, therefore, does not prevent a following VM_DENYWRITE even though the new file might have been opened with FMODE_WRITE. However, callers of alloc_file() expect the file object to be fully instantiated so they can call fput() on it. We could now either fix all callers to do an get_write_access() if opened with FMODE_WRITE, or simply fix alloc_file() to do that. I chose the latter. Note that this bug allows some rather subtle misbehavior. The following sequence of calls should work just fine, but currently fails: int p[2], orig, ro, rw; char buf[128]; pipe(p); sprintf(buf, "/proc/self/fd/%d", p[1]); ro = open(buf, O_RDONLY); close(p[1]); sprintf(buf, "/proc/self/fd/%d", ro); rw = open(buf, O_RDWR); The final open() cannot succeed as close(p[1]) caused an integer underflow on i_writecount, effectively causing VM_DENYWRITE on the inode. The open will fail with -ETXTBUSY. It's a rather odd sequence of calls and given that open() doesn't use alloc_file() (and thus not affected by this bug), it's rather unlikely that this is a serious issue. But stuff like anon_inode shares a *single* inode across a huge set of interfaces. If any of these is broken like pipe(), it will affect all of these (ranging from dma-buf to epoll). Signed-off-by: David Herrmann --- Hi This patch is only included for reference. It was submitted to fs-devel separately and is being worked on. However, this bug must be fixed in order to make use of memfd_create(), so I decided to include it here. David fs/file_table.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/fs/file_table.c b/fs/file_table.c index 5b24008..8059d68 100644 --- a/fs/file_table.c +++ b/fs/file_table.c @@ -168,6 +168,7 @@ struct file *alloc_file(struct path *path, fmode_t mode, const struct file_operations *fop) { struct file *file; + int error; file = get_empty_filp(); if (IS_ERR(file)) @@ -179,15 +180,23 @@ struct file *alloc_file(struct path *path, fmode_t mode, file->f_mode = mode; file->f_op = fop; - /* - * These mounts don't really matter in practice - * for r/o bind mounts. They aren't userspace- - * visible. We do this for consistency, and so - * that we can do debugging checks at __fput() - */ - if ((mode & FMODE_WRITE) && !special_file(path->dentry->d_inode->i_mode)) { - file_take_write(file); - WARN_ON(mnt_clone_write(path->mnt)); + if (mode & FMODE_WRITE) { + error = get_write_access(path->dentry->d_inode); + if (error) { + put_filp(file); + return ERR_PTR(error); + } + + /* + * These mounts don't really matter in practice + * for r/o bind mounts. They aren't userspace- + * visible. We do this for consistency, and so + * that we can do debugging checks at __fput() + */ + if (!special_file(path->dentry->d_inode->i_mode)) { + file_take_write(file); + WARN_ON(mnt_clone_write(path->mnt)); + } } if ((mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) i_readcount_inc(path->dentry->d_inode);