From patchwork Fri Jan 8 13:50:09 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Layton X-Patchwork-Id: 7986081 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 67BD39F1CC for ; Fri, 8 Jan 2016 13:51:38 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 473FD201C0 for ; Fri, 8 Jan 2016 13:51:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 462E62017E for ; Fri, 8 Jan 2016 13:51:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755164AbcAHNu1 (ORCPT ); Fri, 8 Jan 2016 08:50:27 -0500 Received: from mail-qg0-f67.google.com ([209.85.192.67]:32812 "EHLO mail-qg0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755107AbcAHNuY (ORCPT ); Fri, 8 Jan 2016 08:50:24 -0500 Received: by mail-qg0-f67.google.com with SMTP id o11so31600109qge.0 for ; Fri, 08 Jan 2016 05:50:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=poochiereds-net.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=G+bVDjOfwMjWAxuMGjvPynOAvVSCXiJ8G7tO34xe5f0=; b=Ld8dp/Vcj/M07gU1+A1IV6FJ5udzgubg5zw6KASfZfoI/ENhfH5lIHG8lSHqYbW/6g Kxu9fp9OJ09bO1cqIUOo84nw/XFEXou9dLFy0Ov9sp6pSTDmHb8YYEn3AxRxb2BUW7DW sXa/2z6LAZWlYiP4OtfIjGCb/saJu0JbRaKN3dDD22NYA7w68xyMO3RUkUtcZrbpzHm9 cRtfojOPFXO/YcbW351KuRQamSz9eNIr7vpmc7UAhi0GxnHvCCwgJcdQUoyoybkxwf49 jK01SGnixSEFi3lP0lNFWAEZ3GW9GWSls0VtAwpfgayBvUK2KqBbGp89wyFv+WwuLEo+ 6aPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=G+bVDjOfwMjWAxuMGjvPynOAvVSCXiJ8G7tO34xe5f0=; b=T9c91K4hZpJgDOpC1cRZw459hhE8wmLxxCwkDRQrHlBwpFNCdaEwAUM8tzwHYbfR2c 6YsAas0iYhT1eXerUFo51SaYqhaCT3a1mcULVeDDuKs7ga7zzUKUnZ/oMfneG3xKLi2p aWRnkrEVN5nd+Oj7FmQqWJkYatzGvxWMwRCzXGyn9+J5Ivo0ClwXyDLVPoBzZzc5JNPO 0gHlmInQpRlDx3YRB5f77Sr7n99WrEEPvzq2BVsr+plyC/zkp6rDDt4xmg3j2QA7Bi2O 8VfJwQRcAx7sjL/MTAJSqYAW211xa+v679ZpQp7F77ruQgumTYqCsx+LqGkPDdBjZTBC Kr9w== X-Gm-Message-State: ALoCoQkdMN05rWZ8fGI2bp7x8bb8UPVKRJ9VJ5OM3tohq2+LJMahVqJsBMLUHdmGx1YaUa8kld4pmWmqdHMnJKMV5hO/YfpBNw== X-Received: by 10.140.98.197 with SMTP id o63mr145168633qge.43.1452261023865; Fri, 08 Jan 2016 05:50:23 -0800 (PST) Received: from tlielax.poochiereds.net ([2606:a000:1125:4075::d5a]) by smtp.googlemail.com with ESMTPSA id d188sm45848800qkb.9.2016.01.08.05.50.22 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 08 Jan 2016 05:50:23 -0800 (PST) From: Jeff Layton X-Google-Original-From: Jeff Layton To: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Dmitry Vyukov , "J. Bruce Fields" , Alexander Viro , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin , Eric Dumazet Subject: [PATCH v2 1/6] locks: fix unlock when fcntl_setlk races with a close Date: Fri, 8 Jan 2016 08:50:09 -0500 Message-Id: <1452261014-1682-2-git-send-email-jeff.layton@primarydata.com> X-Mailer: git-send-email 2.5.0 In-Reply-To: <1452261014-1682-1-git-send-email-jeff.layton@primarydata.com> References: <1452219742-18507-1-git-send-email-jeff.layton@primarydata.com> <1452261014-1682-1-git-send-email-jeff.layton@primarydata.com> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Dmitry reported that he was able to reproduce the WARN_ON_ONCE that fires in locks_free_lock_context when the flc_posix list isn't empty. The problem turns out to be that we're basically rebuilding the file_lock from scratch in fcntl_setlk when we discover that the setlk has raced with a close. If the l_whence field is SEEK_CUR or SEEK_END, then we may end up with fl_start and fl_end values that differ from when the lock was initially set, if the file position or length of the file has changed in the interim. Fix this by just reusing the same lock request structure, and simply override fl_type value with F_UNLCK as appropriate. That ensures that we really are unlocking the lock that was initially set. While we're there, make sure that we do pop a WARN_ON_ONCE if the removal ever fails. Also return -EBADF in this event, since that's what we would have returned if the close had happened earlier. Cc: "J. Bruce Fields" Cc: Alexander Viro Cc: Fixes: c293621bbf67 (stale POSIX lock handling) Reported-by: Dmitry Vyukov Signed-off-by: Jeff Layton --- fs/locks.c | 51 ++++++++++++++++++++++++++++++--------------------- 1 file changed, 30 insertions(+), 21 deletions(-) diff --git a/fs/locks.c b/fs/locks.c index 593dca300b29..c263aff793bc 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2181,7 +2181,6 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, goto out; } -again: error = flock_to_posix_lock(filp, file_lock, &flock); if (error) goto out; @@ -2223,19 +2222,22 @@ again: * Attempt to detect a close/fcntl race and recover by * releasing the lock that was just acquired. */ - /* - * we need that spin_lock here - it prevents reordering between - * update of i_flctx->flc_posix and check for it done in close(). - * rcu_read_lock() wouldn't do. - */ - spin_lock(¤t->files->file_lock); - f = fcheck(fd); - spin_unlock(¤t->files->file_lock); - if (!error && f != filp && flock.l_type != F_UNLCK) { - flock.l_type = F_UNLCK; - goto again; + if (!error && file_lock->fl_type != F_UNLCK) { + /* + * We need that spin_lock here - it prevents reordering between + * update of i_flctx->flc_posix and check for it done in + * close(). rcu_read_lock() wouldn't do. + */ + spin_lock(¤t->files->file_lock); + f = fcheck(fd); + spin_unlock(¤t->files->file_lock); + if (f != filp) { + file_lock->fl_type = F_UNLCK; + error = do_lock_file_wait(filp, cmd, file_lock); + WARN_ON_ONCE(error); + error = -EBADF; + } } - out: locks_free_lock(file_lock); return error; @@ -2321,7 +2323,6 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, goto out; } -again: error = flock64_to_posix_lock(filp, file_lock, &flock); if (error) goto out; @@ -2363,14 +2364,22 @@ again: * Attempt to detect a close/fcntl race and recover by * releasing the lock that was just acquired. */ - spin_lock(¤t->files->file_lock); - f = fcheck(fd); - spin_unlock(¤t->files->file_lock); - if (!error && f != filp && flock.l_type != F_UNLCK) { - flock.l_type = F_UNLCK; - goto again; + if (!error && file_lock->fl_type != F_UNLCK) { + /* + * We need that spin_lock here - it prevents reordering between + * update of i_flctx->flc_posix and check for it done in + * close(). rcu_read_lock() wouldn't do. + */ + spin_lock(¤t->files->file_lock); + f = fcheck(fd); + spin_unlock(¤t->files->file_lock); + if (f != filp) { + file_lock->fl_type = F_UNLCK; + error = do_lock_file_wait(filp, cmd, file_lock); + WARN_ON_ONCE(error); + error = -EBADF; + } } - out: locks_free_lock(file_lock); return error;