On Tue, Jul 24, 2018 at 06:17:26AM +0100, Al Viro wrote: > Do we have LOOKUP_RCU in nd->flags at that point? And how in hell > did we get that dentry there? In LOOKUP_RCU mode no freeing should > be happening until after we call rcu_read_unlock(), unless the final > dput() has happened before rcu_read_lock(). In which case we shouldn't > have gotten to that dentry in the first place. ... except that we never set DCACHE_RCUACCESS for root dentry. Which invalidates the normal "if we run into dentry in lazy mode, its memory won't be freed until we drop rcu_read_lock"... d_make_root() definitely needs to set DCACHE_RCUACCESS; whether it's all there is or you are hitting something else is a separate question, of course... > And in non-LOOKUP_RCU > mode we are bloody well holding references to everything (vfsmount > and dentry alike), so that deactivate_super() shouldn't have been > called as long as we are holding that reference. > > Details, please. Ideally - how to reproduce that. Is there any way to tell KASAN that we want a crashdump triggered? That would've been really useful for post-mortems...
