From: Al Viro <viro@ZenIV.linux.org.uk>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Hugh Dickins <hughd@google.com>,
Andrew Morton <akpm@linux-foundation.org>,
Nick Piggin <npiggin@kernel.dk>,
linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org
Subject: Re: [PATCH] vfs: fix race in rcu lookup of pruned dentry
Date: Mon, 18 Jul 2011 19:20:30 +0100 [thread overview]
Message-ID: <20110718182030.GF11013@ZenIV.linux.org.uk> (raw)
In-Reply-To: <CA+55aFxKRw8NxcHKzsSeCX3ud6eDrcQvAX+LMQOUT4p5TPLp5g@mail.gmail.com>
On Mon, Jul 18, 2011 at 11:11:40AM -0700, Linus Torvalds wrote:
> Also, looking at that whole mount-point traversal sequence, it looks
> like __follow_mount_rcu() will happily totally ignore the old sequence
> number when it replaces it with the mount-point sequence number. So it
> looks to me that we have a case where we miss the sequence number
> check that can happen with a positive dentry too!
>
> No?
>
> So I think that whenever we change "nd->seq", we should always heck
> the previous sequence number first (the way do_lookup() itself does
> for the *normal* traversal case). Otherwise we will have traversed the
> mount-point without ever having checked the previous sequence number.
>
> Something like the (untested) attached patch.
>
> Comments? This mount-point case is independent of the negative dentry
> issue, and probably never really an issue in practice, but...
->mnt_mountpoint and ->mnt_root are both pinned (and protected by
vfsmount_lock, while we are at it). If it manages to get stale,
we have worse problems...
next prev parent reply other threads:[~2011-07-18 18:20 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-07-17 21:03 [PATCH] vfs: fix race in rcu lookup of pruned dentry Hugh Dickins
2011-07-17 22:00 ` Linus Torvalds
2011-07-17 22:59 ` Linus Torvalds
2011-07-17 23:26 ` Al Viro
2011-07-17 23:16 ` Al Viro
2011-07-17 23:38 ` Linus Torvalds
2011-07-17 23:47 ` Hugh Dickins
2011-07-18 0:25 ` Al Viro
2011-07-18 1:13 ` Hugh Dickins
2011-07-18 2:08 ` Al Viro
2011-07-18 6:31 ` Linus Torvalds
2011-07-18 6:31 ` Linus Torvalds
2011-07-18 14:41 ` Hugh Dickins
2011-07-18 18:11 ` Linus Torvalds
2011-07-18 18:20 ` Al Viro [this message]
2011-07-18 19:08 ` Linus Torvalds
2011-07-18 19:20 ` Al Viro
2011-07-18 19:23 ` Al Viro
2011-07-18 19:34 ` Linus Torvalds
2011-07-18 19:04 ` Hugh Dickins
2011-07-18 19:33 ` Linus Torvalds
2011-07-18 19:47 ` Al Viro
2011-07-18 20:24 ` Linus Torvalds
2011-07-18 21:19 ` Hugh Dickins
2011-07-18 21:42 ` Linus Torvalds
2011-07-18 22:43 ` Hugh Dickins
2011-07-18 23:17 ` Al Viro
2011-07-18 23:21 ` Al Viro
2011-07-18 23:27 ` Linus Torvalds
2011-07-18 23:40 ` Al Viro
2011-07-19 2:07 ` Hugh Dickins
2011-07-19 2:14 ` Linus Torvalds
2011-07-19 2:14 ` Linus Torvalds
2011-07-19 2:17 ` Linus Torvalds
2011-07-19 2:23 ` Al Viro
2011-07-19 2:37 ` Chris Ball
2011-07-19 4:41 ` Nicolas Pitre
2011-07-19 2:21 ` Al Viro
2011-07-19 23:45 ` Al Viro
2011-07-19 23:52 ` Al Viro
2011-07-19 23:55 ` Al Viro
2011-07-20 0:47 ` NeilBrown
2011-07-20 1:40 ` Al Viro
2011-07-20 4:52 ` Linus Torvalds
2011-07-20 4:52 ` Linus Torvalds
2011-07-19 23:56 ` Linus Torvalds
2011-07-20 0:04 ` Al Viro
2011-07-17 23:53 ` Al Viro
2011-07-17 23:31 ` Hugh Dickins
2011-07-17 23:52 ` Linus Torvalds
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110718182030.GF11013@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=akpm@linux-foundation.org \
--cc=hughd@google.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=npiggin@kernel.dk \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.