From: ebiederm@xmission.com (Eric W. Biederman)
To: Lucas De Marchi <lucas.demarchi@profusion.mobi>
Cc: Linux Kernel <linux-kernel@vger.kernel.org>,
linux-fsdevel@vger.kernel.org
Subject: Re: [REVIEW][PATCH] Making poll generally useful for sysctls
Date: Tue, 27 Mar 2012 19:00:23 -0700 [thread overview]
Message-ID: <m1mx71o56w.fsf@fess.ebiederm.org> (raw)
In-Reply-To: <20120327010253.26e5087f@vader> (Lucas De Marchi's message of "Tue, 27 Mar 2012 01:02:53 -0300")
Lucas De Marchi <lucas.demarchi@profusion.mobi> writes:
> On Mon, 26 Mar 2012 14:44:50 -0300
> Lucas De Marchi <lucas.demarchi@profusion.mobi> wrote:
>
>> Hi Eric,
>>
>> On Sat, Mar 24, 2012 at 4:58 AM, Eric W. Biederman
>> <ebiederm@xmission.com> wrote:
>>
>> > Here is rebased version of the patch just in case that helps.
>>
>> Now I can apply, but I can't boot: we hit a NULL dereference in
>> __wake_up_common(), called by proc_sys_poll_notify(). It seems that
>> you forgot to initialize the waitqueue with
>> __WAIT_QUEUE_HEAD_INITIALIZER().
>
> Trying again I came up with the following simple oneliner on top
> of your patch. With it I can boot successfully and poll any file
> under /proc/sys (I didn't try many, but there's no reason it would not
> work).
Thanks. I feel silly for that pretty obvious oversight.
There is another bug I am seeing in the sysctl poll code. It needs to
be .read that updates filp->private_data to event, and not .poll.
Otherwise we have what should be a level triggered interface acting like
an edge triggered interface.
Any chance I could get you to cook up a patch for that bug?
> The nice part of this patch is that suddenly all sysctl entries can be
> monitored through poll() instead of having to add adhoc code. However
> that spurious wake ups are not very nice. Eric, what if we keep the
> waitqueue inside the entry and initialize it there, just like we did
> for ->event? This would mean iterating through them on unregister
> though.
Iterating through the all of the table entries on unregister is
not a problem, some code paths for namespace support are doing that
already. Putting the wait queue in struct ctl_table is something
we can't do. struct ctl_table can be freed before the final fput
on a file descriptor and fs/select.c will try to remove freed
wait queue heads, which would get us back to where we came in.
What we can do is use struct ctl_node instead. Either bloating struct
ctl_node or adding putting a pointer to struct ctl_table_poll. The
only tricky part is that I don't believe I have any size information
on how many ctl_node entries I have. So that information would have
to be gathered and kept as well.
After having looked at how large wait_queue_head_t I am reluctant
to pay the price for keeping a wait queue for nodes that we are not
polling. So I am thinking allocate in .poll and free in unregister,
but I don't think I am ambitious enough to code that up.
Eric
next prev parent reply other threads:[~2012-03-28 1:56 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-03-13 0:58 [3.3-rc7] sys_poll use after free (hibernate) Dave Jones
2012-03-18 19:02 ` Linus Torvalds
2012-03-18 19:27 ` Al Viro
2012-03-19 8:17 ` Alexey Dobriyan
2012-03-20 6:08 ` Lucas De Marchi
2012-03-20 18:29 ` [PATCH] sysctl: protect poll() in entries that may go away Lucas De Marchi
2012-03-22 21:31 ` [3.3-rc7] sys_poll use after free (hibernate) Eric W. Biederman
2012-03-22 22:12 ` Lucas De Marchi
2012-03-22 23:02 ` Eric W. Biederman
2012-03-24 0:25 ` [REVIEW][PATCH] Making poll generally useful for sysctls Eric W. Biederman
2012-03-24 6:20 ` Lucas De Marchi
2012-03-24 7:58 ` Eric W. Biederman
2012-03-26 17:44 ` Lucas De Marchi
2012-03-27 4:02 ` Lucas De Marchi
2012-03-28 2:00 ` Eric W. Biederman [this message]
2012-03-22 22:24 ` [3.3-rc7] sys_poll use after free (hibernate) Eric W. Biederman
2012-03-18 19:47 ` richard -rw- weinberger
2012-03-18 21:24 ` Dave Jones
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=m1mx71o56w.fsf@fess.ebiederm.org \
--to=ebiederm@xmission.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lucas.demarchi@profusion.mobi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox