From patchwork Thu May 7 16:52:41 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steven Rostedt X-Patchwork-Id: 6359651 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id A73BBBEEE1 for ; Thu, 7 May 2015 17:02:11 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A596620351 for ; Thu, 7 May 2015 17:02:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8951C2034E for ; Thu, 7 May 2015 17:02:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751661AbbEGRCF (ORCPT ); Thu, 7 May 2015 13:02:05 -0400 Received: from smtprelay0217.hostedemail.com ([216.40.44.217]:45960 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751127AbbEGRCE (ORCPT ); Thu, 7 May 2015 13:02:04 -0400 X-Greylist: delayed 559 seconds by postgrey-1.27 at vger.kernel.org; Thu, 07 May 2015 13:02:04 EDT Received: from smtprelay.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by smtpgrave04.hostedemail.com (Postfix) with ESMTP id 1560AB1F31 for ; Thu, 7 May 2015 16:52:47 +0000 (UTC) Received: from filter.hostedemail.com (unknown [216.40.38.60]) by smtprelay04.hostedemail.com (Postfix) with ESMTP id CD02E35224E; Thu, 7 May 2015 16:52:44 +0000 (UTC) X-Session-Marker: 726F737465647440676F6F646D69732E6F7267 X-Spam-Summary: 2, 0, 0, , d41d8cd98f00b204, rostedt@goodmis.org, :::::::, RULES_HIT:41:355:379:541:800:960:968:973:988:989:1260:1277:1311:1313:1314:1345:1437:1515:1516:1518:1534:1543:1593:1594:1711:1730:1747:1777:1792:2393:2559:2562:3138:3139:3140:3141:3142:3355:3865:3866:3867:3868:3870:3871:3872:3874:4250:4321:4605:5007:6117:6119:6238:6261:7903:8660:9040:9163:10004:10400:10848:11026:11658:11914:12043:12296:12438:12517:12519:12555:12679:12710:12737:12740:13148:13161:13229:13230:13870:14096:14097:14394:21080, 0, RBL:none, CacheIP:none, Bayesian:0.5, 0.5, 0.5, Netcheck:none, DomainCache:0, MSF:not bulk, SPF:fn, MSBL:0, DNSBL:none, Custom_rules:0:0:0 X-HE-Tag: ink19_51f547a32b606 X-Filterd-Recvd-Size: 4602 Received: from gandalf.local.home (cpe-67-246-153-56.stny.res.rr.com [67.246.153.56]) (Authenticated sender: rostedt@goodmis.org) by omf04.hostedemail.com (Postfix) with ESMTPA; Thu, 7 May 2015 16:52:43 +0000 (UTC) Date: Thu, 7 May 2015 12:52:41 -0400 From: Steven Rostedt To: Al Viro Cc: David Howells , LKML , linux-fsdevel@vger.kernel.org Subject: [PATCH] VFS: Add back check for !inode in walk_component() Message-ID: <20150507125241.4da739ac@gandalf.local.home> X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.25; x86_64-pc-linux-gnu) MIME-Version: 1.0 Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Commit 698934df8b45 "VFS: Combine inode checks with d_is_negative() and d_is_positive() in pathwalk" removed a check for inode being NULL in walk_component() where the type is tested. Stressing my tracefs create and remove instances while reading the files now triggers this: BUG: unable to handle kernel NULL pointer dereference at 0000001c IP: [] inode_permission+0x2d/0x6c *pdpt = 0000000030d9a001 *pde = 0000000000000000 Oops: 0000 [#1] SMP Modules linked in: ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables ipv6 microcode ppdev parport_pc parport r8169 CPU: 0 PID: 3201 Comm: ftrace-test-mki Not tainted 4.1.0-rc2-test+ #94 Hardware name: MSI MS-7823/CSM-H87M-G43 (MS-7823), BIOS V1.6 02/22/2014 task: efa2ac20 ti: ed7a8000 task.ti: ed7a8000 EIP: 0060:[] EFLAGS: 00010282 CPU: 0 EIP is at inode_permission+0x2d/0x6c EAX: 00000001 EBX: 00000000 ECX: 00000006 EDX: 00000081 ESI: 00000000 EDI: ef92201b EBP: ed7a9e0c ESP: ed7a9df8 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 CR0: 80050033 CR2: 0000001c CR3: 31cb4c20 CR4: 001407f0 Stack: c0538379 c101c228 00000000 00000081 ed7a9ef8 ed7a9e64 c0538c7e c0538c33 c1012e98 00000000 ed7a9ef8 00000000 00000006 efa2ac20 efa2ac20 e1919d01 00000000 c04767e1 ed7a9e64 c05374fb f1392210 ee3c0240 00000000 c05391b5 Call Trace: [] ? __inode_permission+0x91/0x91 [] link_path_walk+0x7a/0x3db [] ? link_path_walk+0x2f/0x3db [] ? trace_hardirqs_on+0xb/0xd [] ? read_seqcount_begin+0x6a/0x77 [] ? path_init+0x1d6/0x326 [] path_init+0x31a/0x326 [] ? link_path_walk+0x3db/0x3db [] ? get_empty_filp+0x128/0x190 [] path_openat+0x1a3/0x3da [] ? native_sched_clock+0x46/0x4b [] do_filp_open+0x2e/0x6f [] do_sys_open+0x7c/0x108 [] ? do_sys_open+0x43/0x108 [] ? sysenter_exit+0xf/0x16 [] SyS_open+0x20/0x22 [] sysenter_do_call+0x12/0x12 Code: e5 53 83 ec 10 3e 8d 74 26 00 89 c3 89 44 24 08 a1 d8 7b 25 c1 89 55 f8 c7 04 24 79 83 53 c0 89 44 24 04 e8 0e b0 f9 ff 8b 55 f8 <8b> 4b 1c f6 c2 02 74 2e f6 41 30 01 66 8b 03 74 25 25 00 f0 00 EIP: [] inode_permission+0x2d/0x6c SS:ESP 0068:ed7a9df8 CR2: 000000000000001c ---[ end trace 54b6a3ccfbef84c6 ]--- Adding a bunch of debug I found that the race is the following: CPU1 CPU2 ---- ---- mkdir(foo) d_instantiate(dentry, inode); spin_lock(inode->i_lock); spin_lock(dentry->d_lock); __d_set_inode_and_type(); link_path_walk() walk_component() lookup_fast(nd, path, &inode); *inode = path->d_entry->d_inode; (inode == NULL) dentry->d_inode = inode; smp_wmb(); dentry->d_flags = flags; if (d_is_negative(path->d_entry)) [ fails ] [...] nd->inode = inode; (where inode is NULL); Then in the next loop of link_path_walk() err = may_lookup(nd); inode_permission(nd->inode...) reference to nd->inode->i_sb (BOOM!) Without this patch I can easily cause the bug, with this patch, I have yet to trigger it. Cc: David Howells Signed-off-by: Steven Rostedt --- fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/namei.c b/fs/namei.c index 4a8d998b7274..cdd066680de9 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1585,7 +1585,7 @@ static inline int walk_component(struct nameidata *nd, struct path *path, inode = path->dentry->d_inode; } err = -ENOENT; - if (d_is_negative(path->dentry)) + if (!inode || d_is_negative(path->dentry)) goto out_path_put; if (should_follow_link(path->dentry, follow)) {