On Wed 25-10-17 10:41:36, Miklos Szeredi wrote:
> After having gone through a ref-unref for the mark, dereferencing the group
> (e.g. in fsnotify_compare_groups()) is wrong since the group may be
> completely gone by that time. So before continuing to traverse the mark
> list, check if the mark is still attached.
Are you sure this can happen? The thing is: Group reference from mark is
dropped only in fsnotify_final_mark_destroy(). That gets called after SRCU
period is finished from fsnotify_mark_destroy_workfn(). And SRCU period in
which we have dropped our mark reference in fsnotify_finish_user_wait() has
not yet ended. What am I missing?
Honza
> This is done in the generic case, not just when we go through
> fsnotify_prepare_user_wait()/fsnotify_finish_user_wait(), otherwise it
> would introduce unnecessary complexity. And it shouldn't hurt to skip
> unattached marks anyway ("flags" is very likely in same cacheline as
> neighbouring "ignored_mask", which is pulled in anyway).
>
> Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxxxxx>
> Fixes: 9385a84d7e1f ("fsnotify: Pass fsnotify_iter_info into handle_event handler")
> Cc: <stable@xxxxxxxxxxxxxxx> # v4.12
> ---
> fs/notify/fsnotify.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
> index 48ec61f4c4d5..0ab6a7179e4d 100644
> --- a/fs/notify/fsnotify.c
> +++ b/fs/notify/fsnotify.c
> @@ -328,12 +328,16 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
> inode_mark = hlist_entry(srcu_dereference(inode_node, &fsnotify_mark_srcu),
> struct fsnotify_mark, obj_list);
> inode_group = inode_mark->group;
> + if (!(inode_mark->flags & FSNOTIFY_MARK_FLAG_ATTACHED))
> + goto skip_inode;
> }
>
> if (vfsmount_node) {
> vfsmount_mark = hlist_entry(srcu_dereference(vfsmount_node, &fsnotify_mark_srcu),
> struct fsnotify_mark, obj_list);
> vfsmount_group = vfsmount_mark->group;
> + if (!(vfsmount_mark->flags & FSNOTIFY_MARK_FLAG_ATTACHED))
> + goto skip_vfsmount;
> }
>
> iter_info.inode_mark = inode_mark;
> @@ -357,10 +361,11 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
>
> if (ret && (mask & ALL_FSNOTIFY_PERM_EVENTS))
> goto out;
> -
> +skip_inode:
> if (inode_group)
> inode_node = srcu_dereference(inode_node->next,
> &fsnotify_mark_srcu);
> +skip_vfsmount:
> if (vfsmount_group)
> vfsmount_node = srcu_dereference(vfsmount_node->next,
> &fsnotify_mark_srcu);
> --
> 2.5.5
>
--
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR
