d2603279 | 04-Sep-2024 |
Steven Rostedt <rostedt@goodmis.org> |
eventfs: Use list_del_rcu() for SRCU protected list variable
Chi Zhiling reported:
We found a null pointer accessing in tracefs[1], the reason is that the variable 'ei_child' is set to LIST_POI
eventfs: Use list_del_rcu() for SRCU protected list variable
Chi Zhiling reported:
We found a null pointer accessing in tracefs[1], the reason is that the variable 'ei_child' is set to LIST_POISON1, that means the list was removed in eventfs_remove_rec. so when access the ei_child->is_freed, the panic triggered.
by the way, the following script can reproduce this panic
loop1 (){ while true do echo "p:kp submit_bio" > /sys/kernel/debug/tracing/kprobe_events echo "" > /sys/kernel/debug/tracing/kprobe_events done } loop2 (){ while true do tree /sys/kernel/debug/tracing/events/kprobes/ done } loop1 & loop2
[1]: [ 1147.959632][T17331] Unable to handle kernel paging request at virtual address dead000000000150 [ 1147.968239][T17331] Mem abort info: [ 1147.971739][T17331] ESR = 0x0000000096000004 [ 1147.976172][T17331] EC = 0x25: DABT (current EL), IL = 32 bits [ 1147.982171][T17331] SET = 0, FnV = 0 [ 1147.985906][T17331] EA = 0, S1PTW = 0 [ 1147.989734][T17331] FSC = 0x04: level 0 translation fault [ 1147.995292][T17331] Data abort info: [ 1147.998858][T17331] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 1148.005023][T17331] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1148.010759][T17331] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1148.016752][T17331] [dead000000000150] address between user and kernel address ranges [ 1148.024571][T17331] Internal error: Oops: 0000000096000004 [#1] SMP [ 1148.030825][T17331] Modules linked in: team_mode_loadbalance team nlmon act_gact cls_flower sch_ingress bonding tls macvlan dummy ib_core bridge stp llc veth amdgpu amdxcp mfd_core gpu_sched drm_exec drm_buddy radeon crct10dif_ce video drm_suballoc_helper ghash_ce drm_ttm_helper sha2_ce ttm sha256_arm64 i2c_algo_bit sha1_ce sbsa_gwdt cp210x drm_display_helper cec sr_mod cdrom drm_kms_helper binfmt_misc sg loop fuse drm dm_mod nfnetlink ip_tables autofs4 [last unloaded: tls] [ 1148.072808][T17331] CPU: 3 PID: 17331 Comm: ls Tainted: G W ------- ---- 6.6.43 #2 [ 1148.081751][T17331] Source Version: 21b3b386e948bedd29369af66f3e98ab01b1c650 [ 1148.088783][T17331] Hardware name: Greatwall GW-001M1A-FTF/GW-001M1A-FTF, BIOS KunLun BIOS V4.0 07/16/2020 [ 1148.098419][T17331] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1148.106060][T17331] pc : eventfs_iterate+0x2c0/0x398 [ 1148.111017][T17331] lr : eventfs_iterate+0x2fc/0x398 [ 1148.115969][T17331] sp : ffff80008d56bbd0 [ 1148.119964][T17331] x29: ffff80008d56bbf0 x28: ffff001ff5be2600 x27: 0000000000000000 [ 1148.127781][T17331] x26: ffff001ff52ca4e0 x25: 0000000000009977 x24: dead000000000100 [ 1148.135598][T17331] x23: 0000000000000000 x22: 000000000000000b x21: ffff800082645f10 [ 1148.143415][T17331] x20: ffff001fddf87c70 x19: ffff80008d56bc90 x18: 0000000000000000 [ 1148.151231][T17331] x17: 0000000000000000 x16: 0000000000000000 x15: ffff001ff52ca4e0 [ 1148.159048][T17331] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 1148.166864][T17331] x11: 0000000000000000 x10: 0000000000000000 x9 : ffff8000804391d0 [ 1148.174680][T17331] x8 : 0000000180000000 x7 : 0000000000000018 x6 : 0000aaab04b92862 [ 1148.182498][T17331] x5 : 0000aaab04b92862 x4 : 0000000080000000 x3 : 0000000000000068 [ 1148.190314][T17331] x2 : 000000000000000f x1 : 0000000000007ea8 x0 : 0000000000000001 [ 1148.198131][T17331] Call trace: [ 1148.201259][T17331] eventfs_iterate+0x2c0/0x398 [ 1148.205864][T17331] iterate_dir+0x98/0x188 [ 1148.210036][T17331] __arm64_sys_getdents64+0x78/0x160 [ 1148.215161][T17331] invoke_syscall+0x78/0x108 [ 1148.219593][T17331] el0_svc_common.constprop.0+0x48/0xf0 [ 1148.224977][T17331] do_el0_svc+0x24/0x38 [ 1148.228974][T17331] el0_svc+0x40/0x168 [ 1148.232798][T17331] el0t_64_sync_handler+0x120/0x130 [ 1148.237836][T17331] el0t_64_sync+0x1a4/0x1a8 [ 1148.242182][T17331] Code: 54ffff6c f9400676 910006d6 f9000676 (b9405300) [ 1148.248955][T17331] ---[ end trace 0000000000000000 ]---
The issue is that list_del() is used on an SRCU protected list variable before the synchronization occurs. This can poison the list pointers while there is a reader iterating the list.
This is simply fixed by using list_del_rcu() that is specifically made for this purpose.
Link: https://lore.kernel.org/linux-trace-kernel/20240829085025.3600021-1-chizhiling@163.com/
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Link: https://lore.kernel.org/20240904131605.640d42b1@gandalf.local.home Fixes: 43aa6f97c2d03 ("eventfs: Get rid of dentry pointers without refcounts") Reported-by: Chi Zhiling <chizhiling@kylinos.cn> Tested-by: Chi Zhiling <chizhiling@kylinos.cn> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
/linux/.mailmap/linux/Documentation/ABI/testing/sysfs-bus-i2c-devices-turris-omnia-mcu/linux/Documentation/ABI/testing/sysfs-devices-system-cpu/linux/Documentation/admin-guide/cifs/usage.rst/linux/Documentation/admin-guide/device-mapper/dm-crypt.rst/linux/Documentation/arch/riscv/hwprobe.rst/linux/Documentation/devicetree/bindings/clock/qcom,dispcc-sm6350.yaml/linux/Documentation/devicetree/bindings/clock/qcom,gcc-msm8994.yaml/linux/Documentation/devicetree/bindings/clock/qcom,gcc-sm6125.yaml/linux/Documentation/devicetree/bindings/clock/qcom,gcc-sm6350.yaml/linux/Documentation/devicetree/bindings/clock/qcom,sm6115-gpucc.yaml/linux/Documentation/devicetree/bindings/clock/qcom,sm6125-gpucc.yaml/linux/Documentation/devicetree/bindings/clock/qcom,sm6350-camcc.yaml/linux/Documentation/devicetree/bindings/clock/qcom,sm6375-dispcc.yaml/linux/Documentation/devicetree/bindings/clock/qcom,sm6375-gcc.yaml/linux/Documentation/devicetree/bindings/clock/qcom,sm6375-gpucc.yaml/linux/Documentation/devicetree/bindings/clock/qcom,sm8350-videocc.yaml/linux/Documentation/devicetree/bindings/clock/qcom,sm8450-gpucc.yaml/linux/Documentation/devicetree/bindings/display/msm/qcom,sm6375-mdss.yaml/linux/Documentation/devicetree/bindings/display/panel/asus,z00t-tm5p5-nt35596.yaml/linux/Documentation/devicetree/bindings/display/panel/samsung,atna33xc20.yaml/linux/Documentation/devicetree/bindings/display/panel/sony,td4353-jdi.yaml/linux/Documentation/devicetree/bindings/eeprom/at25.yaml/linux/Documentation/devicetree/bindings/interconnect/qcom,sc7280-rpmh.yaml/linux/Documentation/devicetree/bindings/interconnect/qcom,sc8280xp-rpmh.yaml/linux/Documentation/devicetree/bindings/interconnect/qcom,sm8450-rpmh.yaml/linux/Documentation/devicetree/bindings/iommu/qcom,iommu.yaml/linux/Documentation/devicetree/bindings/net/fsl,qoriq-mc-dpmac.yaml/linux/Documentation/devicetree/bindings/pinctrl/qcom,mdm9607-tlmm.yaml/linux/Documentation/devicetree/bindings/pinctrl/qcom,sm6350-tlmm.yaml/linux/Documentation/devicetree/bindings/pinctrl/qcom,sm6375-tlmm.yaml/linux/Documentation/devicetree/bindings/remoteproc/qcom,rpm-proc.yaml/linux/Documentation/devicetree/bindings/soc/qcom/qcom,rpm-master-stats.yaml/linux/Documentation/devicetree/bindings/sound/qcom,wcd934x.yaml/linux/Documentation/devicetree/bindings/sound/qcom,wcd937x.yaml/linux/Documentation/devicetree/bindings/sound/qcom,wcd938x.yaml/linux/Documentation/devicetree/bindings/sound/qcom,wcd939x.yaml/linux/Documentation/devicetree/bindings/usb/microchip,usb2514.yaml/linux/Documentation/filesystems/caching/fscache.rst/linux/Documentation/process/embargoed-hardware-issues.rst/linux/Documentation/virt/kvm/api.rst/linux/Documentation/wmi/devices/msi-wmi-platform.rst/linux/MAINTAINERS/linux/Makefile/linux/arch/arm/mach-pxa/gumstix.c/linux/arch/arm/mach-rpc/ecard.c/linux/arch/arm64/boot/dts/ti/k3-am62-verdin-dahlia.dtsi/linux/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi/linux/arch/arm64/boot/dts/ti/k3-am62p-j722s-common-mcu.dtsi/linux/arch/arm64/boot/dts/ti/k3-am62p-main.dtsi/linux/arch/arm64/boot/dts/ti/k3-j722s-main.dtsi/linux/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts/linux/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi/linux/arch/arm64/include/asm/kvm_ptrauth.h/linux/arch/arm64/include/asm/uaccess.h/linux/arch/arm64/kernel/acpi_numa.c/linux/arch/arm64/kernel/setup.c/linux/arch/arm64/kernel/smp.c/linux/arch/arm64/kvm/Kconfig/linux/arch/arm64/kvm/Makefile/linux/arch/arm64/kvm/arm.c/linux/arch/arm64/kvm/hyp/include/hyp/switch.h/linux/arch/arm64/kvm/hyp/nvhe/Makefile/linux/arch/arm64/kvm/hyp/nvhe/switch.c/linux/arch/arm64/kvm/hyp/vhe/Makefile/linux/arch/arm64/kvm/nested.c/linux/arch/arm64/kvm/vgic/vgic-debug.c/linux/arch/arm64/kvm/vgic/vgic-init.c/linux/arch/arm64/kvm/vgic/vgic-irqfd.c/linux/arch/arm64/kvm/vgic/vgic-its.c/linux/arch/arm64/kvm/vgic/vgic-v3.c/linux/arch/arm64/kvm/vgic/vgic.c/linux/arch/arm64/kvm/vgic/vgic.h/linux/arch/loongarch/include/asm/hugetlb.h/linux/arch/loongarch/include/asm/kfence.h/linux/arch/loongarch/include/asm/kvm_host.h/linux/arch/loongarch/include/asm/kvm_para.h/linux/arch/loongarch/include/asm/pgtable.h/linux/arch/loongarch/kernel/efi.c/linux/arch/loongarch/kvm/mmu.c/linux/arch/loongarch/mm/hugetlbpage.c/linux/arch/loongarch/mm/init.c/linux/arch/loongarch/mm/kasan_init.c/linux/arch/loongarch/mm/pgtable.c/linux/arch/mips/sgi-ip22/ip22-gio.c/linux/arch/powerpc/include/asm/topology.h/linux/arch/powerpc/kernel/setup-common.c/linux/arch/powerpc/mm/init-common.c/linux/arch/powerpc/mm/mem.c/linux/arch/riscv/include/asm/hwprobe.h/linux/arch/riscv/include/uapi/asm/hwprobe.h/linux/arch/riscv/kernel/acpi_numa.c/linux/arch/riscv/kernel/patch.c/linux/arch/riscv/kernel/sys_hwprobe.c/linux/arch/riscv/kernel/traps.c/linux/arch/riscv/kernel/traps_misaligned.c/linux/arch/riscv/kernel/unaligned_access_speed.c/linux/arch/riscv/kernel/vendor_extensions.c/linux/arch/riscv/mm/init.c/linux/arch/s390/include/asm/uv.h/linux/arch/s390/kvm/kvm-s390.h/linux/arch/x86/include/asm/kvm_host.h/linux/arch/x86/include/asm/qspinlock.h/linux/arch/x86/kernel/acpi/madt_wakeup.c/linux/arch/x86/kernel/cpu/mtrr/mtrr.c/linux/arch/x86/kernel/paravirt.c/linux/arch/x86/kvm/hyperv.h/linux/arch/x86/kvm/lapic.c/linux/arch/x86/kvm/svm/sev.c/linux/arch/x86/kvm/x86.c/linux/arch/x86/mm/pti.c/linux/block/blk-mq-tag.c/linux/block/blk-throttle.c/linux/drivers/acpi/acpica/acevents.h/linux/drivers/acpi/acpica/evregion.c/linux/drivers/acpi/acpica/evxfregn.c/linux/drivers/acpi/ec.c/linux/drivers/acpi/internal.h/linux/drivers/acpi/scan.c/linux/drivers/android/binder.c/linux/drivers/android/binder_alloc.c/linux/drivers/android/dbitmap.h/linux/drivers/ata/libata-scsi.c/linux/drivers/atm/idt77252.c/linux/drivers/base/core.c/linux/drivers/base/module.c/linux/drivers/bluetooth/hci_qca.c/linux/drivers/char/ds1620.c/linux/drivers/char/nwbutton.c/linux/drivers/char/nwflash.c/linux/drivers/char/xillybus/xillyusb.c/linux/drivers/clk/thead/clk-th1520-ap.c/linux/drivers/cpufreq/intel_pstate.c/linux/drivers/fsi/fsi-core.c/linux/drivers/fsi/fsi-master-aspeed.c/linux/drivers/fsi/fsi-master-ast-cf.c/linux/drivers/fsi/fsi-master-gpio.c/linux/drivers/fsi/fsi-master-hub.c/linux/drivers/fsi/fsi-scom.c/linux/drivers/gpio/gpio-mlxbf3.c/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.h/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c/linux/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c/linux/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c/linux/drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c/linux/drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c/linux/drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c/linux/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c/linux/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.h/linux/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c/linux/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c/linux/drivers/gpu/drm/amd/amdgpu/mes_v12_0.c/linux/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c/linux/drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c/linux/drivers/gpu/drm/amd/amdgpu/soc15d.h/linux/drivers/gpu/drm/amd/amdgpu/soc24.c/linux/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c/linux/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c/linux/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h/linux/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c/linux/drivers/gpu/drm