From mboxrd@z Thu Jan 1 00:00:00 1970 From: Matthew Wilcox Subject: Re: [PATCH] vfs: Fix possible NULL pointer dereference in inode_permission() Date: Thu, 9 Jan 2014 14:42:39 -0700 Message-ID: <20140109214239.GD29910@parisc-linux.org> References: <20140109162731.12500986@gandalf.local.home> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: LKML , linux-fsdevel@vger.kernel.org, Alexander Viro , Stephen Smalley , Christoph Hellwig , Linus Torvalds , Eric Paris , Theodore Ts'o , Dave Chinner , James Morris , Paul Moore , Andrew Morton , "Paul E. McKenney" , stable To: Steven Rostedt Return-path: Content-Disposition: inline In-Reply-To: <20140109162731.12500986@gandalf.local.home> Sender: stable-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Thu, Jan 09, 2014 at 04:27:31PM -0500, Steven Rostedt wrote: > Note, the crash came from stressing the deletion and reading of debugfs > files. I was not able to recreate this via normal files. But I'm not > sure they are safe. It may just be that the race window is much harder > to hit. But "normal" files have a 'destroy_inode' method. So you've basically only fixed it for debugfs (and maybe a few other unusual filesystems). Why doesn't the code look like this: static void i_callback(struct rcu_head *head) { struct inode *inode = container_of(head, struct inode, i_rcu); __destroy_inode(inode); if (inode->i_sb->s_op->destroy_inode) inode->i_sb->s_op->destroy_inode(inode); else kmem_cache_free(inode_cachep, inode); } static void destroy_inode(struct inode *inode) { BUG_ON(!list_empty(&inode->i_lru)); call_rcu(&inode->i_rcu, i_callback); } We'd then have to get rid of all the call_rcu() invocations in individual filesystems' destroy_inode methods, but that doesn't sound like a bad thing to me. -- Matthew Wilcox Intel Open Source Technology Centre "Bill, look, we understand that you're interested in selling us this operating system, but compare it to ours. We can't possibly take such a retrograde step."