All of lore.kernel.org
 help / color / mirror / Atom feed
From: ebiederm@xmission.com (Eric W. Biederman)
To: Lucas De Marchi <lucas.demarchi@profusion.mobi>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>,
	linux-fsdevel@vger.kernel.org
Subject: Re: [REVIEW][PATCH] Making poll generally useful for sysctls
Date: Tue, 27 Mar 2012 19:00:23 -0700	[thread overview]
Message-ID: <m1mx71o56w.fsf@fess.ebiederm.org> (raw)
In-Reply-To: <20120327010253.26e5087f@vader> (Lucas De Marchi's message of "Tue, 27 Mar 2012 01:02:53 -0300")

Lucas De Marchi <lucas.demarchi@profusion.mobi> writes:

> On Mon, 26 Mar 2012 14:44:50 -0300
> Lucas De Marchi <lucas.demarchi@profusion.mobi> wrote:
>
>> Hi Eric,
>> 
>> On Sat, Mar 24, 2012 at 4:58 AM, Eric W. Biederman
>> <ebiederm@xmission.com> wrote:
>>
>> > Here is rebased version of the patch just in case that helps.
>> 
>> Now I can apply, but I can't boot: we hit a NULL dereference in
>> __wake_up_common(), called by proc_sys_poll_notify(). It seems that
>> you forgot to initialize the waitqueue with
>> __WAIT_QUEUE_HEAD_INITIALIZER().
>
> Trying again I came up with the following simple oneliner on top
> of your patch. With it I can boot successfully and poll any file
> under /proc/sys (I didn't try many, but there's no reason it would not
> work).

Thanks. I feel silly for that pretty obvious oversight.

There is another bug I am seeing in the sysctl poll code.  It needs to
be .read that updates filp->private_data to event, and not .poll.
Otherwise we have what should be a level triggered interface acting like
an edge triggered interface.

Any chance I could get you to cook up a patch for that bug?

> The nice part of this patch is that suddenly all sysctl entries can be
> monitored through poll() instead of having to add adhoc code. However
> that spurious wake ups are not very nice. Eric, what if we keep the
> waitqueue inside the entry and initialize it there, just like we did
> for ->event? This would mean iterating through them on unregister
> though.

Iterating through the all of the table entries on unregister is
not a problem, some code paths for namespace support are doing that
already.  Putting the wait queue in struct ctl_table is something
we can't do.  struct ctl_table can be freed before the final fput
on a file descriptor and fs/select.c will try to remove freed
wait queue heads, which would get us back to where we came in.

What we can do is use struct ctl_node instead. Either bloating struct
ctl_node or adding putting a pointer to struct ctl_table_poll.  The
only tricky part is that I don't believe I have any size information
on how many ctl_node entries I have.  So that information would have
to be gathered and kept as well.

After having looked at how large wait_queue_head_t I am reluctant
to pay the price for keeping a wait queue for nodes that we are not
polling.  So I am thinking allocate in .poll and free in unregister,
but I don't think I am ambitious enough to code that up.

Eric

  reply	other threads:[~2012-03-28  2:00 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-03-13  0:58 [3.3-rc7] sys_poll use after free (hibernate) Dave Jones
2012-03-18 19:02 ` Linus Torvalds
2012-03-18 19:27   ` Al Viro
2012-03-19  8:17     ` Alexey Dobriyan
2012-03-20  6:08     ` Lucas De Marchi
2012-03-20 18:29       ` [PATCH] sysctl: protect poll() in entries that may go away Lucas De Marchi
2012-03-22 21:31       ` [3.3-rc7] sys_poll use after free (hibernate) Eric W. Biederman
2012-03-22 22:12         ` Lucas De Marchi
2012-03-22 23:02           ` Eric W. Biederman
2012-03-24  0:25           ` [REVIEW][PATCH] Making poll generally useful for sysctls Eric W. Biederman
2012-03-24  6:20             ` Lucas De Marchi
2012-03-24  7:58               ` Eric W. Biederman
2012-03-26 17:44                 ` Lucas De Marchi
2012-03-26 17:44                   ` Lucas De Marchi
2012-03-27  4:02                   ` Lucas De Marchi
2012-03-27  4:02                     ` Lucas De Marchi
2012-03-28  2:00                     ` Eric W. Biederman [this message]
2012-03-22 22:24     ` [3.3-rc7] sys_poll use after free (hibernate) Eric W. Biederman
2012-03-18 19:47 ` richard -rw- weinberger
2012-03-18 21:24   ` Dave Jones

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=m1mx71o56w.fsf@fess.ebiederm.org \
    --to=ebiederm@xmission.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lucas.demarchi@profusion.mobi \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.