2023-05-16 04:05:16

by Muchun Song

Subject: [PATCH] kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR

The root->ino_idr is supposed to be protected by kernfs_idr_lock, fix
it.

Fixes: 488dee96bb62 ("kernfs: allow creating kernfs objects with arbitrary uid/gid")
Signed-off-by: Muchun Song <[email protected]>
---
fs/kernfs/dir.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
index 45b6919903e6..84a2cd196076 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -525,6 +525,13 @@ void kernfs_get(struct kernfs_node *kn)
}
EXPORT_SYMBOL_GPL(kernfs_get);

+static void kernfs_idr_remove(struct kernfs_root *root, struct kernfs_node *kn)
+{
+ spin_lock(&kernfs_idr_lock);
+ idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
+ spin_unlock(&kernfs_idr_lock);
+}
+
/**
* kernfs_put - put a reference count on a kernfs_node
* @kn: the target kernfs_node
@@ -559,9 +566,7 @@ void kernfs_put(struct kernfs_node *kn)
simple_xattrs_free(&kn->iattr->xattrs);
kmem_cache_free(kernfs_iattrs_cache, kn->iattr);
}
- spin_lock(&kernfs_idr_lock);
- idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
- spin_unlock(&kernfs_idr_lock);
+ kernfs_idr_remove(root, kn);
kmem_cache_free(kernfs_node_cache, kn);

kn = parent;
@@ -655,7 +660,7 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
return kn;

err_out3:
- idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
+ kernfs_idr_remove(root, kn);
err_out2:
kmem_cache_free(kernfs_node_cache, kn);
err_out1:
--
2.11.0

2023-05-22 20:13:51

by Tejun Heo

Subject: Re: [PATCH] kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR

On Tue, May 16, 2023 at 11:45:36AM +0800, Muchun Song wrote:
> @@ -655,7 +660,7 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
> return kn;
>
> err_out3:
> - idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
> + kernfs_idr_remove(root, kn);

Good catch but I'd just open code the locking here.

Thanks.

--
tejun

2023-05-23 02:30:16

by Muchun Song

Subject: Re: [PATCH] kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR

> On May 23, 2023, at 03:08, Tejun Heo <[email protected]> wrote:
>
> On Tue, May 16, 2023 at 11:45:36AM +0800, Muchun Song wrote:
>> @@ -655,7 +660,7 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
>> return kn;
>>
>> err_out3:
>> - idr_remove(&root->ino_idr, (u32)kernfs_ino(kn));
>> + kernfs_idr_remove(root, kn);
>
> Good catch but I'd just open code the locking here.

OK. I'll send v2.

Thanks.

>
> Thanks.
>
> --
> tejun