Linux Security Modules development
 help / color / mirror / Atom feed
From: Tingmao Wang <m@maowtm.org>
To: "Al Viro" <viro@zeniv.linux.org.uk>, "Mickaël Salaün" <mic@digikod.net>
Cc: "Song Liu" <song@kernel.org>, "Günther Noack" <gnoack@google.com>,
	"Jan Kara" <jack@suse.cz>,
	"Alexei Starovoitov" <alexei.starovoitov@gmail.com>,
	"Christian Brauner" <brauner@kernel.org>,
	linux-security-module@vger.kernel.org,
	linux-fsdevel@vger.kernel.org
Subject: Re: [RFC PATCH 3/3] Restart pathwalk on rename seqcount change
Date: Wed, 4 Jun 2025 19:56:09 +0100	[thread overview]
Message-ID: <c4005b56-b341-4f37-b189-6681fcfe5bc6@maowtm.org> (raw)
In-Reply-To: <20250604022126.GF299672@ZenIV>

On 6/4/25 03:21, Al Viro wrote:
> On Wed, Jun 04, 2025 at 02:12:11AM +0100, Tingmao Wang wrote:
>> On 6/4/25 01:55, Al Viro wrote:
>>> On Wed, Jun 04, 2025 at 01:45:45AM +0100, Tingmao Wang wrote:
>>>> +		rename_seqcount = read_seqbegin(&rename_lock);
>>>> +		if (rename_seqcount % 2 == 1) {
>>>
>>> Please, describe the condition when that can happen, preferably
>>> along with a reproducer.
>>
>> My understanding is that when a rename is in progress the seqcount is odd,
>> is that correct?
>>
>> If that's the case, then the fs_race_test in patch 2 should act as a
>> reproducer, since it's constantly moving the directory.
>>
>> I can add a comment to explain this, thanks for pointing out.
>
> Please, read through the header declaring those primitives and read the
> documentation it refers to - it's useful for background.

Ok, so I didn't realize read_seqbegin actually waits for the seqcount to
turn even.  I did read the header earlier when following dget_parent but
probably misremembered and mixed raw_seqcount_begin with read_seqbegin.

>
> What's more, look at the area covered by rename_lock - I seriously suspect
> that you are greatly overestimating it.

Admittedly "when a rename is in progress" is a vague statement.  Looking
at what takes rename_lock in the code, it's only when we actually do
d_move where we take this lock (plus some other places), and the critical
section isn't very large, and does not contain any waits etc.

If we keep read_seqbegin, then that gives landlock more opportunity to do
a reference-less parent walk, but at the expense that a d_move anywhere,
even if it doesn't affect anything we're currently looking at, will
temporarily block this landlocked application (even if not for very long),
and multiple concurrent renames might cause us to wait for longer (but
probably won't starve us since we just need one "cycle" where rename
seqcount is even).

Since we can still safely do a parent walk, just needing to take dentry
references on our way, we could simply fallback to that in this situation.
i.e.  we can use raw_seqcount_begin and keep the seqcount & 1 check.

Now, there is the argument that if d_move is very quick, then it might be
worth waiting for it to finish, and we will fallback to the original
parent walk if the seqcount changes again.  I'm not sure which is best,
but I'm inclining towards changing this to raw_seqcount_begin, as this is
purely an optimization, and we do not _need_ to avoid concurrent renames.

  reply	other threads:[~2025-06-04 18:56 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-06-04  0:45 [RFC PATCH 0/3] landlock: walk parent dir with RCU, without taking references Tingmao Wang
2025-06-04  0:45 ` [RFC PATCH 1/3] landlock: walk parent dir " Tingmao Wang
2025-06-04 17:15   ` Mickaël Salaün
2025-06-04 21:05     ` Tingmao Wang
2025-06-06 10:25       ` Christian Brauner
2025-06-04  0:45 ` [RFC PATCH 2/3] selftests/landlock: Add fs_race_test Tingmao Wang
2025-06-04  0:45 ` [RFC PATCH 3/3] Restart pathwalk on rename seqcount change Tingmao Wang
2025-06-04  0:55   ` Al Viro
2025-06-04  1:12     ` Tingmao Wang
2025-06-04  2:21       ` Al Viro
2025-06-04 18:56         ` Tingmao Wang [this message]
2025-06-04 19:17           ` Tingmao Wang
2025-06-04  1:09   ` Tingmao Wang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=c4005b56-b341-4f37-b189-6681fcfe5bc6@maowtm.org \
    --to=m@maowtm.org \
    --cc=alexei.starovoitov@gmail.com \
    --cc=brauner@kernel.org \
    --cc=gnoack@google.com \
    --cc=jack@suse.cz \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mic@digikod.net \
    --cc=song@kernel.org \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox