From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932346AbdJ3Nem (ORCPT ); Mon, 30 Oct 2017 09:34:42 -0400 Received: from mx2.suse.de ([195.135.220.15]:49081 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932213AbdJ3Nek (ORCPT ); Mon, 30 Oct 2017 09:34:40 -0400 Date: Mon, 30 Oct 2017 14:34:38 +0100 From: Jan Kara To: Miklos Szeredi Cc: linux-fsdevel@vger.kernel.org, Jan Kara , Amir Goldstein , Xiong Zhou , linux-kernel@vger.kernel.org Subject: Re: [PATCH v2 2/7] fsnotify: pin both inode and vfsmount mark Message-ID: <20171030133438.GK23278@quack2.suse.cz> References: <1508920899-8115-1-git-send-email-mszeredi@redhat.com> <1508920899-8115-3-git-send-email-mszeredi@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1508920899-8115-3-git-send-email-mszeredi@redhat.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed 25-10-17 10:41:34, Miklos Szeredi wrote: > We may fail to pin one of the marks in fsnotify_prepare_user_wait() when > dropping the srcu read lock, resulting in use after free at the next > iteration. > > Solution is to store both marks in iter_info instead of just the one we'll > be sending the event for. I'm sorry but I'm not getting it. Where exactly is use-after-free happening? And how come because if fsnotify_prepare_user_wait() fails to pin some mark, it does not drop SRCU and bails out, doesn't it? Honza > diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c > index 0c4583b61717..48ec61f4c4d5 100644 > --- a/fs/notify/fsnotify.c > +++ b/fs/notify/fsnotify.c > @@ -336,6 +336,9 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is, > vfsmount_group = vfsmount_mark->group; > } > > + iter_info.inode_mark = inode_mark; > + iter_info.vfsmount_mark = vfsmount_mark; > + > if (inode_group && vfsmount_group) { > int cmp = fsnotify_compare_groups(inode_group, > vfsmount_group); > @@ -348,9 +351,6 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is, > } > } > > - iter_info.inode_mark = inode_mark; > - iter_info.vfsmount_mark = vfsmount_mark; > - > ret = send_to_group(to_tell, inode_mark, vfsmount_mark, mask, > data, data_is, cookie, file_name, > &iter_info); > -- > 2.5.5 > -- Jan Kara SUSE Labs, CR