From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f46.google.com (mail-ej1-f46.google.com [209.85.218.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 67C00347BDB for ; Mon, 20 Apr 2026 14:00:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776693661; cv=none; b=F2hqoV0ywR7jdBVOw0qSV1rH5ZTIREPvgbqs+hI5tzra6pksEvD/HOMAHpl3GC0y1oHs38zvTdonOMOF0JMvGnqm/LeB0oO7Ip/KdQw8xPkpeyE/pt4iAH8d+lyJq78kRqz0p5iHYQmz3VP/oEdGHk1rNvSQV/snt1K8Ws5Zj5A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776693661; c=relaxed/simple; bh=GeIwoHKdIt3lRMHRpv38Y59HbZX122pNjvfE2Ot3KkY=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=p7UH5fYET/6ZEAXSbg0WzVHS/kRCX7SXCTSYxpjUDKWpPO+6bqUhTwCU93GCMnfHOUylSMUtbPcbpzF7igUNE5rlC+13ED0NJaUlizOXHkZvJiHAa7zKQdX3RFv89etE1taNTL816y1/RNuMTeveWAS64Q5GnemKXp1nXeVmego= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IuqIb4/4; arc=none smtp.client-ip=209.85.218.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IuqIb4/4" Received: by mail-ej1-f46.google.com with SMTP id a640c23a62f3a-b9e00649769so435444866b.3 for ; Mon, 20 Apr 2026 07:00:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776693658; x=1777298458; darn=vger.kernel.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:from:to :cc:subject:date:message-id:reply-to; bh=GDU0CUYIgdPj6T6zTg/0YVXUe6jDtdkR+wmRebePUmA=; b=IuqIb4/4shVWThfChaK77dU4EFVNLIeFbOUEaZJV1IhLKe41JYWecKadjpMjM1xMOw XKz/4nJEFcatEPbFNgEqBEvf9uG87K+V+TT207JcnySJeSbr7s4uosTBl1wotVOHMo13 QBPnsmDAFlJWFCgJoVJUKH6uwBmYwez0yL4sGn0JkfwRFuHbye98xR+Qfu1IELcRbiLz hO2/Nw1Ie1Ay2p9vGc5frNSQgbEpnIdO7Myez2MW7qmih79wnCRGpsb2ZLGsjK65jZ+W SFKeQwVJ89+Sk8+DfCJdquiIaG8mZBW3zyHMrO8fFZbUU3S5SDnVjhP+fcyWJjJ3dsnq lRBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776693658; x=1777298458; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=GDU0CUYIgdPj6T6zTg/0YVXUe6jDtdkR+wmRebePUmA=; b=aeZGIvLTTH1hxMYEPi+qnYRkOLNub3mc2UCzyzHt0NxGXx2fDNMjuqSR5V02NUrP9I ead8pFIXdasShu9ae/xzJXre/bx2dwE1HQAKV9oQrxrXFGUTfClYX35sDONIoY9aboKO j8hZnHr8xUWE7DyoBg81cOWLQZnM8pANkG3o4s54+KqLrytJ37YU+J6HP/bX3YF9Y1UL fxGwFPh1jp1pwIrZzgeUMRJ1OAljYcvblBG+xMTxUUV9yvSBMaBEvDNFJKRC5RVIpVhz drofqPPFtHwta/fnI0cBXzdW9eB63eJEjM4HVEqCw1/SvaX49ltFYV7zjD1/b3nXR8RO UWdg== X-Forwarded-Encrypted: i=1; AFNElJ9EMwqd/gGwybaOKwLWTZvjoaLEumqf5R7hoIhUGyHy4nKOyQGywm+B0pQrcZPLJFZnv1nlvrSVdcUbfSk=@vger.kernel.org X-Gm-Message-State: AOJu0Yx/YqQ7ge3icCedozyZRF7kkhwKKP+W/U4Lhwm9ULtw0Enl2VJV BFtcD3zPdIdODmXlWQSpB+TYYucapvQpu2+gY3Ud33b9R8IIWO/Ovu8K X-Gm-Gg: AeBDieuI3mp9+MRDAwPFxu+NwUuKU+phvfBX16u+7jUOF7S5HhpgD5Jzr2xvvcX3FaU iCWw91bJyTI0Cz1FFbZkHD/56CLnnabyampKpuQJmVfVaIPR5BMLv5KUH6dlZAChpqQrHkqMp6G fNEQBjOXPd41yhF9w17u/p5nmVcivB75hufHo+5vXfu0WNfUMq9s39RHSlqCr5J9dxOR9ALsHEZ TKkgIZ2Cgr5mGujX7Y7LKIYygikTPrd+dxdZPgjbb0/N9jcSqkgrjvvV60Ei4DrdN/j6VVdpekq aCcSrjD7EddB8SGTrD2B3RkGzsmksDxRQNqclmVWYj0263h51/9HCu8qgfeS+RWh0MRpdKDpCAR WE4h9St3PMeQlyNHQYBbe9sz6/VcnXmKDATCgDn1OIaiBixtKhG9og19ifxfIVtxZPjBqNfbg6o xCWTrWz5Ko6UXcFpI+/UqWQWLBJrx92+X3EeOJK8EW3WtJgmRDsXwhbQc9YL1oOr4+SChXpNV1r WRVvOhHnsn3wT9I3+C/BhvgxleZCnNCUCJsR3o= X-Received: by 2002:a17:907:a0d6:b0:b98:595c:a76f with SMTP id a640c23a62f3a-ba418888cfdmr606545166b.16.1776693652814; Mon, 20 Apr 2026 07:00:52 -0700 (PDT) Received: from localhost (2001-1c00-570d-ee00-3beb-8da5-f727-16c5.cable.dynamic.v6.ziggo.nl. [2001:1c00:570d:ee00:3beb:8da5:f727:16c5]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-ba454d1bae2sm355617166b.36.2026.04.20.07.00.