iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Nicholas Bellinger a6d6282040 configfs: Fix race between create_link and configfs_rmdir 
commit ba80aa909c99802c428682c352b0ee0baac0acd3 upstream.

This patch closes a long standing race in configfs between
the creation of a new symlink in create_link(), while the
symlink target's config_item is being concurrently removed
via configfs_rmdir().

This can happen because the symlink target's reference
is obtained by config_item_get() in create_link() before
the CONFIGFS_USET_DROPPING bit set by configfs_detach_prep()
during configfs_rmdir() shutdown is actually checked..

This originally manifested itself on ppc64 on v4.8.y under
heavy load using ibmvscsi target ports with Novalink API:

[ 7877.289863] rpadlpar_io: slot U8247.22L.212A91A-V1-C8 added
[ 7879.893760] ------------[ cut here ]------------
[ 7879.893768] WARNING: CPU: 15 PID: 17585 at ./include/linux/kref.h:46 config_item_get+0x7c/0x90 [configfs]
[ 7879.893811] CPU: 15 PID: 17585 Comm: targetcli Tainted: G           O 4.8.17-customv2.22 #12
[ 7879.893812] task: c00000018a0d3400 task.stack: c0000001f3b40000
[ 7879.893813] NIP: d000000002c664ec LR: d000000002c60980 CTR: c000000000b70870
[ 7879.893814] REGS: c0000001f3b43810 TRAP: 0700   Tainted: G O     (4.8.17-customv2.22)
[ 7879.893815] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 28222242  XER: 00000000
[ 7879.893820] CFAR: d000000002c664bc SOFTE: 1
                GPR00: d000000002c60980 c0000001f3b43a90 d000000002c70908 c0000000fbc06820
                GPR04: c0000001ef1bd900 0000000000000004 0000000000000001 0000000000000000
                GPR08: 0000000000000000 0000000000000001 d000000002c69560 d000000002c66d80
                GPR12: c000000000b70870 c00000000e798700 c0000001f3b43ca0 c0000001d4949d40
                GPR16: c00000014637e1c0 0000000000000000 0000000000000000 c0000000f2392940
                GPR20: c0000001f3b43b98 0000000000000041 0000000000600000 0000000000000000
                GPR24: fffffffffffff000 0000000000000000 d000000002c60be0 c0000001f1dac490
                GPR28: 0000000000000004 0000000000000000 c0000001ef1bd900 c0000000f2392940
[ 7879.893839] NIP [d000000002c664ec] config_item_get+0x7c/0x90 [configfs]
[ 7879.893841] LR [d000000002c60980] check_perm+0x80/0x2e0 [configfs]
[ 7879.893842] Call Trace:
[ 7879.893844] [c0000001f3b43ac0] [d000000002c60980] check_perm+0x80/0x2e0 [configfs]
[ 7879.893847] [c0000001f3b43b10] [c000000000329770] do_dentry_open+0x2c0/0x460
[ 7879.893849] [c0000001f3b43b70] [c000000000344480] path_openat+0x210/0x1490
[ 7879.893851] [c0000001f3b43c80] [c00000000034708c] do_filp_open+0xfc/0x170
[ 7879.893853] [c0000001f3b43db0] [c00000000032b5bc] do_sys_open+0x1cc/0x390
[ 7879.893856] [c0000001f3b43e30] [c000000000009584] system_call+0x38/0xec
[ 7879.893856] Instruction dump:
[ 7879.893858] 409d0014 38210030 e8010010 7c0803a6 4e800020 3d220000 e94981e0 892a0000
[ 7879.893861] 2f890000 409effe0 39200001 992a0000 <0fe00000> 4bffffd0 60000000 60000000
[ 7879.893866] ---[ end trace 14078f0b3b5ad0aa ]---

To close this race, go ahead and obtain the symlink's target
config_item reference only after the existing CONFIGFS_USET_DROPPING
check succeeds.

This way, if configfs_rmdir() wins create_link() will return -ENONET,
and if create_link() wins configfs_rmdir() will return -EBUSY.

