Race inotify_rm_watch vs umount

Hi,

I'm looking the race inotify_rm_watch() vs umount(). This race become the cause of Oops. You can see the oops at

https://bugzilla.kernel.org/show_bug.cgi?id=22602

So, what race?

umount inotify_rm_watch
... fsnotify_destroy_mark()

                                         fsnotify_destroy_inode_mark()
                                           /* removed from i_fsnotify_marks */
    generic_shutdown_super()
      fsnotify_unmount_inodes()
        put_super()
                                           iput()
                                             iput_final()
                                               /* this is after put_super() */

Like above, inotify doesn't guarantee to call final iput() before put_super(). With this violation, FS driver can oops.

Well, so, what are requested for inotify? We can't simply take sb->s_umount in inotify_rm_watch()?

Any ideas?

Thanks.

Quoted 5 lines · OGAWA Hirofumi

Hi,

I'm looking the race inotify_rm_watch() vs umount(). This race become the cause of Oops. You can see the oops at

Quoted 3 lines

https://bugzilla.kernel.org/show_bug.cgi?id=22602

So, what race?

Ok, I see what you are saying, I'll see what I can do. I'm a little scared to call something like iput() under a lock though. I might be able to make the bigest lock a mutex and fix this....

Forwarded conversation
Subject: *Race inotify_rm_watch vs umount*
------------------------

From: *OGAWA Hirofumi* <[email protected] <mailto:[email protected]>>
Date: Fri, Jun 10, 2011 at 7:20 AM
To: John McCutchan <[email protected] <mailto:[email protected]>>, Robert Love <[email protected] <mailto:[email protected]>>, Eric Paris <[email protected] <mailto:[email protected]>>
Cc: [email protected] <mailto:[email protected]>, [email protected] <mailto:[email protected]>

Hi,

I'm looking the race inotify_rm_watch() vs umount(). This race become the cause of Oops. You can see the oops at

https://bugzilla.kernel.org/show_bug.cgi?id=22602

So, what race?

umount inotify_rm_watch
... fsnotify_destroy_mark()

                                         fsnotify_destroy_inode_mark()
                                           /* removed from
i_fsnotify_marks */
    generic_shutdown_super()
      fsnotify_unmount_inodes()
        put_super()
                                           iput()
                                             iput_final()
                                               /* this is after

put_super() */

Like above, inotify doesn't guarantee to call final iput() before put_super(). With this violation, FS driver can oops.

Well, so, what are requested for inotify? We can't simply take sb->s_umount in inotify_rm_watch()?

Any ideas?

Thanks.
--
OGAWA Hirofumi <[email protected] <mailto:[email protected]>>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] <mailto:[email protected]>
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

----------
From: *Eric Paris* <[email protected] <mailto:[email protected]>>
Date: Fri, Jun 10, 2011 at 9:46 AM
To: OGAWA Hirofumi <[email protected] <mailto:[email protected]>>
Cc: John McCutchan <[email protected] <mailto:[email protected]>>, Robert Love <[email protected] <mailto:[email protected]>>, [email protected] <mailto:[email protected]>, [email protected] <mailto:[email protected]>

Ok, I see what you are saying, I'll see what I can do. I'm a little scared to call something like iput() under a lock though. I might be able to make the bigest lock a mutex and fix this....

I'll add this to my test suite.

-Eric

Quoted 5 lines

umount inotify_rm_watch
... fsnotify_destroy_mark()

                                         fsnotify_destroy_inode_mark()
                                           /* removed from

i_fsnotify_marks */

Quoted 6 lines

    generic_shutdown_super()
      fsnotify_unmount_inodes()
        put_super()
                                           iput()
                                             iput_final()
                                               /* this is after

put_super() */

Quoted 10 lines

Like above, inotify doesn't guarantee to call final iput() before put_super(). With this violation, FS driver can oops.

Well, so, what are requested for inotify? We can't simply take sb->s_umount in inotify_rm_watch()?

Any ideas?

Thanks.

--

----------
From: *Al Viro* <[email protected] <mailto:[email protected]>>
Date: Fri, Jun 10, 2011 at 10:35 AM
To: Eric Paris <[email protected] <mailto:[email protected]>>
Cc: OGAWA Hirofumi <[email protected] <mailto:[email protected]>>, John McCutchan <[email protected] <mailto:[email protected]>>, Robert Love <[email protected] <mailto:[email protected]>>, [email protected] <mailto:[email protected]>, [email protected] <mailto:[email protected]>

Which lock would that be? I don't see any good candidates in there...