From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr700071.outbound.protection.outlook.com ([40.107.70.71]:57072 "EHLO NAM04-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725788AbeK3Gc7 (ORCPT ); Fri, 30 Nov 2018 01:32:59 -0500 From: Jan Glauber To: Will Deacon CC: Alexander Viro , "linux-fsdevel@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "gregkh@linuxfoundation.org" , "jslaby@suse.com" Subject: Re: dcache_readdir NULL inode oops Date: Thu, 29 Nov 2018 19:25:48 +0000 Message-ID: <20181129184950.GA7290@hc> References: <20181109143744.GA12128@hc> <20181109155856.GC2091@brain-police> <20181110111656.GA16667@hc> <20181120182854.GC28838@arm.com> <20181120190317.GA29161@arm.com> <20181121131900.GA18931@hc> <20181123180525.GA21017@arm.com> <20181128200806.GC32668@arm.com> In-Reply-To: <20181128200806.GC32668@arm.com> Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-ID: <4F8CEBC213D0DC4181E630E3BF425186@namprd07.prod.outlook.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Wed, Nov 28, 2018 at 08:08:06PM +0000, Will Deacon wrote: > I spent some more time looking at this today... >=20 > On Fri, Nov 23, 2018 at 06:05:25PM +0000, Will Deacon wrote: > > Doing some more debugging, it looks like the usual failure case is wher= e > > one CPU clears the inode field in the dentry via: > > > > devpts_pty_kill() > > -> d_delete() // dentry->d_lockref.count =3D=3D 1 > > -> dentry_unlink_inode() > > > > whilst another CPU gets a pointer to the dentry via: > > > > sys_getdents64() > > -> iterate_dir() > > -> dcache_readdir() > > -> next_positive() > > > > and explodes on the subsequent inode dereference when trying to pass th= e > > inode number to dir_emit(): > > > > if (!dir_emit(..., d_inode(next)->i_ino, ...)) > > > > Indeed, the hack below triggers a warning, indicating that the inode > > is being cleared concurrently. > > > > I can't work out whether the getdents64() path should hold a refcount > > to stop d_delete() in its tracks, or whether devpts_pty_kill() shouldn'= t > > be calling d_delete() like this at all. >=20 > So the issue is that opening /dev/pts/ptmx creates a new pty in /dev/pts, > which disappears when you close /dev/pts/ptmx. Consequently, when we tear > down the dentry for the magic new file, we have to take the i_node rwsem = of > the *parent* so that concurrent path walkers don't trip over it whilst it= s > being freed. I wrote a simple concurrent program to getdents(/dev/pts/) i= n > one thread, whilst another opens and closes /dev/pts/ptmx: it crashes the > kernel in seconds. I also made a testcase and verified that your fix is fine. I also tried replacing open-close on /dev/ptmx with mkdir-rmdir but that does not trigger the error. > Patch below, but I'd still like somebody else to look at this, please. I wonder why no inode_lock on parent is needed for devpts_pty_new(), but I'm obviously not a VFS expert... So your patch looks good to me and clearly solves the issue. thanks, Jan > Will >=20 > --->8 >=20 > diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c > index c53814539070..50ddb95ff84c 100644 > --- a/fs/devpts/inode.c > +++ b/fs/devpts/inode.c > @@ -619,11 +619,17 @@ void *devpts_get_priv(struct dentry *dentry) > */ > void devpts_pty_kill(struct dentry *dentry) > { > - WARN_ON_ONCE(dentry->d_sb->s_magic !=3D DEVPTS_SUPER_MAGIC); > + struct super_block *sb =3D dentry->d_sb; > + struct dentry *parent =3D sb->s_root; >=20 > + WARN_ON_ONCE(sb->s_magic !=3D DEVPTS_SUPER_MAGIC); > + > + inode_lock(parent->d_inode); > dentry->d_fsdata =3D NULL; > drop_nlink(dentry->d_inode); > d_delete(dentry); > + inode_unlock(parent->d_inode); > + > dput(dentry); /* d_alloc_name() in devpts_pty_new() */ > }