Reported-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
Tested-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-24 07:11:12 +02:00
..
9p
9p: fix a potential acl leak
2017-05-14 14:00:13 +02:00
adfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
affs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
afs
fs: Better permission checking for submounts
2017-03-15 10:02:44 +08:00
autofs4
fs: Better permission checking for submounts
2017-03-15 10:02:44 +08:00
befs
befs fixes for 4.9-rc1
2016-10-15 12:09:13 -07:00
bfs
Merge remote-tracking branch 'ovl/rename2' into for-linus
2016-10-10 23:02:51 -04:00
btrfs
btrfs: fix memory leak in update_space_info failure path
2017-06-14 15:06:02 +02:00
cachefiles
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
ceph
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
cifs
CIFS: add misssing SFM mapping for doublequote
2017-05-20 14:28:40 +02:00
coda
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
configfs
configfs: Fix race between create_link and configfs_rmdir
2017-06-24 07:11:12 +02:00
cramfs
…
crypto
fscrypt: avoid collisions when presenting long encrypted filenames
2017-05-25 15:44:38 +02:00
debugfs
fs: Better permission checking for submounts
2017-03-15 10:02:44 +08:00
devpts
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
dlm
dlm: free workqueues after the connections
2016-10-10 09:54:00 -05:00
ecryptfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
efivarfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
efs
…
exofs
fs: exofs: print a hex number after a 0x prefix
2016-10-27 18:43:43 -07:00
exportfs
exportfs: be careful to only return expected errors.
2016-10-06 09:07:44 -04:00
ext2
ext2: avoid bogus -Wmaybe-uninitialized warning
2016-10-18 11:29:35 +02:00
ext4
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
f2fs
fscrypt: avoid collisions when presenting long encrypted filenames
2017-05-25 15:44:38 +02:00
fat
fat: fix using uninitialized fields of fat_inode/fsinfo_inode
2017-03-15 10:02:52 +08:00
freevxfs
…
fscache
FS-Cache: Initialise stores_lock in netfs cookie
2017-06-17 06:41:52 +02:00
fuse
fuse: add missing FR_FORCE
2017-03-12 06:41:47 +01:00
gfs2
gfs2: Use rhashtable walk interface in glock_hash_walk
2017-06-17 06:41:50 +02:00
hfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
hfsplus
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
hostfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
hpfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
hugetlbfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
isofs
isofs: add KERN_CONT to printing of ER records
2016-11-30 10:41:26 -08:00
jbd2
jbd2: don't leak memory if setting up journal fails
2017-03-30 09:41:27 +02:00
jffs2
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
jfs
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
kernfs
kernfs: Add noop_fsync to supported kernfs_file_fops
2016-10-27 17:47:11 +02:00
lockd
treewide: remove redundant #include <linux/kconfig.h>
2016-10-11 15:06:33 -07:00
logfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
minix
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
ncpfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
nfs
nfs: Fix "Don't increment lock sequence ID after NFS4ERR_MOVED"
2017-06-17 06:41:55 +02:00
nfs_common
…
nfsd
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
nilfs2
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
nls
…
notify
fanotify: don't expose EOPENSTALE to userspace
2017-05-25 15:44:31 +02:00
ntfs
fs: remove the never implemented aio_fsync file operation
2016-10-30 13:09:42 -04:00
ocfs2
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
omfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
openpromfs
fs: Replace CURRENT_TIME with current_time() for inode timestamps
2016-09-27 21:06:21 -04:00
orangefs
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
overlayfs
ovl: fix d_real() for stacked fs
2016-11-29 10:20:24 +01:00
proc
proc: add a schedule point in proc_pid_readdir()
2017-06-17 06:41:56 +02:00
pstore
pstore: Shut down worker when unregistering
2017-05-20 14:28:42 +02:00
qnx4
…
qnx6
…
quota
quota: fill in Q_XGETQSTAT inode information for inactive quotas
2016-08-15 17:43:31 +02:00
ramfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
reiserfs
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
romfs
romfs: use different way to generate fsid for BLOCK or MTD
2017-06-17 06:41:56 +02:00
squashfs
vfs: Remove {get,set,remove}xattr inode operations
2016-10-07 21:48:36 -04:00
sysfs
sysfs: be careful of error returns from ops->show()
2017-04-12 12:41:11 +02:00
sysv
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
tracefs
fs: Replace CURRENT_TIME with current_time() for inode timestamps
2016-09-27 21:06:21 -04:00
