From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3418C433DF for ; Wed, 10 Jun 2020 21:52:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BB9D52072E for ; Wed, 10 Jun 2020 21:52:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591825943; bh=1mB9qo0mQqlBR2asORG2q/eNPb0O9RBr6d1/9JvB+DI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=cR4NY5nGEJXYkZlKqsU7xrmC32+Xxx80baurwRMC+Khqc1aQDNqhgMVWe7iAs5u19 I/QWxh/n6jebDdeIPtlziDyDyDD3DG0f+bjprQzkxCVhIEsh/wDbuxh6wV51wgzmNJ 278S+ciG/tkw77AYIRHvb1Bjc+Yl/Bf5jsrh2Fwc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726698AbgFJVwR (ORCPT ); Wed, 10 Jun 2020 17:52:17 -0400 Received: from mail-pg1-f193.google.com ([209.85.215.193]:45621 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726289AbgFJVwR (ORCPT ); Wed, 10 Jun 2020 17:52:17 -0400 Received: by mail-pg1-f193.google.com with SMTP id n23so1561442pgb.12; Wed, 10 Jun 2020 14:52:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=eRf6W4oVEmwpsh0h+K1sCW7NaH3bq1FpwEBiNryS1Wo=; b=GVfmeToqAO9SEml7j9bByOpsYVyCsxug/bX6H9XLG7OC9NfuH5pjGiWLQEEZzTAsHM d7EpWSbJn/Qp+6FxhUkJQJFl6QYtMS/bpQEEfnihJR6WZlA/Yr5GZzXUcRKEgvsBTh3P pV6BYcZvb3atDdRmAqUaYlsLORSlWiJKVee239z+S7WD+KXNJaDxtw2j1uR7VPhNE5qr deNri2wUB9Ki+IZ9rUw0l1UUYyqaW3G1Giu6nx3HjuzSO5axDQIUbvvLaNXpBfTv7iTT /5eDvDQK7zHhjci9nk8KKZZnvOKIGC9XXKrky4lC+yGy3S9/Im0tyrobF0nx54nSP5J7 JCTA== X-Gm-Message-State: AOAM530EWaOzgQw5VdHOft0Yf0VERYq+euCqLCQV1dH+ZrcbR92iwMX7 CLlaCKtU8S9M6uU6Z1w3ank= X-Google-Smtp-Source: ABdhPJy992mUv5U8bhwojNTbIZ80dvsxUMVUFbzemXqKRntKpx7DGKHGnQxvq9NILxqv4J2ZE+scdw== X-Received: by 2002:a63:4d5a:: with SMTP id n26mr4421932pgl.85.1591825936625; Wed, 10 Jun 2020 14:52:16 -0700 (PDT) Received: from 42.do-not-panic.com (42.do-not-panic.com. [157.230.128.187]) by smtp.gmail.com with ESMTPSA id n69sm854031pfd.171.2020.06.10.14.52.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 10 Jun 2020 14:52:14 -0700 (PDT) Received: by 42.do-not-panic.com (Postfix, from userid 1000) id 038B5403AB; Wed, 10 Jun 2020 21:52:13 +0000 (UTC) Date: Wed, 10 Jun 2020 21:52:13 +0000 From: Luis Chamberlain To: Christoph Hellwig Cc: Jan Kara , axboe@kernel.dk, viro@zeniv.linux.org.uk, bvanassche@acm.org, gregkh@linuxfoundation.org, rostedt@goodmis.org, mingo@redhat.com, ming.lei@redhat.com, nstange@suse.de, akpm@linux-foundation.org, mhocko@suse.com, yukuai3@huawei.com, martin.petersen@oracle.com, jejb@linux.ibm.com, linux-block@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Omar Sandoval , Hannes Reinecke , Michal Hocko , syzbot+603294af2d01acfdd6da@syzkaller.appspotmail.com Subject: Re: [PATCH v6 6/6] blktrace: fix debugfs use after free Message-ID: <20200610215213.GH13911@42.do-not-panic.com> References: <20200608170127.20419-1-mcgrof@kernel.org> <20200608170127.20419-7-mcgrof@kernel.org> <20200609150602.GA7111@infradead.org> <20200609172922.GP11244@42.do-not-panic.com> <20200609173218.GA7968@infradead.org> <20200609175359.GR11244@42.do-not-panic.com> <20200610064234.GB24975@infradead.org> <20200610210917.GH11244@42.do-not-panic.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200610210917.GH11244@42.do-not-panic.com> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org So, upon updating the commit log, and moving the empty directory check into another patch, I realized we might be able to simplify this now even further still. Patch below. The key of the issue was that the use after free happens when a recursive removal happens, and then later a specific dentry removal happens. This happened for make_request block drivers when using the whole disk, but since we *don't* have any other users of the directory for the others cases, this in theory shuld not happen for them either. I'll try to shoot some bullets at this. diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index 7ff2ea5cd05e..5cea04c05e09 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -524,10 +524,16 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, if (!bt->msg_data) goto err; - ret = -ENOENT; - - dir = debugfs_lookup(buts->name, blk_debugfs_root); - if (!dir) + /* + * When tracing whole make_request drivers (multiqueue) block devices, + * reuse the existing debugfs directory created by the block layer on + * init. For request-based block devices, all partitions block devices, + * and scsi-generic block devices we create a temporary new debugfs + * directory that will be removed once the trace ends. + */ + if (queue_is_mq(q)) + dir = q->debugfs_dir; + else bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root); bt->dev = dev; @@ -565,8 +571,6 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, ret = 0; err: - if (dir && !bt->dir) - dput(dir); if (ret) blk_trace_free(bt); return ret;