/amd/display/dc/dml/Makefile/linux/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c/linux/drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c/linux/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c/linux/drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.c/linux/drivers/gpu/drm/amd/display/dc/resource/dcn401/dcn401_resource.h/linux/drivers/gpu/drm/amd/include/mes_v12_api_def.h/linux/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0_2_pptable.h/linux/drivers/gpu/drm/drm_atomic_uapi.c/linux/drivers/gpu/drm/drm_bridge_connector.c/linux/drivers/gpu/drm/drm_buddy.c/linux/drivers/gpu/drm/drm_client_modeset.c/linux/drivers/gpu/drm/drm_panel_orientation_quirks.c/linux/drivers/gpu/drm/i915/display/intel_backlight.c/linux/drivers/gpu/drm/i915/display/intel_pps.c/linux/drivers/gpu/drm/i915/gem/i915_gem_mman.c/linux/drivers/gpu/drm/i915/gem/i915_gem_ttm.c/linux/drivers/gpu/drm/mediatek/mtk_drm_drv.c/linux/drivers/gpu/drm/omapdrm/Kconfig/linux/drivers/gpu/drm/rockchip/inno_hdmi.c/linux/drivers/gpu/drm/tests/drm_gem_shmem_test.c/linux/drivers/gpu/drm/v3d/v3d_sched.c/linux/drivers/gpu/drm/xe/xe_device.c/linux/drivers/gpu/drm/xe/xe_device.h/linux/drivers/gpu/drm/xe/xe_device_types.h/linux/drivers/gpu/drm/xe/xe_drm_client.c/linux/drivers/gpu/drm/xe/xe_exec_queue.c/linux/drivers/gpu/drm/xe/xe_exec_queue_types.h/linux/drivers/gpu/drm/xe/xe_gt_sriov_pf_config.c/linux/drivers/gpu/drm/xe/xe_gt_sriov_vf.c/linux/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c/linux/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h/linux/drivers/gpu/drm/xe/xe_gt_tlb_invalidation_types.h/linux/drivers/gpu/drm/xe/xe_guc_ct.c/linux/drivers/gpu/drm/xe/xe_guc_submit.c/linux/drivers/gpu/drm/xe/xe_hwmon.c/linux/drivers/gpu/drm/xe/xe_lrc.c/linux/drivers/gpu/drm/xe/xe_pt.c/linux/drivers/gpu/drm/xe/xe_rtp.c/linux/drivers/gpu/drm/xe/xe_sync.c/linux/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c/linux/drivers/gpu/drm/xe/xe_vm.c/linux/drivers/i2c/busses/i2c-qcom-geni.c/linux/drivers/i2c/busses/i2c-tegra.c/linux/drivers/i2c/i2c-slave-testunit.c/linux/drivers/i2c/i2c-smbus.c/linux/drivers/iommu/io-pgfault.c/linux/drivers/irqchip/irq-riscv-aplic-msi.c/linux/drivers/irqchip/irq-xilinx-intc.c/linux/drivers/md/dm-ioctl.c/linux/drivers/md/dm.c/linux/drivers/md/persistent-data/dm-space-map-metadata.c/linux/drivers/md/raid1.c/linux/drivers/media/usb/dvb-usb/dvb-usb-init.c/linux/drivers/misc/Kconfig/linux/drivers/misc/eeprom/ee1004.c/linux/drivers/misc/fastrpc.c/linux/drivers/misc/lkdtm/refcount.c/linux/drivers/net/dsa/bcm_sf2.c/linux/drivers/net/dsa/microchip/ksz_common.c/linux/drivers/net/dsa/vitesse-vsc73xx-core.c/linux/drivers/net/ethernet/broadcom/bnxt/bnxt.c/linux/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c/linux/drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c/linux/drivers/net/ethernet/cadence/macb_main.c/linux/drivers/net/ethernet/cavium/thunder/thunder_bgx.c/linux/drivers/net/ethernet/freescale/fec_ptp.c/linux/drivers/net/ethernet/google/gve/gve_ethtool.c/linux/drivers/net/ethernet/google/gve/gve_main.c/linux/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c/linux/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c/linux/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c/linux/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c/linux/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c/linux/drivers/net/ethernet/intel/ice/ice_ethtool.c/linux/drivers/net/ethernet/intel/ice/ice_main.c/linux/drivers/net/ethernet/intel/ice/ice_ptp.c/linux/drivers/net/ethernet/intel/idpf/idpf_lib.c/linux/drivers/net/ethernet/intel/idpf/idpf_txrx.c/linux/drivers/net/ethernet/intel/igc/igc_defines.h/linux/drivers/net/ethernet/intel/igc/igc_main.c/linux/drivers/net/ethernet/intel/igc/igc_tsn.c/linux/drivers/net/ethernet/intel/igc/igc_tsn.h/linux/drivers/net/ethernet/jme.c/linux/drivers/net/ethernet/mediatek/mtk_wed.c/linux/drivers/net/ethernet/mellanox/mlx5/core/en.h/linux/drivers/net/ethernet/mellanox/mlx5/core/en/params.c/linux/drivers/net/ethernet/mellanox/mlx5/core/en/params.h/linux/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c/linux/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c/linux/drivers/net/ethernet/mellanox/mlx5/core/en_main.c/linux/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c/linux/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h/linux/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c/linux/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_regs.h/linux/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c/linux/drivers/net/ethernet/microsoft/mana/mana_en.c/linux/drivers/net/ethernet/stmicro/stmmac/dwmac4.h/linux/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c/linux/drivers/net/ethernet/xilinx/xilinx_axienet.h/linux/drivers/net/gtp.c/linux/drivers/net/phy/vitesse.c/linux/drivers/net/pse-pd/pse_core.c/linux/drivers/net/pse-pd/tps23881.c/linux/drivers/net/usb/ipheth.c/linux/drivers/net/usb/qmi_wwan.c/linux/drivers/net/virtio_net.c/linux/drivers/net/wireless/ath/ath12k/dp_tx.c/linux/drivers/net/wireless/ath/ath12k/hw.c/linux/drivers/net/wireless/ath/ath12k/hw.h/linux/drivers/net/wireless/ath/ath12k/mac.c/linux/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c/linux/drivers/net/wireless/intel/iwlwifi/pcie/internal.h/linux/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c/linux/drivers/net/wireless/intel/iwlwifi/pcie/tx.c/linux/drivers/net/wireless/mediatek/mt76/mt7921/main.c/linux/drivers/net/wireless/realtek/rtlwifi/rtl8192du/hw.c/linux/drivers/nvdimm/pmem.c/linux/drivers/nvme/host/core.c/linux/drivers/nvme/host/nvme.h/linux/drivers/of/irq.c/linux/drivers/platform/cznic/Kconfig/linux/drivers/platform/cznic/Makefile/linux/drivers/platform/cznic/turris-omnia-mcu-base.c/linux/drivers/platform/cznic/turris-omnia-mcu.h/linux/drivers/platform/x86/Kconfig/linux/drivers/platform/x86/amd/pmc/pmc.c/linux/drivers/platform/x86/amd/pmc/pmc.h/linux/drivers/platform/x86/amd/pmf/core.c/linux/drivers/platform/x86/amd/pmf/pmf-quirks.c/linux/drivers/platform/x86/amd/pmf/spc.c/linux/drivers/platform/x86/ideapad-laptop.c/linux/drivers/platform/x86/ideapad-laptop.h/linux/drivers/platform/x86/intel/ifs/runtest.c/linux/drivers/platform/x86/intel/vbtn.c/linux/drivers/platform/x86/lenovo-ymc.c/linux/drivers/power/supply/axp288_charger.c/linux/drivers/power/supply/qcom_battmgr.c/linux/drivers/power/supply/rt5033_battery.c/linux/drivers/s390/block/dasd.c/linux/drivers/s390/block/dasd_3990_erp.c/linux/drivers/s390/block/dasd_eckd.c/linux/drivers/s390/block/dasd_genhd.c/linux/drivers/s390/block/dasd_int.h/linux/drivers/scsi/mpi3mr/mpi3mr_app.c/linux/drivers/scsi/mpi3mr/mpi3mr_os.c/linux/drivers/scsi/sd.c/linux/drivers/soc/fsl/qbman/qman.c/linux/drivers/spi/spi-fsl-lpspi.c/linux/drivers/spi/spi-hisi-kunpeng.c/linux/drivers/spi/spidev.c/linux/drivers/spmi/spmi-pmic-arb.c/linux/drivers/staging/media/atomisp/pci/ia_css_stream_public.h/linux/drivers/staging/media/atomisp/pci/sh_css_internal.h/linux/drivers/thermal/gov_bang_bang.c/linux/drivers/thermal/thermal_core.c/linux/drivers/thunderbolt/debugfs.c/linux/drivers/thunderbolt/switch.c/linux/drivers/tty/serial/8250/8250_omap.c/linux/drivers/tty/serial/atmel_serial.c/linux/drivers/tty/serial/fsl_lpuart.c/linux/drivers/tty/serial/sc16is7xx.c/linux/drivers/tty/serial/serial_core.c/linux/drivers/tty/vt/conmakehash.c/linux/drivers/ufs/core/ufshcd.c/linux/drivers/usb/gadget/function/f_fs.c/linux/drivers/usb/gadget/function/f_midi2.c/linux/drivers/usb/gadget/function/u_audio.c/linux/drivers/usb/gadget/function/u_serial.c/linux/drivers/usb/gadget/udc/core.c/linux/drivers/usb/host/xhci-mem.c/linux/drivers/usb/host/xhci-ring.c/linux/drivers/usb/host/xhci.c/linux/drivers/usb/misc/usb-ljca.c/linux/drivers/usb/serial/ch341.c/linux/drivers/usb/serial/garmin_gps.c/linux/drivers/usb/serial/mxuport.c/linux/drivers/usb/serial/navman.c/linux/drivers/usb/serial/qcaux.c/linux/drivers/usb/serial/spcp8x5.c/linux/drivers/usb/serial/symbolserial.c/linux/drivers/usb/serial/usb-serial-simple.c/linux/drivers/usb/serial/usb_debug.c/linux/drivers/usb/typec/mux/fsa4480.c/linux/drivers/usb/typec/tcpm/tcpci.c/linux/drivers/usb/typec/tcpm/tcpm.c/linux/drivers/usb/typec/tipd/core.c/linux/drivers/usb/typec/ucsi/ucsi.c/linux/drivers/usb/usbip/vhci_hcd.c/linux/drivers/vhost/vdpa.c/linux/fs/9p/vfs_addr.c/linux/fs/afs/file.c/linux/fs/bcachefs/acl.c/linux/fs/bcachefs/acl.h/linux/fs/bcachefs/alloc_background.c/linux/fs/bcachefs/alloc_background.h/linux/fs/bcachefs/alloc_foreground.c/linux/fs/bcachefs/alloc_foreground.h/linux/fs/bcachefs/backpointers.c/linux/fs/bcachefs/backpointers.h/linux/fs/bcachefs/bcachefs.h/linux/fs/bcachefs/bcachefs_format.h/linux/fs/bcachefs/bkey.h/linux/fs/bcachefs/bkey_methods.c/linux/fs/bcachefs/bkey_methods.h/linux/fs/bcachefs/btree_gc.c/linux/fs/bcachefs/btree_io.c/linux/fs/bcachefs/btree_iter.c/linux/fs/bcachefs/btree_iter.h/linux/fs/bcachefs/btree_key_cache.c/linux/fs/bcachefs/btree_key_cache.h/linux/fs/bcachefs/btree_node_scan.c/linux/fs/bcachefs/btree_trans_commit.c/linux/fs/bcachefs/btree_update_interior.c/linux/fs/bcachefs/buckets.c/linux/fs/bcachefs/buckets.h/linux/fs/bcachefs/buckets_waiting_for_journal.c/linux/fs/bcachefs/data_update.c/linux/fs/bcachefs/debug.c/linux/fs/bcachefs/dirent.c/linux/fs/bcachefs/dirent.h/linux/fs/bcachefs/disk_accounting.c/linux/fs/bcachefs/disk_accounting.h/linux/fs/bcachefs/disk_accounting_format.h/linux/fs/bcachefs/ec.c/linux/fs/bcachefs/ec.h/linux/fs/bcachefs/errcode.h/linux/fs/bcachefs/error.c/linux/fs/bcachefs/error.h/linux/fs/bcachefs/extents.c/linux/fs/bcachefs/extents.h/linux/fs/bcachefs/fs.c/linux/fs/bcachefs/inode.c/linux/fs/bcachefs/inode.h/linux/fs/bcachefs/io_misc.c/linux/fs/bcachefs/io_read.c/linux/fs/bcachefs/io_write.c/linux/fs/bcachefs/journal_io.c/linux/fs/bcachefs/lru.c/linux/fs/bcachefs/lru.h/linux/fs/bcachefs/opts.h/linux/fs/bcachefs/quota.c/linux/fs/bcachefs/quota.h/linux/fs/bcachefs/reflink.c/linux/fs/bcachefs/reflink.h/linux/fs/bcachefs/replicas.c/linux/fs/bcachefs/sb-downgrade.c/linux/fs/bcachefs/sb-errors_format.h/linux/fs/bcachefs/snapshot.c/linux/fs/bcachefs/snapshot.h/linux/fs/bcachefs/subvolume.c/linux/fs/bcachefs/subvolume.h/linux/fs/bcachefs/super-io.c/linux/fs/bcachefs/super.c/linux/fs/bcachefs/sysfs.c/linux/fs/bcachefs/trace.c/linux/fs/bcachefs/trace.h/linux/fs/bcachefs/xattr.c/linux/fs/bcachefs/xattr.h/linux/fs/binfmt_flat.c/linux/fs/btrfs/delayed-ref.c/linux/fs/btrfs/delayed-ref.h/linux/fs/btrfs/extent-tree.c/linux/fs/btrfs/extent_io.c/linux/fs/btrfs/extent_map.c/linux/fs/btrfs/file.c/linux/fs/btrfs/free-space-cache.c/linux/fs/btrfs/inode.c/linux/fs/btrfs/print-tree.c/linux/fs/btrfs/scrub.c/linux/fs/btrfs/send.c/linux/fs/btrfs/super.c/linux/fs/btrfs/tree-checker.c/linux/fs/ceph/addr.c/linux/fs/ceph/inode.c/linux/fs/exec.c/linux/fs/file.c/linux/fs/fuse/dev.c/linux/fs/inode.c/linux/fs/libfs.c/linux/fs/locks.c/linux/fs/netfs/Kconfig/linux/fs/netfs/buffered_read.c/linux/fs/netfs/buffered_write.c/linux/fs/netfs/fscache_cookie.c/linux/fs/netfs/io.c/linux/fs/netfs/objects.c/linux/fs/netfs/write_issue.c/linux/fs/nfs/fscache.c/linux/fs/nfs/fscache.h/linux/fs/nfsd/nfsctl.c/linux/fs/smb/client/cifs_debug.c/linux/fs/smb/client/cifsglob.h/linux/fs/smb/client/file.c/linux/fs/smb/client/misc.c/linux/fs/smb/client/smb2pdu.c/linux/fs/smb/client/smbdirect.c/linux/fs/smb/client/transport.c/linux/fs/smb/common/smb2pdu.h/linux/fs/smb/server/mgmt/share_config.c/linux/fs/smb/server/mgmt/share_config.h/linux/fs/smb/server/mgmt/tree_connect.c/linux/fs/smb/server/mgmt/tree_connect.h/linux/fs/smb/server/smb2pdu.c/linux/fs/smb/server/smb_common.c/linux/fs/smb/server/smb_common.h/linux/fs/squashfs/inode.cevent_inode.c/linux/fs/xfs/scrub/bmap.c/linux/fs/xfs/xfs_ioctl.c/linux/fs/xfs/xfs_trans_ail.c/linux/include/acpi/acpixf.h/linux/include/drm/drm_buddy.h/linux/include/linux/bitmap.h/linux/include/linux/bpf_verifier.h/linux/include/linux/cpumask.h/linux/include/linux/ethtool.h/linux/include/linux/file.h/linux/include/linux/fs.h/linux/include/linux/hugetlb.h/linux/include/linux/i2c.h/linux/include/linux/iommu.h/linux/include/linux/kvm_host.h/linux/include/linux/mm.h/linux/include/linux/mmzone.h/linux/include/linux/netfs.h/linux/include/linux/pgalloc_tag.h/linux/include/linux/refcount.h/linux/include/linux/spi/spi.h/linux/include/linux/thermal.h/linux/include/linux/trace