[adding lsm and selinux]
Am I just crazy, or was this bug discussed (and obviously not fixed)
some time ago?
VFS can still use inodes after security_inode_free_security() was
called...
On Thu, 2014-01-09 at 10:57 -0500, Eric Paris wrote:
> On Thu, 2014-01-09 at 10:51 -0500, Steven Rostedt wrote:
> > On Thu, 9 Jan 2014 10:31:55 -0500
> > Eric Paris <eparis@xxxxxxxxxxxxxx> wrote:
> >
> > > Didn't Al find this/something very similar. I really hate this
> >
> > I'm not involved with the vfs, so I'm unaware of other solutions
> > presented. I just hit this now and solving bugs is where I get a chance
> > to learn about other aspects of the kernel. ;-)
> >
> > > solution. Why should every LSM try to understand the intimate
> > > lifetime rules of the parent subsystems? The real problem is that
> > > inode_free_security() is being called while the inode is still in use.
> > > While I agree with the assessment, I disagree with the solution. Let
> > > me try to find where Al and Christoph talked about this....
> > >
> >
> > The other obvious solution (but not as trivial to implement) is to call
> > the security_inode_free() and friends (probably __destroy_inode()
> > itself) after a synchronize_rcu().
> >
> > Perhaps something like this?
>
> I can't for the life of me find that conversation! Maybe I'm just
> making it all up... Usually I forget conversations, not remember ones
> that didn't happen...
>
> Assuming the VFS guys say that delaying __destroy_inode() is safe like
> that, I like it better. It also means that this is fixed for all LSMs,
> not just SELinux...
>
> -Eric
>
> >
> > -- Steve
> >
> > diff --git a/fs/inode.c b/fs/inode.c
> > index 4bcdad3..a8f3b88 100644
> > --- a/fs/inode.c
> > +++ b/fs/inode.c
> > @@ -252,16 +252,17 @@ EXPORT_SYMBOL(__destroy_inode);
> > static void i_callback(struct rcu_head *head)
> > {
> > struct inode *inode = container_of(head, struct inode, i_rcu);
> > + __destroy_inode(inode);
> > kmem_cache_free(inode_cachep, inode);
> > }
> >
> > static void destroy_inode(struct inode *inode)
> > {
> > BUG_ON(!list_empty(&inode->i_lru));
> > - __destroy_inode(inode);
> > - if (inode->i_sb->s_op->destroy_inode)
> > + if (inode->i_sb->s_op->destroy_inode) {
> > + __destroy_inode(inode);
> > inode->i_sb->s_op->destroy_inode(inode);
> > - else
> > + } else
> > call_rcu(&inode->i_rcu, i_callback);
> > }
> >
>
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html