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Apr 2026 07:00:51 -0700 (PDT) Date: Mon, 20 Apr 2026 16:00:51 +0200 From: Amir Goldstein To: Xin Yin Cc: jack@suse.cz, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] fsnotify: fix inode reference leak in fsnotify_recalc_mask() Message-ID: References: <20260420064727.1760604-1-yinxin.x@bytedance.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: [fix Jan's cc] On Mon, Apr 20, 2026 at 03:33:30PM +0200, Amir Goldstein wrote: > On Mon, Apr 20, 2026 at 8:52 AM Xin Yin wrote: > > > > fsnotify_recalc_mask() fails to handle the return value of > > __fsnotify_recalc_mask(), which may return an inode pointer that needs > > to be released via fsnotify_drop_object() when the connector's HAS_IREF > > flag transitions from set to cleared. > > > > This manifests as a hung task with the following call trace: > > > > INFO: task umount:1234 blocked for more than 120 seconds. > > Call Trace: > > __schedule > > schedule > > fsnotify_sb_delete > > generic_shutdown_super > > kill_anon_super > > cleanup_mnt > > task_work_run > > do_exit > > do_group_exit > > > > The race window that triggers the iref leak: > > > > Thread A (adding mark) Thread B (removing mark) > > ────────────────────── ──────────────────────── > > fsnotify_add_mark_locked(): > > fsnotify_add_mark_list(): > > spin_lock(conn->lock) > > add mark_B(evictable) to list > > spin_unlock(conn->lock) > > return > > > > /* ---- gap: no lock held ---- */ > > > > fsnotify_detach_mark(mark_A): > > spin_lock(mark_A->lock) > > clear ATTACHED flag on mark_A > > spin_unlock(mark_A->lock) > > > > fsnotify_recalc_mask(): > > spin_lock(conn->lock) > > __fsnotify_recalc_mask(): > > /* mark_A skipped: ATTACHED cleared */ > > /* only mark_B(evictable) remains */ > > want_iref = false > > has_iref = true /* not yet cleared */ > > -> HAS_IREF transitions true -> false > > -> returns inode pointer > > spin_unlock(conn->lock) > > /* BUG: return value discarded! > > * iput() and fsnotify_put_sb_watched_objects() > > * are never called */ > > > > Hi Xin! > > Ouch! nasty one. > Very good analysis. > Do you also have a reproducer? > > > > Fix this by capturing the return value of __fsnotify_recalc_mask() and > > passing it to fsnotify_drop_object() after releasing the spinlock, which > > is the same pattern used in fsnotify_put_mark(). > > The fix looks correct, but I prefer for my mental model to keep > fsnotify_drop_object() in one place at the end of fsnotify_put_mark(). > > Please see the suggested (only sanity tested) patch. > > Thanks, > Amir. > > > > > > Fixes: c3638b5b1374 ("fsnotify: allow adding an inode mark without pinning