_events.h/linux/include/linux/vmstat.h/linux/include/net/af_vsock.h/linux/include/net/mana/mana.h/linux/include/sound/cs35l56.h/linux/include/sound/soc-component.h/linux/include/trace/events/netfs.h/linux/include/uapi/linux/io_uring.h/linux/include/uapi/linux/nsfs.h/linux/include/uapi/linux/psp-sev.h/linux/include/uapi/misc/fastrpc.h/linux/init/Kconfig/linux/io_uring/napi.c/linux/io_uring/napi.h/linux/io_uring/net.c/linux/io_uring/sqpoll.c/linux/kernel/bpf/verifier.c/linux/kernel/cpu.c/linux/kernel/crash_reserve.c/linux/kernel/dma/debug.c/linux/kernel/events/core.c/linux/kernel/fork.c/linux/kernel/irq/irqdesc.c/linux/kernel/kallsyms.c/linux/kernel/kallsyms_selftest.c/linux/kernel/kcov.c/linux/kernel/kprobes.c/linux/kernel/locking/lockdep.c/linux/kernel/module/main.c/linux/kernel/padata.c/linux/kernel/time/ntp.c/linux/kernel/time/timekeeping.c/linux/kernel/trace/fgraph.c/linux/kernel/trace/trace.c/linux/kernel/trace/trace_selftest.c/linux/lib/generic-radix-tree.c/linux/lib/overflow_kunit.c/linux/mm/huge_memory.c/linux/mm/hugetlb_vmemmap.c/linux/mm/list_lru.c/linux/mm/memcontrol-v1.c/linux/mm/memcontrol.c/linux/mm/memory-failure.c/linux/mm/memory.c/linux/mm/migrate.c/linux/mm/mm_init.c/linux/mm/mseal.c/linux/mm/page_alloc.c/linux/mm/page_ext.c/linux/mm/shmem.c/linux/mm/slub.c/linux/mm/sparse-vmemmap.c/linux/mm/sparse.c/linux/mm/vmalloc.c/linux/mm/vmstat.c/linux/net/bluetooth/hci_sync.c/linux/net/bluetooth/l2cap_core.c/linux/net/bridge/br_multicast.c/linux/net/bridge/br_netfilter_hooks.c/linux/net/core/dev.c/linux/net/core/link_watch.c/linux/net/ethtool/cmis_fw_update.c/linux/net/ethtool/ioctl.c/linux/net/ipv4/tcp_ao.c/linux/net/ipv4/tcp_input.c/linux/net/ipv4/udp_offload.c/linux/net/ipv6/netfilter/nf_conntrack_reasm.c/linux/net/l2tp/l2tp_core.c/linux/net/mptcp/diag.c/linux/net/mptcp/options.c/linux/net/mptcp/pm_netlink.c/linux/net/netfilter/nf_flow_table_offload.c/linux/net/netfilter/nf_tables_api.c/linux/net/netfilter/nfnetlink.c/linux/net/netfilter/nfnetlink_queue.c/linux/net/sctp/input.c/linux/net/smc/smc_stats.h/linux/net/sunrpc/svc.c/linux/net/vmw_vsock/af_vsock.c/linux/net/vmw_vsock/vsock_bpf.c/linux/rust/Makefile/linux/rust/compiler_builtins.rs/linux/rust/kernel/firmware.rs/linux/rust/macros/lib.rs/linux/scripts/gcc-plugins/randomize_layout_plugin.c/linux/scripts/generate_rust_analyzer.py/linux/scripts/generate_rust_target.rs/linux/scripts/kallsyms.c/linux/scripts/link-vmlinux.sh/linux/scripts/syscall.tbl/linux/security/keys/trusted-keys/trusted_dcp.c/linux/security/selinux/avc.c/linux/security/selinux/hooks.c/linux/sound/core/timer.c/linux/sound/pci/hda/cs35l41_hda.c/linux/sound/pci/hda/cs35l56_hda.c/linux/sound/pci/hda/cs35l56_hda.h/linux/sound/pci/hda/patch_hdmi.c/linux/sound/pci/hda/patch_realtek.c/linux/sound/pci/hda/tas2781_hda_i2c.c/linux/sound/soc/amd/yc/acp6x-mach.c/linux/sound/soc/codecs/cs-amp-lib.c/linux/sound/soc/codecs/cs35l45.c/linux/sound/soc/codecs/cs35l56-sdw.c/linux/sound/soc/codecs/cs35l56-shared.c/linux/sound/soc/codecs/cs35l56.c/linux/sound/soc/codecs/cs42l43.c/linux/sound/soc/codecs/cs42l43.h/linux/sound/soc/codecs/cs530x.c/linux/sound/soc/codecs/es8326.c/linux/sound/soc/codecs/lpass-va-macro.c/linux/sound/soc/codecs/nau8822.c/linux/sound/soc/codecs/wcd937x-sdw.c/linux/sound/soc/codecs/wcd938x-sdw.c/linux/sound/soc/codecs/wcd939x-sdw.c/linux/sound/soc/codecs/wm_adsp.c/linux/sound/soc/codecs/wm_adsp.h/linux/sound/soc/codecs/wsa881x.c/linux/sound/soc/codecs/wsa883x.c/linux/sound/soc/codecs/wsa884x.c/linux/sound/soc/fsl/fsl_micfil.c/linux/sound/soc/fsl/fsl_micfil.h/linux/sound/soc/meson/axg-fifo.c/linux/sound/soc/soc-component.c/linux/sound/soc/sof/mediatek/mt8195/mt8195.c/linux/sound/soc/sti/sti_uniperif.c/linux/sound/soc/sti/uniperif.h/linux/sound/soc/sti/uniperif_player.c/linux/sound/soc/sti/uniperif_reader.c/linux/sound/usb/line6/driver.c/linux/sound/usb/quirks-table.h/linux/sound/usb/quirks.c/linux/tools/arch/arm64/include/asm/cputype.h/linux/tools/arch/powerpc/include/uapi/asm/kvm.h/linux/tools/arch/x86/include/asm/cpufeatures.h/linux/tools/arch/x86/include/asm/msr-index.h/linux/tools/arch/x86/include/uapi/asm/kvm.h/linux/tools/arch/x86/include/uapi/asm/svm.h/linux/tools/include/uapi/README/linux/tools/include/uapi/asm-generic/unistd.h/linux/tools/include/uapi/drm/i915_drm.h/linux/tools/include/uapi/linux/in.h/linux/tools/include/uapi/linux/kvm.h/linux/tools/include/uapi/linux/perf_event.h/linux/tools/include/uapi/linux/stat.h/linux/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl/linux/tools/perf/arch/s390/entry/syscalls/syscall.tbl/linux/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl/linux/tools/perf/builtin-daemon.c/linux/tools/perf/trace/beauty/include/linux/socket.h/linux/tools/perf/trace/beauty/include/uapi/linux/fs.h/linux/tools/perf/trace/beauty/include/uapi/linux/mount.h/linux/tools/perf/trace/beauty/include/uapi/linux/stat.h/linux/tools/perf/trace/beauty/include/uapi/sound/asound.h/linux/tools/testing/selftests/bpf/progs/iters.c/linux/tools/testing/selftests/core/close_range_test.c/linux/tools/testing/selftests/kselftest/ksft.py/linux/tools/testing/selftests/kvm/aarch64/get-reg-list.c/linux/tools/testing/selftests/kvm/x86_64/xapic_state_test.c/linux/tools/testing/selftests/mm/Makefile/linux/tools/testing/selftests/mm/compaction_test.c/linux/tools/testing/selftests/mm/run_vmtests.sh/linux/tools/testing/selftests/net/af_unix/msg_oob.c/linux/tools/testing/selftests/net/lib.sh/linux/tools/testing/selftests/net/mptcp/mptcp_join.sh/linux/tools/testing/selftests/net/netfilter/Makefile/linux/tools/testing/selftests/net/netfilter/br_netfilter_queue.sh/linux/tools/testing/selftests/net/udpgso.c/linux/tools/tracing/rtla/src/osnoise_top.c/linux/virt/kvm/eventfd.c/linux/virt/kvm/kvm_main.c |
0b6743bd | 08-Aug-2024 |
Steven Rostedt <rostedt@goodmis.org> |
tracefs: Use generic inode RCU for synchronizing freeing
With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-once membe
tracefs: Use generic inode RCU for synchronizing freeing
With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-once members, e.g. i_lru or i_sb_list to not corrupt related list traversals when making use of the rcu_head.