ubifs
ubifs: Fix O_TMPFILE corner case in ubifs_link()
2017-04-27 09:10:38 +02:00
udf
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
ufs
ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path
2017-06-14 15:06:01 +02:00
xfs
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
aio.c
aio: fix freeze protection of aio writes
2016-10-30 13:09:42 -04:00
anon_inodes.c
…
attr.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
bad_inode.c
bad_inode: add missing i_op initializers
2017-01-09 08:32:24 +01:00
binfmt_aout.c
…
binfmt_elf_fdpic.c
elf_fdpic_transfer_args_to_stack(): make it generic
2016-07-25 16:51:49 +10:00
binfmt_elf.c
x86/coredump: Use pr_reg size, rather that TIF_IA32 flag
2016-09-14 21:28:10 +02:00
binfmt_em86.c
fs/binfmt_em86.c: fix incompatible pointer type
2016-08-02 19:35:15 -04:00
binfmt_flat.c
binfmt_flat: allow compressed flat binary format to work on MMU systems
2016-07-28 13:29:12 +10:00
binfmt_misc.c
fs: Replace current_fs_time() with current_time()
2016-09-27 21:06:22 -04:00
binfmt_script.c
…
block_dev.c
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
buffer.c
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
char_dev.c
dax: define a unified inode/address_space for device-dax mappings
2016-08-23 22:58:51 -07:00
compat_binfmt_elf.c
…
compat_ioctl.c
fs: compat_ioctl: add pretimeout functions for watchdogs
2016-09-24 09:27:18 +02:00
compat.c
compat: remove compat_printk()
2016-09-27 21:20:53 -04:00
coredump.c
coredump: fix unfreezable coredumping task
2016-11-11 08:12:37 -08:00
dax.c
fs: break out of iomap_file_buffered_write on fatal signals
2017-02-09 08:08:31 +01:00
dcache.c
mnt: Protect the mountpoint hashtable with mount_lock
2017-01-19 20:18:03 +01:00
dcookies.c
…
direct-io.c
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
drop_caches.c
…
eventfd.c
…
eventpoll.c
…
exec.c
ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
2017-01-06 10:40:13 +01:00
fcntl.c
…
fhandle.c
…
file_table.c
…
file.c
fs/file: more unsigned file descriptors
2016-09-27 18:47:38 -04:00
filesystems.c
…
fs_pin.c
…
fs_struct.c
…
fs-writeback.c
mm, writeback: flush plugged IO in wakeup_flusher_threads()
2016-08-09 19:58:06 -06:00
inode.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
internal.h
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 13:04:49 -07:00
ioctl.c
vfs: cap dedupe request structure size at PAGE_SIZE
2016-09-15 13:29:52 -07:00
iomap.c
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
Kconfig
mm/hugetlb: introduce ARCH_HAS_GIGANTIC_PAGE
2016-10-07 18:46:29 -07:00
Kconfig.binfmt
ARM: 8594/1: enable binfmt_flat on systems with an MMU
2016-08-12 16:47:05 +01:00
libfs.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
locks.c
locking, fs/locks: Add missing file_sem locks
2016-10-18 12:21:28 +02:00
Makefile
fs: introduce iomap infrastructure
2016-06-21 09:23:11 +10:00
mbcache.c
mbcache: fix to detect failure of register_shrinker
2016-08-31 11:44:36 -04:00
mount.h
mnt: Tuck mounts under others instead of creating shadow/side mounts.
2017-03-15 10:02:43 +08:00
mpage.c
fs: add i_blocksize()
2017-06-14 15:06:00 +02:00
namei.c
fs: Better permission checking for submounts
2017-03-15 10:02:44 +08:00
namespace.c
fs: Better permission checking for submounts
2017-03-15 10:02:44 +08:00
no-block.c
…
nsfs.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
open.c
xfs: reflink update for 4.9-rc1
2016-10-13 20:28:22 -07:00
pipe.c
pipe: cap initial pipe capacity according to pipe-max-size limit
2016-10-11 15:06:32 -07:00
pnode.c
mnt: Tuck mounts under others instead of creating shadow/side mounts.
2017-03-15 10:02:43 +08:00
pnode.h
mnt: Tuck mounts under others instead of creating shadow/side mounts.
2017-03-15 10:02:43 +08:00
posix_acl.c
tmpfs: clear S_ISGID when setting posix ACLs
2017-01-26 08:24:37 +01:00
proc_namespace.c
…
read_write.c
fs: pass on flags in compat_writev
2017-06-24 07:11:12 +02:00
readdir.c
…
select.c
fs/select: add vmalloc fallback for select(2)
2016-10-11 15:06:30 -07:00
seq_file.c
seq/proc: modify seq_put_decimal_[u]ll to take a const char *, not char
2016-10-07 18:46:30 -07:00
signalfd.c
…
splice.c
vfs: fix uninitialized flags in splice_to_pipe()
2017-02-23 17:44:35 +01:00
stack.c
…
stat.c
ufs: restore maintaining ->i_blocks
2017-06-14 15:06:01 +02:00
statfs.c
…
super.c
fs: Better permission checking for submounts
2017-03-15 10:02:44 +08:00
sync.c
…
timerfd.c
timerfd: Protect the might cancel mechanism proper
2017-05-08 07:47:54 +02:00
userfaultfd.c
userfaultfd: fix SIGBUS resulting from false rwsem wakeups
2017-06-17 06:41:56 +02:00
utimes.c
Merge remote-tracking branch 'jk/vfs' into work.misc
2016-10-08 11:06:08 -04:00
xattr.c
fs/xattr.c: zero out memory copied to userspace in getxattr
2017-05-20 14:28:39 +02:00