On Fri, 12 Nov 2021 at 01:32, Dave Chinner <david@xxxxxxxxxxxxx> wrote:
>
> On Thu, Nov 11, 2021 at 11:39:30AM +0800, Ian Kent wrote:
> > When following a trailing symlink in rcu-walk mode it's possible to
> > succeed in getting the ->get_link() method pointer but the link path
> > string be deallocated while it's being used.
> >
> > Utilize the rcu mechanism to mitigate this risk.
> >
> > Suggested-by: Miklos Szeredi <miklos@xxxxxxxxxx>
> > Signed-off-by: Ian Kent <raven@xxxxxxxxxx>
> > ---
> > fs/xfs/kmem.h | 4 ++++
> > fs/xfs/xfs_inode.c | 4 ++--
> > fs/xfs/xfs_iops.c | 10 ++++++++--
> > 3 files changed, 14 insertions(+), 4 deletions(-)
> >
> > diff --git a/fs/xfs/kmem.h b/fs/xfs/kmem.h
> > index 54da6d717a06..c1bd1103b340 100644
> > --- a/fs/xfs/kmem.h
> > +++ b/fs/xfs/kmem.h
> > @@ -61,6 +61,10 @@ static inline void kmem_free(const void *ptr)
> > {
> > kvfree(ptr);
> > }
> > +static inline void kmem_free_rcu(const void *ptr)
> > +{
> > + kvfree_rcu(ptr);
> > +}
> >
> >
> > static inline void *
> > diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
> > index a4f6f034fb81..aaa1911e61ed 100644
> > --- a/fs/xfs/xfs_inode.c
> > +++ b/fs/xfs/xfs_inode.c
> > @@ -2650,8 +2650,8 @@ xfs_ifree(
> > * already been freed by xfs_attr_inactive.
> > */
> > if (ip->i_df.if_format == XFS_DINODE_FMT_LOCAL) {
> > - kmem_free(ip->i_df.if_u1.if_data);
> > - ip->i_df.if_u1.if_data = NULL;
> > + kmem_free_rcu(ip->i_df.if_u1.if_data);
> > + RCU_INIT_POINTER(ip->i_df.if_u1.if_data, NULL);
> > ip->i_df.if_bytes = 0;
> > }
>
> How do we get here in a way that the VFS will walk into this inode
> during a lookup?
>
> I mean, the dentry has to be validated and held during the RCU path
> walk, so if we are running a transaction to mark the inode as free
> here it has already been unlinked and the dentry turned
> negative. So anything that is doing a lockless pathwalk onto that
> dentry *should* see that it is a negative dentry at this point and
> hence nothing should be walking any further or trying to access the
> link that was shared from ->get_link().
>
> AFAICT, that's what the sequence check bug you fixed in the previous
> patch guarantees. It makes no difference if the unlinked inode has
> been recycled or not, the lookup race condition is the same in that
> the inode has gone through ->destroy_inode and is now owned by the
> filesystem and not the VFS.
Yes, the concern here is that without locking all the above can
theoretically happen between the sequence number check and if_data
being dereferenced.
> Otherwise, it might just be best to memset the buffer to zero here
> rather than free it, and leave it to be freed when the inode is
> freed from the RCU callback in xfs_inode_free_callback() as per
> normal.
My suggestion was to use .free_inode instead of .destroy_inode, the
former always being called after an RCU grace period.
Thanks,
Miklos
