User-triggerable WARNING with fuse

User-triggerable WARNING with fuse

[Tero Roponen]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1765 bytes --]


Using the attached program I can trigger the following WARNING
reliably as a normal user. This happens at least both in 3.8-rc6
and 3.7.5.

The kernel is tainted by proprietary NVIDIA module, but I don't
thinks it matters in this case.

[ 4390.882323] ------------[ cut here ]------------
[ 4390.882342] WARNING: at fs/inode.c:280 drop_nlink+0x41/0x50()
[ 4390.882345] Hardware name: M50Vm               
[ 4390.882347] Modules linked in: fuse rfcomm bnep snd_hda_codec_hdmi 
nvidia(PO) snd_hda_codec_realtek snd_hda_intel iwldvm snd_hda_codec 
snd_hwdep uvcvideo btusb videobuf2_vmalloc videobuf2_memops videobuf2_core 
mac80211 bluetooth snd_seq snd_seq_device snd_pcm asus_laptop iwlwifi 
cfg80211 snd_page_alloc snd_timer videodev r8169 input_polldev 
sparse_keymap snd soundcore kvm_intel kvm microcode rfkill i2c_core mii 
pcspkr uinput hid_generic firewire_ohci sdhci_pci sdhci mmc_core 
firewire_core crc_itu_t
[ 4390.882438] Pid: 6040, comm: rm Tainted: P        W  O 3.8.0-rc6 #1
[ 4390.882442] Call Trace:
[ 4390.882453]  [<ffffffff81032eca>] warn_slowpath_common+0x7a/0xb0
[ 4390.882460]  [<ffffffff81032f15>] warn_slowpath_null+0x15/0x20
[ 4390.882466]  [<ffffffff81101dd1>] drop_nlink+0x41/0x50
[ 4390.882478]  [<ffffffffa00d261f>] fuse_unlink+0xdf/0x130 [fuse]
[ 4390.882486]  [<ffffffff810f6cfd>] vfs_unlink+0x8d/0x100
[ 4390.882493]  [<ffffffff810f6f09>] do_unlinkat+0x199/0x220
[ 4390.882501]  [<ffffffff81092e82>] ? call_rcu_sched+0x12/0x20
[ 4390.882508]  [<ffffffff81057c2a>] ? __put_cred+0x3a/0x50
[ 4390.882516]  [<ffffffff810e9977>] ? sys_faccessat+0x137/0x1e0
[ 4390.882524]  [<ffffffff810f94b6>] sys_unlinkat+0x16/0x40
[ 4390.882532]  [<ffffffff81490c16>] system_call_fastpath+0x1a/0x1f
[ 4390.882536] ---[ end trace 372eef394febff4c ]---

[-- Attachment #2: Type: TEXT/plain, Size: 830 bytes --]

/*
 * $ gcc warn.c -o warn -D_FILE_OFFSET_BITS=64 -DFUSE_USE_VERSION=26 -lfuse
 *
 * $ mkdir mnt
 * $ ./warn mnt
 * $ rm mnt/foo
 */

#include <fuse/fuse.h>

static int readdir_op(const char *path, void *buf,
	fuse_fill_dir_t filler, off_t offset,
	struct fuse_file_info *fi)
{
	struct stat st = {.st_mode = S_IFREG | 0666};
	filler(buf, "foo", &st, 0);
	return 0;
}

static int getattr_op(const char *path, struct stat *st)
{
	if (strcmp(path, "/") == 0)
		st->st_mode = S_IFDIR | 0777;
	else
		st->st_mode = S_IFREG | 0666;
	return 0;
}

static int unlink_op(const char *path)
{
	return 0;
}

static struct fuse_operations ops = {
	.readdir = readdir_op,
	.getattr = getattr_op,
	.unlink = unlink_op,
};

int main(int argc, char *argv[])
{
	return fuse_main(argc, argv, &ops, NULL);
}

Re: User-triggerable WARNING with fuse

[Miklos Szeredi]

[-- Attachment #1: Type: text/plain, Size: 380 bytes --]

On Fri, Feb 1, 2013 at 12:39 PM, Tero Roponen <tero.roponen@gmail.com> wrote:
>
> Using the attached program I can trigger the following WARNING
> reliably as a normal user. This happens at least both in 3.8-rc6
> and 3.7.5.
>
> The kernel is tainted by proprietary NVIDIA module, but I don't
> thinks it matters in this case.
>

Thanks, the attached patch should fix it.

Miklos

[-- Attachment #2: fuse-dont-warn-when-nlink-is-zero.patch --]
[-- Type: application/octet-stream, Size: 1004 bytes --]

From: Miklos Szeredi <mszeredi@suse.cz>
Subject: fuse: don't WARN when nlink is zero

drop_nlink() warns if nlink is already zero.  This is triggerable by a buggy
userspace filesystem.  The cure, I think, is worse than the disease so disable
the warning.

Reported-by: Tero Roponen <tero.roponen@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
---
 fs/fuse/dir.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -705,7 +705,14 @@ static int fuse_unlink(struct inode *dir
 
 		spin_lock(&fc->lock);
 		fi->attr_version = ++fc->attr_version;
-		drop_nlink(inode);
+		/*
+		 * If i_nlink == 0 then unlink doesn't make sense, yet this can
+		 * happen if userspace filesystem is careless.  It would be
+		 * difficult to enforce correct nlink usage so just ignore this
+		 * condition here
+		 */
+		if (inode->i_nlink > 0)
+			drop_nlink(inode);
 		spin_unlock(&fc->lock);
 		fuse_invalidate_attr(inode);
 		fuse_invalidate_attr(dir);

Re: User-triggerable WARNING with fuse

[Tero Roponen]

On Mon, 4 Feb 2013, Miklos Szeredi wrote:

> On Fri, Feb 1, 2013 at 12:39 PM, Tero Roponen <tero.roponen@gmail.com> wrote:
> >
> > Using the attached program I can trigger the following WARNING
> > reliably as a normal user. This happens at least both in 3.8-rc6
> > and 3.7.5.
> >
> > The kernel is tainted by proprietary NVIDIA module, but I don't
> > thinks it matters in this case.
> >
> 
> Thanks, the attached patch should fix it.

Yes, that fixed it.

-- 
Tero Roponen