inode") > > Signed-off-by: Xin Yin > > --- > > fs/notify/mark.c | 8 +++++++- > > 1 file changed, 7 insertions(+), 1 deletion(-) > > > > diff --git a/fs/notify/mark.c b/fs/notify/mark.c > > index c2ed5b11b0fe6..cc93fcc2c5a9c 100644 > > --- a/fs/notify/mark.c > > +++ b/fs/notify/mark.c > > @@ -283,6 +283,8 @@ static void fsnotify_conn_set_children_dentry_flags( > > fsnotify_set_children_dentry_flags(fsnotify_conn_inode(conn)); > > } > > > > +static void fsnotify_drop_object(unsigned int type, void *objp); > > + > > /* > > * Calculate mask of events for a list of marks. The caller must make sure > > * connector and connector->obj cannot disappear under us. Callers achieve > > @@ -292,15 +294,19 @@ static void fsnotify_conn_set_children_dentry_flags( > > void fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) > > { > > bool update_children; > > + unsigned int type; > > + void *objp; > > > > if (!conn) > > return; > > > > spin_lock(&conn->lock); > > update_children = !fsnotify_conn_watches_children(conn); > > - __fsnotify_recalc_mask(conn); > > + objp = __fsnotify_recalc_mask(conn); > > + type = conn->type; > > update_children &= fsnotify_conn_watches_children(conn); > > spin_unlock(&conn->lock); > > + fsnotify_drop_object(type, objp); > > /* > > * Set children's PARENT_WATCHED flags only if parent started watching. > > * When parent stops watching, we clear false positive PARENT_WATCHED > > -- > > 2.20.1 > From 8cc3e7e2e75f5c93875bffce6bf8398d94398c33 Mon Sep 17 00:00:00 2001 > From: Amir Goldstein > Date: Mon, 20 Apr 2026 14:58:00 +0200 > Subject: [PATCH v2] fsnotify: fix inode reference leak in > fsnotify_recalc_mask() > MIME-Version: 1.0 > Content-Type: text/plain; charset=UTF-8 > Content-Transfer-Encoding: 8bit > > fsnotify_recalc_mask() fails to handle the return value of > __fsnotify_recalc_mask(), which may return an inode pointer that needs > to be released via fsnotify_drop_object() when the connector's HAS_IREF > flag transitions from set to cleared. > > This manifests as a hung task with the following call trace: > > INFO: task umount:1234 blocked for more than 120 seconds. > Call Trace: > __schedule > schedule > fsnotify_sb_delete > generic_shutdown_super > kill_anon_super > cleanup_mnt > task_work_run > do_exit > do_group_exit > > The race window that triggers the iref leak: > > Thread A (adding mark) Thread B (removing mark) > ────────────────────── ──────────────────────── > fsnotify_add_mark_locked(): > fsnotify_add_mark_list(): > spin_lock(conn->lock) > add mark_B(evictable) to list > spin_unlock(conn->lock) > return > > /* ---- gap: no lock held ---- */ > > fsnotify_detach_mark(mark_A): > spin_lock(mark_A->lock) > clear ATTACHED flag on mark_A > spin_unlock(mark_A->lock) > fsnotify_put_mark(mark_A) > > fsnotify_recalc_mask(): > spin_lock(conn->lock) > __fsnotify_recalc_mask(): > /* mark_A skipped: ATTACHED cleared */ > /* only mark_B(evictable) remains */ > want_iref = false > has_iref = true /* not yet cleared */ > -> HAS_IREF transitions true -> false > -> returns inode pointer > spin_unlock(conn->lock) > /* BUG: return value discarded! > * iput() and fsnotify_put_sb_watched_objects() > * are never called */ > > Fix this by deferring the transition true -> false of HAS_IREF flag from > fsnotify_recalc_mask() (Thread A) to fsnotify_put_mark() (thread B). > > Fixes: c3638b5b1374 ("fsnotify: allow adding an inode mark without pinning inode") > Signed-off-by: Xin Yin > Signed-off-by: Amir Goldstein > --- > fs/notify/mark.c | 39 ++++++++++++++++++++++++++++++++++++--- > 1 file changed, 36 insertions(+), 3 deletions(-) > > diff --git a/fs/notify/mark.c b/fs/notify/mark.c > index 622f05977f86a..e256b420100dc 100644 > --- a/fs/notify/mark.c > +++ b/fs/notify/mark.c > @@ -238,7 +238,12 @@ static struct inode *fsnotify_update_iref(struct fsnotify_mark_connector *conn, > return inode; > } > > -static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) > +/* > + * Calculate mask of events for a list of marks. > + * > + * Return true if any of the attached marks want to hold an inode reference. > + */ > +static bool __fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) > { > u32 new_mask = 0; > bool want_iref = false; > @@ -262,6 +267,34 @@ static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) > */ > WRITE_ONCE(*fsnotify_conn_mask_p(conn), new_mask); > > + return want_iref; > +} > + > +/* > + * Calculate mask of events for a list of marks after attach/modify mark > + * and get an inode reference for the connector if needed. > + * > + * A concurrent add of evictable mark and detach of non-evictable mark can > + * lead to __fsnotify_recalc_mask() returning false want_iref, but in this > + * case we defer clearing iref to fsnotify_recalc_mask_clear_iref() called > + * from fsnotify_put_mark(). > + */ > +static void fsnotify_recalc_mask_set_iref(struct fsnotify_mark_connector *conn) > +{ > + bool has_iref = conn->flags & FSNOTIFY_CONN_FLAG_HAS_IREF; > + bool want_iref = __fsnotify_recalc_mask(conn) || has_iref; > + > + (void) fsnotify_update_iref(conn, want_iref); > +} > + > +/* > + * Calculate mask of events for a list of marks after detach mark > + * and return the inode object if its reference is no longer needed. > + */ > +static void *fsnotify_recalc_mask_clear_iref(struct fsnotify_mark_connector *conn) > +{ > + bool want_iref = __fsnotify_recalc_mask(conn); > + > return fsnotify_update_iref(conn, want_iref); > } > > @@ -298,7 +331,7 @@ void fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) > > spin_lock(&conn->lock); > update_children = !fsnotify_conn_watches_children(conn); > - __fsnotify_recalc_mask(conn); > + fsnotify_recalc_mask_set_iref(conn); > update_children &= fsnotify_conn_watches_children(conn); > spin_unlock(&conn->lock); > /* > @@ -419,7 +452,7 @@ void fsnotify_put_mark(struct fsnotify_mark *mark) > /* Update watched objects after detaching mark */ > if (sb) > fsnotify_update_sb_watchers(sb, conn); > - objp = __fsnotify_recalc_mask(conn); > + objp = fsnotify_recalc_mask_clear_iref(conn); > type = conn->type; > } > WRITE_ONCE(mark->connector, NULL); > -- > 2.53.0 >