For an unlucky structure layout of 'struct inode' we may end up with the following splat when running the ftrace selftests:
[<...>] list_del corruption, ffff888103ee2cb0->next (tracefs_inode_cache+0x0/0x4e0 [slab object]) is NULL (prev is tracefs_inode_cache+0x78/0x4e0 [slab object]) [<...>] ------------[ cut here ]------------ [<...>] kernel BUG at lib/list_debug.c:54! [<...>] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [<...>] CPU: 3 PID: 2550 Comm: mount Tainted: G N 6.8.12-grsec+ #122 ed2f536ca62f28b087b90e3cc906a8d25b3ddc65 [<...>] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [<...>] RIP: 0010:[<ffffffff84656018>] __list_del_entry_valid_or_report+0x138/0x3e0 [<...>] Code: 48 b8 99 fb 65 f2 ff ff ff ff e9 03 5c d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff e9 33 5a d9 fc cc 48 b8 99 fb 65 f2 ff ff ff ff <0f> 0b 4c 89 e9 48 89 ea 48 89 ee 48 c7 c7 60 8f dd 89 31 c0 e8 2f [<...>] RSP: 0018:fffffe80416afaf0 EFLAGS: 00010283 [<...>] RAX: 0000000000000098 RBX: ffff888103ee2cb0 RCX: 0000000000000000 [<...>] RDX: ffffffff84655fe8 RSI: ffffffff89dd8b60 RDI: 0000000000000001 [<...>] RBP: ffff888103ee2cb0 R08: 0000000000000001 R09: fffffbd0082d5f25 [<...>] R10: fffffe80416af92f R11: 0000000000000001 R12: fdf99c16731d9b6d [<...>] R13: 0000000000000000 R14: ffff88819ad4b8b8 R15: 0000000000000000 [<...>] RBX: tracefs_inode_cache+0x0/0x4e0 [slab object] [<...>] RDX: __list_del_entry_valid_or_report+0x108/0x3e0 [<...>] RSI: __func__.47+0x4340/0x4400 [<...>] RBP: tracefs_inode_cache+0x0/0x4e0 [slab object] [<...>] RSP: process kstack fffffe80416afaf0+0x7af0/0x8000 [mount 2550 2550] [<...>] R09: kasan shadow of process kstack fffffe80416af928+0x7928/0x8000 [mount 2550 2550] [<...>] R10: process kstack fffffe80416af92f+0x792f/0x8000 [mount 2550 2550] [<...>] R14: tracefs_inode_cache+0x78/0x4e0 [slab object] [<...>] FS: 00006dcb380c1840(0000) GS:ffff8881e0600000(0000) knlGS:0000000000000000 [<...>] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [<...>] CR2: 000076ab72b30e84 CR3: 000000000b088004 CR4: 0000000000360ef0 shadow CR4: 0000000000360ef0 [<...>] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [<...>] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [<...>] ASID: 0003 [<...>] Stack: [<...>] ffffffff818a2315 00000000f5c856ee ffffffff896f1840 ffff888103ee2cb0 [<...>] ffff88812b6b9750 0000000079d714b6 fffffbfff1e9280b ffffffff8f49405f [<...>] 0000000000000001 0000000000000000 ffff888104457280 ffffffff8248b392 [<...>] Call Trace: [<...>] <TASK> [<...>] [<ffffffff818a2315>] ? lock_release+0x175/0x380 fffffe80416afaf0 [<...>] [<ffffffff8248b392>] list_lru_del+0x152/0x740 fffffe80416afb48 [<...>] [<ffffffff8248ba93>] list_lru_del_obj+0x113/0x280 fffffe80416afb88 [<...>] [<ffffffff8940fd19>] ? _atomic_dec_and_lock+0x119/0x200 fffffe80416afb90 [<...>] [<ffffffff8295b244>] iput_final+0x1c4/0x9a0 fffffe80416afbb8 [<...>] [<ffffffff8293a52b>] dentry_unlink_inode+0x44b/0xaa0 fffffe80416afbf8 [<...>] [<ffffffff8293fefc>] __dentry_kill+0x23c/0xf00 fffffe80416afc40 [<...>] [<ffffffff8953a85f>] ? __this_cpu_preempt_check+0x1f/0xa0 fffffe80416afc48 [<...>] [<ffffffff82949ce5>] ? shrink_dentry_list+0x1c5/0x760 fffffe80416afc70 [<...>] [<ffffffff82949b71>] ? shrink_dentry_list+0x51/0x760 fffffe80416afc78 [<...>] [<ffffffff82949da8>] shrink_dentry_list+0x288/0x760 fffffe80416afc80 [<...>] [<ffffffff8294ae75>] shrink_dcache_sb+0x155/0x420 fffffe80416afcc8 [<...>] [<ffffffff8953a7c3>] ? debug_smp_processor_id+0x23/0xa0 fffffe80416afce0 [<...>] [<ffffffff8294ad20>] ? do_one_tree+0x140/0x140 fffffe80416afcf8 [<...>] [<ffffffff82997349>] ? do_remount+0x329/0xa00 fffffe80416afd18 [<...>] [<ffffffff83ebf7a1>] ? security_sb_remount+0x81/0x1c0 fffffe80416afd38 [<...>] [<ffffffff82892096>] reconfigure_super+0x856/0x14e0 fffffe80416afd70 [<...>] [<ffffffff815d1327>] ? ns_capable_common+0xe7/0x2a0 fffffe80416afd90 [<...>] [<ffffffff82997436>] do_remount+0x416/0xa00 fffffe80416afdd0 [<...>] [<ffffffff829b2ba4>] path_mount+0x5c4/0x900 fffffe80416afe28 [<...>] [<ffffffff829b25e0>] ? finish_automount+0x13a0/0x13a0 fffffe80416afe60 [<...>] [<ffffffff82903812>] ? user_path_at_empty+0xb2/0x140 fffffe80416afe88 [<...>] [<ffffffff829b2ff5>] do_mount+0x115/0x1c0 fffffe80416afeb8 [<...>] [<ffffffff829b2ee0>] ? path_mount+0x900/0x900 fffffe80416afed8 [<...>] [<ffffffff8272461c>] ? __kasan_check_write+0x1c/0xa0 fffffe80416afee0 [<...>] [<ffffffff829b31cf>] __do_sys_mount+0x12f/0x280 fffffe80416aff30 [<...>] [<ffffffff829b36cd>] __x64_sys_mount+0xcd/0x2e0 fffffe80416aff70 [<...>] [<ffffffff819f8818>] ? syscall_trace_enter+0x218/0x380 fffffe80416aff88 [<...>] [<ffffffff8111655e>] x64_sys_call+0x5d5e/0x6720 fffffe80416affa8 [<...>] [<ffffffff8952756d>] do_syscall_64+0xcd/0x3c0 fffffe80416affb8 [<...>] [<ffffffff8100119b>] entry_SYSCALL_64_safe_stack+0x4c/0x87 fffffe80416affe8 [<...>] </TASK> [<...>] <PTREGS> [<...>] RIP: 0033:[<00006dcb382ff66a>] vm_area_struct[mount 2550 2550 file 6dcb38225000-6dcb3837e000 22 55(read|exec|mayread|mayexec)]+0x0/0xb8 [userland map] [<...>] Code: 48 8b 0d 29 18 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f6 17 0d 00 f7 d8 64 89 01 48 [<...>] RSP: 002b:0000763d68192558 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [<...>] RAX: ffffffffffffffda RBX: 00006dcb38433264 RCX: 00006dcb382ff66a [<...>] RDX: 000017c3e0d11210 RSI: 000017c3e0d1a5a0 RDI: 000017c3e0d1ae70 [<...>] RBP: 000017c3e0d10fb0 R08: 000017c3e0d11260 R09: 00006dcb383d1be0 [<...>] R10: 000000000020002e R11: 0000000000000246 R12: 0000000000000000 [<...>] R13: 000017c3e0d1ae70 R14: 000017c3e0d11210 R15: 000017c3e0d10fb0 [<...>] RBX: vm_area_struct[mount 2550 2550 file 6dcb38433000-6dcb38434000 5b 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RCX: vm_area_struct[mount 2550 2550 file 6dcb38225000-6dcb3837e000 22 55(read|exec|mayread|mayexec)]+0x0/0xb8 [userland map] [<...>] RDX: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RSI: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RDI: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RBP: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] RSP: vm_area_struct[mount 2550 2550 anon 763d68173000-763d68195000 7ffffffdd 100133(read|write|mayread|maywrite|growsdown|account)]+0x0/0xb8 [userland map] [<...>] R08: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R09: vm_area_struct[mount 2550 2550 file 6dcb383d1000-6dcb383d3000 1cd 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R13: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R14: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] R15: vm_area_struct[mount 2550 2550 anon 17c3e0d0f000-17c3e0d31000 17c3e0d0f 100033(read|write|mayread|maywrite|account)]+0x0/0xb8 [userland map] [<...>] </PTREGS> [<...>] Modules linked in: [<...>] ---[ end trace 0000000000000000 ]---
The list debug message as well as RBX's symbolic value point out that the object in question was allocated from 'tracefs_inode_cache' and that the list's '->next' member is at offset 0. Dumping the layout of the relevant parts of 'struct tracefs_inode' gives the following:
struct tracefs_inode { union { struct inode { struct list_head { struct list_head * next; /* 0 8 */ struct list_head * prev; /* 8 8 */ } i_lru; [...] } vfs_inode; struct callback_head { void (*func)(struct callback_head *); /* 0 8 */ struct callback_head * next; /* 8 8 */ } rcu; }; [...] };
Above shows that 'vfs_inode.i_lru' overlaps with 'rcu' which will destroy the 'i_lru' list as soon as the 'rcu' member gets used, e.g. in call_rcu() or later when calling the RCU callback. This will disturb concurrent list traversals as well as object reuse which assumes these list heads will keep their integrity.
For reproduction, the following diff manually overlays 'i_lru' with 'rcu' as, otherwise, one would require some good portion of luck for gambling an unlucky RANDSTRUCT seed:
--- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -629,6 +629,7 @@ struct inode { umode_t i_mode; unsigned short i_opflags; kuid_t i_uid; + struct list_head i_lru; /* inode LRU list */ kgid_t i_gid; unsigned int i_flags;
@@ -690,7 +691,6 @@ struct inode { u16 i_wb_frn_avg_time; u16 i_wb_frn_history; #endif - struct list_head i_lru; /* inode LRU list */ struct list_head i_sb_list; struct list_head i_wb_list; /* backing dev writeback list */ union {
The tracefs inode does not need to supply its own RCU delayed destruction of its inode. The inode code itself offers both a "destroy_inode()" callback that gets called when the last reference of the inode is released, and the "free_inode()" which is called after a RCU synchronization period from the "destroy_inode()".
The tracefs code can unlink the inode from its list in the destroy_inode() callback, and the simply free it from the free_inode() callback. This should provide the same protection.
