From: Joseph Salisbury <joseph.salisbury@canonical.com>
To: viro@zeniv.linux.org.uk, eparis@redhat.com
Cc: hirofumi@mail.parknet.co.jp, john@johnmccutchan.com,
rlove@rlove.org, linux-kernel@vger.kernel.org,
linux-fsdevel@vger.kernel.org
Subject: Re: Race inotify_rm_watch vs umount
Date: Tue, 06 Mar 2012 16:09:55 -0500 [thread overview]
Message-ID: <4F567D23.9040309@canonical.com> (raw)
In-Reply-To: <CAGHUO11rNGU9VMAPQNdXtpQeAixFX6zxJc-tWur1McqbpYpYpQ@mail.gmail.com>
On 03/06/2012 04:02 PM, Joseph Salisbury wrote:
>
>
> Forwarded conversation
> Subject: *Race inotify_rm_watch vs umount*
> ------------------------
>
> From: *OGAWA Hirofumi* <hirofumi@mail.parknet.co.jp
> <mailto:hirofumi@mail.parknet.co.jp>>
> Date: Fri, Jun 10, 2011 at 7:20 AM
> To: John McCutchan <john@johnmccutchan.com
> <mailto:john@johnmccutchan.com>>, Robert Love <rlove@rlove.org
> <mailto:rlove@rlove.org>>, Eric Paris <eparis@redhat.com
> <mailto:eparis@redhat.com>>
> Cc: linux-kernel@vger.kernel.org <mailto:linux-kernel@vger.kernel.org>,
> linux-fsdevel@vger.kernel.org <mailto:linux-fsdevel@vger.kernel.org>
>
>
> Hi,
>
> I'm looking the race inotify_rm_watch() vs umount(). This race become the
> cause of Oops. You can see the oops at
>
> https://bugzilla.kernel.org/show_bug.cgi?id=22602
>
> So, what race?
>
> umount inotify_rm_watch
> ... fsnotify_destroy_mark()
> fsnotify_destroy_inode_mark()
> /* removed from
> i_fsnotify_marks */
> generic_shutdown_super()
> fsnotify_unmount_inodes()
> put_super()
> iput()
> iput_final()
> /* this is after
> put_super() */
>
> Like above, inotify doesn't guarantee to call final iput() before
> put_super(). With this violation, FS driver can oops.
>
> Well, so, what are requested for inotify? We can't simply take
> sb->s_umount in inotify_rm_watch()?
>
> Any ideas?
>
> Thanks.
> --
> OGAWA Hirofumi <hirofumi@mail.parknet.co.jp
> <mailto:hirofumi@mail.parknet.co.jp>>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> <mailto:majordomo@vger.kernel.org>
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
> ----------
> From: *Eric Paris* <eparis@redhat.com <mailto:eparis@redhat.com>>
> Date: Fri, Jun 10, 2011 at 9:46 AM
> To: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp
> <mailto:hirofumi@mail.parknet.co.jp>>
> Cc: John McCutchan <john@johnmccutchan.com
> <mailto:john@johnmccutchan.com>>, Robert Love <rlove@rlove.org
> <mailto:rlove@rlove.org>>, linux-kernel@vger.kernel.org
> <mailto:linux-kernel@vger.kernel.org>, linux-fsdevel@vger.kernel.org
> <mailto:linux-fsdevel@vger.kernel.org>
>
>
> Ok, I see what you are saying, I'll see what I can do. I'm a little
> scared to call something like iput() under a lock though. I might be
> able to make the bigest lock a mutex and fix this....
>
> I'll add this to my test suite.
>
> -Eric
> >
> > umount inotify_rm_watch
> > ... fsnotify_destroy_mark()
> > fsnotify_destroy_inode_mark()
> > /* removed from
> i_fsnotify_marks */
> > generic_shutdown_super()
> > fsnotify_unmount_inodes()
> > put_super()
> > iput()
> > iput_final()
> > /* this is after
> put_super() */
> >
> > Like above, inotify doesn't guarantee to call final iput() before
> > put_super(). With this violation, FS driver can oops.
> >
> > Well, so, what are requested for inotify? We can't simply take
> > sb->s_umount in inotify_rm_watch()?
> >
> > Any ideas?
> >
> > Thanks.
>
>
> --
>
> ----------
> From: *Al Viro* <viro@zeniv.linux.org.uk <mailto:viro@zeniv.linux.org.uk>>
> Date: Fri, Jun 10, 2011 at 10:35 AM
> To: Eric Paris <eparis@redhat.com <mailto:eparis@redhat.com>>
> Cc: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp
> <mailto:hirofumi@mail.parknet.co.jp>>, John McCutchan
> <john@johnmccutchan.com <mailto:john@johnmccutchan.com>>, Robert Love
> <rlove@rlove.org <mailto:rlove@rlove.org>>, linux-kernel@vger.kernel.org
> <mailto:linux-kernel@vger.kernel.org>, linux-fsdevel@vger.kernel.org
> <mailto:linux-fsdevel@vger.kernel.org>
>
>
> Which lock would that be? I don't see any good candidates in there...
>
>
Hello,
It appears this bug still exists in the 3.2 kernel[0]. There was some
discussion about this bug in this thread and in the bug[1]. However,
there haven't been any updates in a while.
Has there been any further findings on this issue?
Thanks,
Joe
[0] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/922906
[1] https://bugzilla.kernel.org/show_bug.cgi?id=22602
prev parent reply other threads:[~2012-03-06 21:10 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-06-10 11:20 Race inotify_rm_watch vs umount OGAWA Hirofumi
2011-06-10 13:46 ` Eric Paris
2011-06-10 14:35 ` Al Viro
[not found] ` <CAGHUO11rNGU9VMAPQNdXtpQeAixFX6zxJc-tWur1McqbpYpYpQ@mail.gmail.com>
2012-03-06 21:09 ` Joseph Salisbury [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F567D23.9040309@canonical.com \
--to=joseph.salisbury@canonical.com \
--cc=eparis@redhat.com \
--cc=hirofumi@mail.parknet.co.jp \
--cc=john@johnmccutchan.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rlove@rlove.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox