Received-SPF: pass (google.com: domain of linux-kernel+bounces-29629-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Thu, 18 Jan 2024 01:38:57 +0000
From: Al Viro <viro@zeniv.linux.org.uk>
To: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: akpm@linux-foundation.org, willy@infradead.org, brauner@kernel.org,
	jack@suse.cz, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH] fs: improve dump_mapping() robustness
Message-ID: <20240118013857.GO1674809@ZenIV>
References: <937ab1f87328516821d39be672b6bc18861d9d3e.1705391420.git.baolin.wang@linux.alibaba.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <937ab1f87328516821d39be672b6bc18861d9d3e.1705391420.git.baolin.wang@linux.alibaba.com>
Sender: Al Viro <viro@ftp.linux.org.uk>

On Tue, Jan 16, 2024 at 03:53:35PM +0800, Baolin Wang wrote:

> With checking the 'dentry.parent' and 'dentry.d_name.name' used by
> dentry_name(), I can see dump_mapping() will output the invalid dentry
> instead of crashing the system when this issue is reproduced again.

>  	dentry_ptr = container_of(dentry_first, struct dentry, d_u.d_alias);
> -	if (get_kernel_nofault(dentry, dentry_ptr)) {
> +	if (get_kernel_nofault(dentry, dentry_ptr) ||
> +	    !dentry.d_parent || !dentry.d_name.name) {
>  		pr_warn("aops:%ps ino:%lx invalid dentry:%px\n",
>  				a_ops, ino, dentry_ptr);
>  		return;

That's nowhere near enough.  Your ->d_name.name can bloody well be pointing
to an external name that gets freed right under you.  Legitimately so.

Think what happens if dentry has a long name (longer than would fit into
the embedded array) and gets renamed name just after you copy it into
a local variable.  Old name will get freed.  Yes, freeing is RCU-delayed,
but I don't see anything that would prevent your thread losing CPU
and not getting it back until after the sucker's been freed.