[PATCH] fs: fix bug that fput() may not have done to complete in flush_delayed_fput

[PATCH] fs: fix bug that fput() may not have done to complete in flush_delayed_fput

[shao.mingyin]

From: shao mingyin <shao.mingyin@zte.com.cn>

We find a bug that the rcS file may not be executed, resulting in module 
and business not being loaded. When trying to execute rcS, the fput() 
related to rcS has not done to complete, so deny_write_access() returns 
ETXTBSY.

rcS is opened in do_populate_rootfs before executed.
After flush_delayed_fput() has done to complete, do_populate_rootfs 
assumes that all fput() related to do_populate_rootfs has done to complete.
However, flush_delayed_fput can only ensure that the fput() on current 
delayed_fput_list has done to complete, the fput() that has already been 
removed from delayed_fput_list in advance may not be completed. Attempting
to execute the file associated with this fput() now will result in ETXTBSY.
Most of the time, the fput() related to rcS has done to complete in 
do_populate_rootfs before executing rcS, but sometimes it's not.

do_populate_rootfs	delayed_fput_list	delayed_fput	execve
fput()			a
fput()			a->b
fput()			a->b->rcS
						__fput(a)
fput()			c
fput()			c->d
						__fput(b)
flush_delayed_fput
__fput(c)
__fput(d)
						__fput(b)
						__fput(b)	execve(rcS)

in execve(rcS), deny_write_access(rcS) returns ETXTBSY because __fput(rcS) 
has not done to complete.

This patch can guarantee all fput() related to do_populate_rootfs has done 
to complete, and ensure that rcS can be executed successfully.

Signed-off-by: Chen Lin <chen.lin5@zte.com.cn>
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
Cc: Yang Yang <yang.yang29@zte.com.cn>
Cc: Yang Tao <yang.tao172@zte.com.cn>
Cc: Xu Xin <xu.xin16@zte.com.cn>
---
 fs/file_table.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/file_table.c b/fs/file_table.c
index eed5ffad9997..345e68caa4d7 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -462,6 +462,8 @@ static void ____fput(struct callback_head *work)
 	__fput(container_of(work, struct file, f_task_work));
 }

+static DECLARE_DELAYED_WORK(delayed_fput_work, delayed_fput);
+
 /*
  * If kernel thread really needs to have the final fput() it has done
  * to complete, call this.  The only user right now is the boot - we
@@ -475,11 +477,10 @@ static void ____fput(struct callback_head *work)
 void flush_delayed_fput(void)
 {
 	delayed_fput(NULL);
+	flush_delayed_work(&delayed_fput_work);
 }
 EXPORT_SYMBOL_GPL(flush_delayed_fput);

-static DECLARE_DELAYED_WORK(delayed_fput_work, delayed_fput);
-
 void fput(struct file *file)
 {
 	if (file_ref_put(&file->f_ref)) {
-- 
2.25.1

Re: [PATCH] boot: flush delayed work

[Christian Brauner]

On Wed, 23 Oct 2024 13:58:50 +0800, shao.mingyin@zte.com.cn wrote:
> We find a bug that the rcS file may not be executed, resulting in module
> and business not being loaded. When trying to execute rcS, the fput()
> related to rcS has not done to complete, so deny_write_access() returns
> ETXTBSY.
> 
> rcS is opened in do_populate_rootfs before executed.
> After flush_delayed_fput() has done to complete, do_populate_rootfs
> assumes that all fput() related to do_populate_rootfs has done to complete.
> However, flush_delayed_fput can only ensure that the fput() on current
> delayed_fput_list has done to complete, the fput() that has already been
> removed from delayed_fput_list in advance may not be completed. Attempting
> to execute the file associated with this fput() now will result in ETXTBSY.
> Most of the time, the fput() related to rcS has done to complete in
> do_populate_rootfs before executing rcS, but sometimes it's not.
> 
> [...]

Commit message rewritten by me.

---

Applied to the vfs-6.14.misc branch of the vfs/vfs.git tree.
Patches in the vfs-6.14.misc branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs-6.14.misc

[1/1] fs: fix bug that fput() may not have done to complete in flush_delayed_fput
      https://git.kernel.org/vfs/vfs/c/c0ef70cf7a91