Link: https://lore.kernel.org/all/20240807115143.45927-3-minipli@grsecurity.net/
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Ajay Kaher <ajay.kaher@broadcom.com> Cc: Ilkka =?utf-8?b?TmF1bGFww6TDpA==?= <digirigawa@gmail.com> Link: https://lore.kernel.org/20240807185402.61410544@gandalf.local.home Fixes: baa23a8d4360 ("tracefs: Reset permissions on remount if permissions are options") Reported-by: Mathias Krause <minipli@grsecurity.net> Reported-by: Brad Spengler <spender@grsecurity.net> Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
8e556432 | 23-Jul-2024 |
Mathias Krause <minipli@grsecurity.net> |
eventfs: Use SRCU for freeing eventfs_inodes
To mirror the SRCU lock held in eventfs_iterate() when iterating over eventfs inodes, use call_srcu() to free them too.
This was accidentally(?) degrade
eventfs: Use SRCU for freeing eventfs_inodes
To mirror the SRCU lock held in eventfs_iterate() when iterating over eventfs inodes, use call_srcu() to free them too.
This was accidentally(?) degraded to RCU in commit 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts").
Cc: Ajay Kaher <ajay.kaher@broadcom.com> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20240723210755.8970-1-minipli@grsecurity.net Fixes: 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts") Signed-off-by: Mathias Krause <minipli@grsecurity.net> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
12c20c65 | 23-Jul-2024 |
Mathias Krause <minipli@grsecurity.net> |
eventfs: Don't return NULL in eventfs_create_dir()
Commit 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry") added another check, testing if the parent was freed after we rele
eventfs: Don't return NULL in eventfs_create_dir()
Commit 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry") added another check, testing if the parent was freed after we released the mutex. If so, the function returns NULL. However, all callers expect it to either return a valid pointer or an error pointer, at least since commit 5264a2f4bb3b ("tracing: Fix a NULL vs IS_ERR() bug in event_subsystem_dir()"). Returning NULL will therefore fail the error condition check in the caller.
Fix this by substituting the NULL return value with a fitting error pointer.
Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: stable@vger.kernel.org Fixes: 77a06c33a22d ("eventfs: Test for ei->is_freed when accessing ei->dentry") Link: https://lore.kernel.org/20240723122522.2724-1-minipli@grsecurity.net Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Ajay Kaher <ajay.kaher@broadcom.com> Signed-off-by: Mathias Krause <minipli@grsecurity.net> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
2dd00ac1 | 22-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
eventfs: Do not use attributes for events directory
The top "events" directory has a static inode (it's created when it is and removed when the directory is removed). There's no need to use the even
eventfs: Do not use attributes for events directory
The top "events" directory has a static inode (it's created when it is and removed when the directory is removed). There's no need to use the events ei->attr to determine its permissions. But it is used for saving the permissions of the "events" directory for when it is created, as that is needed for the default permissions for the files and directories underneath it.
For example:
# cd /sys/kernel/tracing # mkdir instances/foo # chown 1001 instances/foo/events
The files under instances/foo/events should still have the same owner as instances/foo (which the instances/foo/events ei->attr will hold), but the events directory now has owner 1001.
Link: https://lore.kernel.org/lkml/20240522165032.104981011@goodmis.org
Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
6e3d7c90 | 22-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
eventfs: Cleanup permissions in creation of inodes
The permissions being set during the creation of the inodes was updating eventfs_inode attributes as well. Those attributes should only be touched
eventfs: Cleanup permissions in creation of inodes
The permissions being set during the creation of the inodes was updating eventfs_inode attributes as well. Those attributes should only be touched by the setattr or remount operations, not during the creation of inodes. The eventfs_inode attributes should only be used to set the inodes and should not be modified during the inode creation.
Simplify the code and fix the situation by:
1) Removing the eventfs_find_events() and doing a simple lookup for the events descriptor in eventfs_get_inode()
2) Remove update_events_attr() as the attributes should only be used to update the inode and should not be modified here.
3) Add update_inode_attr() that uses the attributes to determine what the inode permissions should be.
4) As the parent_inode of the eventfs_root_inode structure is no longer needed, remove it.
Now on creation, the inode gets the proper permissions without causing side effects to the ei->attr field.
Link: https://lore.kernel.org/lkml/20240522165031.944088388@goodmis.org
Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
37cd0d12 | 22-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
eventfs: Remove getattr and permission callbacks
Now that inodes have their permissions updated on remount, the only other places to update the inode permissions are when they are created and in the
eventfs: Remove getattr and permission callbacks
Now that inodes have their permissions updated on remount, the only other places to update the inode permissions are when they are created and in the setattr callback. The getattr and permission callbacks are not needed as the inodes should already be set at their proper settings.
Remove the callbacks, as it not only simplifies the code, but also allows more flexibility to fix the inconsistencies with various corner cases (like changing the permission of an instance directory).
Link: https://lore.kernel.org/lkml/20240522165031.782066021@goodmis.org
Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
625acf9d | 22-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
eventfs: Consolidate the eventfs_inode update in eventfs_get_inode()
To simplify the code, create a eventfs_get_inode() that is used when an eventfs file or directory is created. Have the internal t
eventfs: Consolidate the eventfs_inode update in eventfs_get_inode()
To simplify the code, create a eventfs_get_inode() that is used when an eventfs file or directory is created. Have the internal tracefs_inode updated the appropriate flags in this function and update the inode's mode as well.
Link: https://lore.kernel.org/lkml/20240522165031.624864160@goodmis.org
Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
0bcfd9aa | 23-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
tracefs: Clear EVENT_INODE flag in tracefs_drop_inode()
When the inode is being dropped from the dentry, the TRACEFS_EVENT_INODE flag needs to be cleared to prevent a remount from calling eventfs_re
tracefs: Clear EVENT_INODE flag in tracefs_drop_inode()
When the inode is being dropped from the dentry, the TRACEFS_EVENT_INODE flag needs to be cleared to prevent a remount from calling eventfs_remount() on the tracefs_inode private data. There's a race between the inode is dropped (and the dentry freed) to where the inode is actually freed. If a remount happens between the two, the eventfs_inode could be accessed after it is freed (only the dentry keeps a ref count on it).
Currently the TRACEFS_EVENT_INODE flag is cleared from the dentry iput() function. But this is incorrect, as it is possible that the inode has another reference to it. The flag should only be cleared when the inode is really being dropped and has no more references. That happens in the drop_inode callback of the inode, as that gets called when the last reference of the inode is released.
Remove the tracefs_d_iput() function and move its logic to the more appropriate tracefs_drop_inode() callback function.
Link: https://lore.kernel.org/linux-trace-kernel/20240523051539.908205106@goodmis.org
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Masahiro Yamada <masahiroy@kernel.org> Fixes: baa23a8d4360d ("tracefs: Reset permissions on remount if permissions are options") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
340f0c70 | 23-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
eventfs: Update all the eventfs_inodes from the events descriptor
The change to update the permissions of the eventfs_inode had the misconception that using the tracefs_inode would find all the even
eventfs: Update all the eventfs_inodes from the events descriptor
The change to update the permissions of the eventfs_inode had the misconception that using the tracefs_inode would find all the eventfs_inodes that have been updated and reset them on remount. The problem with this approach is that the eventfs_inodes are freed when they are no longer used (basically the reason the eventfs system exists). When they are freed, the updated eventfs_inodes are not reset on a remount because their tracefs_inodes have been freed.
Instead, since the events directory eventfs_inode always has a tracefs_inode pointing to it (it is not freed when finished), and the events directory has a link to all its children, have the eventfs_remount() function only operate on the events eventfs_inode and have it descend into its children updating their uid and gids.
Link: https://lore.kernel.org/all/CAK7LNARXgaWw3kH9JgrnH4vK6fr8LDkNKf3wq8NhMWJrVwJyVQ@mail.gmail.com/ Link: https://lore.kernel.org/linux-trace-kernel/20240523051539.754424703@goodmis.org
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Fixes: baa23a8d4360d ("tracefs: Reset permissions on remount if permissions are options") Reported-by: Masahiro Yamada <masahiroy@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
27c04648 | 23-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
tracefs: Update inode permissions on remount
When a remount happens, if a gid or uid is specified update the inodes to have the same gid and uid. This will allow the simplification of the permission
tracefs: Update inode permissions on remount
When a remount happens, if a gid or uid is specified update the inodes to have the same gid and uid. This will allow the simplification of the permissions logic for the dynamically created files and directories.
Link: https://lore.kernel.org/linux-trace-kernel/20240523051539.592429986@goodmis.org
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Masahiro Yamada <masahiroy@kernel.org> Fixes: baa23a8d4360d ("tracefs: Reset permissions on remount if permissions are options") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
d57cf30c | 02-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
eventfs: Have "events" directory get permissions from its parent
The events directory gets its permissions from the root inode. But this can cause an inconsistency if the instances directory changes
eventfs: Have "events" directory get permissions from its parent
The events directory gets its permissions from the root inode. But this can cause an inconsistency if the instances directory changes its permissions, as the permissions of the created directories under it should inherit the permissions of the instances directory when directories under it are created.
Currently the behavior is:
# cd /sys/kernel/tracing # chgrp 1002 instances # mkdir instances/foo # ls -l instances/foo [..] -r--r----- 1 root lkp 0 May 1 18:55 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 18:55 current_tracer -rw-r----- 1 root lkp 0 May 1 18:55 error_log drwxr-xr-x 1 root root 0 May 1 18:55 events --w------- 1 root lkp 0 May 1 18:55 free_buffer drwxr-x--- 2 root lkp 0 May 1 18:55 options drwxr-x--- 10 root lkp 0 May 1 18:55 per_cpu -rw-r----- 1 root lkp 0 May 1 18:55 set_event
All the files and directories under "foo" has the "lkp" group except the "events" directory. That's because its getting its default value from the mount point instead of its parent.
Have the "events" directory make its default value based on its parent's permissions. That now gives:
# ls -l instances/foo [..] -rw-r----- 1 root lkp 0 May 1 21:16 buffer_subbuf_size_kb -r--r----- 1 root lkp 0 May 1 21:16 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 21:16 current_tracer -rw-r----- 1 root lkp 0 May 1 21:16 error_log drwxr-xr-x 1 root lkp 0 May 1 21:16 events --w------- 1 root lkp 0 May 1 21:16 free_buffer drwxr-x--- 2 root lkp 0 May 1 21:16 options drwxr-x--- 10 root lkp 0 May 1 21:16 per_cpu -rw-r----- 1 root lkp 0 May 1 21:16 set_event
Link: https://lore.kernel.org/linux-trace-kernel/20240502200906.161887248@goodmis.org
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Fixes: 8186fff7ab649 ("tracefs/eventfs: Use root and instance inodes as default ownership") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
22e61e15 | 02-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
eventfs: Do not treat events directory different than other directories
Treat the events directory the same as other directories when it comes to permissions. The events directory was considered dif
eventfs: Do not treat events directory different than other directories
Treat the events directory the same as other directories when it comes to permissions. The events directory was considered different because it's dentry is persistent, whereas the other directory dentries are created when accessed. But the way tracefs now does its ownership by using the root dentry's permissions as the default permissions, the events directory can get out of sync when a remount is performed setting the group and user permissions.
Remove the special case for the events directory on setting the attributes. This allows the updates caused by remount to work properly as well as simplifies the code.
Link: https://lore.kernel.org/linux-trace-kernel/20240502200906.002923579@goodmis.org
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Fixes: 8186fff7ab649 ("tracefs/eventfs: Use root and instance inodes as default ownership") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
d53891d3 | 02-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
eventfs: Do not differentiate the toplevel events directory
The toplevel events directory is really no different than the events directory of instances. Having the two be different caused inconsiste
eventfs: Do not differentiate the toplevel events directory
The toplevel events directory is really no different than the events directory of instances. Having the two be different caused inconsistencies and made it harder to fix the permissions bugs.
Make all events directories act the same.
Link: https://lore.kernel.org/linux-trace-kernel/20240502200905.846448710@goodmis.org
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Fixes: 8186fff7ab649 ("tracefs/eventfs: Use root and instance inodes as default ownership") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
6599bd55 | 02-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
tracefs: Still use mount point as default permissions for instances
If the instances directory's permissions were never change, then have it and its children use the mount point permissions as the d
tracefs: Still use mount point as default permissions for instances
If the instances directory's permissions were never change, then have it and its children use the mount point permissions as the default.
Currently, the permissions of instance directories are determined by the instance directory's permissions itself. But if the tracefs file system is remounted and changes the permissions, the instance directory and its children should use the new permission.
But because both the instance directory and its children use the instance directory's inode for permissions, it misses the update.
To demonstrate this:
# cd /sys/kernel/tracing/ # mkdir instances/foo # ls -ld instances/foo drwxr-x--- 5 root root 0 May 1 19:07 instances/foo # ls -ld instances drwxr-x--- 3 root root 0 May 1 18:57 instances # ls -ld current_tracer -rw-r----- 1 root root 0 May 1 18:57 current_tracer
# mount -o remount,gid=1002 . # ls -ld instances drwxr-x--- 3 root root 0 May 1 18:57 instances # ls -ld instances/foo/ drwxr-x--- 5 root root 0 May 1 19:07 instances/foo/ # ls -ld current_tracer -rw-r----- 1 root lkp 0 May 1 18:57 current_tracer
Notice that changing the group id to that of "lkp" did not affect the instances directory nor its children. It should have been:
# ls -ld current_tracer -rw-r----- 1 root root 0 May 1 19:19 current_tracer # ls -ld instances/foo/ drwxr-x--- 5 root root 0 May 1 19:25 instances/foo/ # ls -ld instances drwxr-x--- 3 root root 0 May 1 19:19 instances
# mount -o remount,gid=1002 . # ls -ld current_tracer -rw-r----- 1 root lkp 0 May 1 19:19 current_tracer # ls -ld instances drwxr-x--- 3 root lkp 0 May 1 19:19 instances # ls -ld instances/foo/ drwxr-x--- 5 root lkp 0 May 1 19:25 instances/foo/
Where all files were updated by the remount gid update.
Link: https://lore.kernel.org/linux-trace-kernel/20240502200905.686838327@goodmis.org
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Fixes: 8186fff7ab649 ("tracefs/eventfs: Use root and instance inodes as default ownership") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
baa23a8d | 02-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
tracefs: Reset permissions on remount if permissions are options
There's an inconsistency with the way permissions are handled in tracefs. Because the permissions are generated when accessed, they d
tracefs: Reset permissions on remount if permissions are options
There's an inconsistency with the way permissions are handled in tracefs. Because the permissions are generated when accessed, they default to the root inode's permission if they were never set by the user. If the user sets the permissions, then a flag is set and the permissions are saved via the inode (for tracefs files) or an internal attribute field (for eventfs).
But if a remount happens that specify the permissions, all the files that were not changed by the user gets updated, but the ones that were are not. If the user were to remount the file system with a given permission, then all files and directories within that file system should be updated.
This can cause security issues if a file's permission was updated but the admin forgot about it. They could incorrectly think that remounting with permissions set would update all files, but miss some.
For example:
# cd /sys/kernel/tracing # chgrp 1002 current_tracer # ls -l [..] -rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb -rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb -r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer -rw-r----- 1 root root 0 May 1 21:25 dynamic_events -r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info -r--r----- 1 root root 0 May 1 21:25 enabled_functions
Where current_tracer now has group "lkp".
# mount -o remount,gid=1001 . # ls -l -rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb -r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer -rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events -r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info -r--r----- 1 root tracing 0 May 1 21:25 enabled_functions
Everything changed but the "current_tracer".
Add a new link list that keeps track of all the tracefs_inodes which has the permission flags that tell if the file/dir should use the root inode's permission or not. Then on remount, clear all the flags so that the default behavior of using the root inode's permission is done for all files and directories.
Link: https://lore.kernel.org/linux-trace-kernel/20240502200905.529542160@goodmis.org
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Fixes: 8186fff7ab649 ("tracefs/eventfs: Use root and instance inodes as default ownership") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|
ee4e0379 | 02-May-2024 |
Steven Rostedt (Google) <rostedt@goodmis.org> |
eventfs: Free all of the eventfs_inode after RCU
The freeing of eventfs_inode via a kfree_rcu() callback. But the content of the eventfs_inode was being freed after the last kref. This is dangerous,
eventfs: Free all of the eventfs_inode after RCU
The freeing of eventfs_inode via a kfree_rcu() callback. But the content of the eventfs_inode was being freed after the last kref. This is dangerous, as changes are being made that can access the content of an eventfs_inode from an RCU loop.
Instead of using kfree_rcu() use call_rcu() that calls a function to do all the freeing of the eventfs_inode after a RCU grace period has expired.
Link: https://lore.kernel.org/linux-trace-kernel/20240502200905.370261163@goodmis.org
Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Fixes: 43aa6f97c2d03 ("eventfs: Get rid of dentry pointers without refcounts") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
show more ...
|