NULL the dangling pipe reference while clearing watch_queue.
If not done, a reference to a freed pipe remains in the watch_queue,
as this function is called before freeing a pipe in free_pipe_info()
(see line 834 of fs/pipe.c).
The sole use of wqueue->defunct is for checking if the watch queue has
been cleared, but wqueue->pipe is also NULLed while clearing.
Thus, wqueue->defunct is superfluous, as wqueue->pipe can be checked
for NULL. Hence, the former can be removed.
Signed-off-by: Siddh Raman Pant <[email protected]>
---
Changes in v4:
- Drop preceeding kerneldoc-changes patch and change appropriately.
Changes in v3 (8 Jan 2023):
- Minor rephrase of comment before NULLing in watch_queue_clear().
Changes in v2 (6 Aug 2022):
- Merged the NULLing and removing defunct patches.
- Removed READ_ONCE barrier in lock_wqueue().
- Better commit messages.
include/linux/watch_queue.h | 3 +--
kernel/watch_queue.c | 12 ++++++------
2 files changed, 7 insertions(+), 8 deletions(-)
diff --git a/include/linux/watch_queue.h b/include/linux/watch_queue.h
index fc6bba20273b..45cd42f55d49 100644
--- a/include/linux/watch_queue.h
+++ b/include/linux/watch_queue.h
@@ -38,7 +38,7 @@ struct watch_filter {
struct watch_queue {
struct rcu_head rcu;
struct watch_filter __rcu *filter;
- struct pipe_inode_info *pipe; /* The pipe we're using as a buffer */
+ struct pipe_inode_info *pipe; /* Pipe we use as a buffer, NULL if queue closed */
struct hlist_head watches; /* Contributory watches */
struct page **notes; /* Preallocated notifications */
unsigned long *notes_bitmap; /* Allocation bitmap for notes */
@@ -46,7 +46,6 @@ struct watch_queue {
spinlock_t lock;
unsigned int nr_notes; /* Number of notes */
unsigned int nr_pages; /* Number of pages in notes[] */
- bool defunct; /* T when queues closed */
};
/*
diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c
index a6f9bdd956c3..6ead921c15c0 100644
--- a/kernel/watch_queue.c
+++ b/kernel/watch_queue.c
@@ -43,7 +43,7 @@ MODULE_LICENSE("GPL");
static inline bool lock_wqueue(struct watch_queue *wqueue)
{
spin_lock_bh(&wqueue->lock);
- if (unlikely(wqueue->defunct)) {
+ if (unlikely(!wqueue->pipe)) {
spin_unlock_bh(&wqueue->lock);
return false;
}
@@ -105,9 +105,6 @@ static bool post_one_notification(struct watch_queue *wqueue,
unsigned int head, tail, mask, note, offset, len;
bool done = false;
- if (!pipe)
- return false;
-
spin_lock_irq(&pipe->rd_wait.lock);
mask = pipe->ring_size - 1;
@@ -603,8 +600,11 @@ void watch_queue_clear(struct watch_queue *wqueue)
rcu_read_lock();
spin_lock_bh(&wqueue->lock);
- /* Prevent new notifications from being stored. */
- wqueue->defunct = true;
+ /*
+ * This pipe can be freed by callers like free_pipe_info().
+ * Removing this reference also prevents new notifications.
+ */
+ wqueue->pipe = NULL;
while (!hlist_empty(&wqueue->watches)) {
watch = hlist_entry(wqueue->watches.first, struct watch, queue_node);
--
2.39.0
Seems reasonable. Have you run it with the keyutils testsuite?
David
Siddh Raman Pant <[email protected]> wrote:
> All tests in tests/ pass except features/builtin_trusted, which
> fails even without the patch. (Failure log: https://pastebin.com/SGgAbzXp)
Don't worry about that one. That requires some kernel preparation.
David
On Wed, 11 Jan 2023 22:07:28 +0530, David Howells wrote:
> Seems reasonable. Have you run it with the keyutils testsuite?
>
> David
I had not, but I did now.
I first ran all the keyctl tests with ./runtest.sh keyctl/**/*
All of them passsed. Log: https://pastebin.com/PBm6h5E2
All tests in tests/ pass except features/builtin_trusted, which
fails even without the patch. (Failure log: https://pastebin.com/SGgAbzXp)
Thanks,
Siddh
On Wed, 11 Jan 2023 23:50:20 +0530, David Howells wrote:
> Siddh Raman Pant [email protected]> wrote:
>
> > All tests in tests/ pass except features/builtin_trusted, which
> > fails even without the patch. (Failure log: https://pastebin.com/SGgAbzXp)
>
> Don't worry about that one. That requires some kernel preparation.
>
> David
Hello,
Please let me know if any changes are required.
Context: https://lore.kernel.org/all/[email protected]/
Thanks,
Siddh