Messages in this thread | | | Date | Thu, 9 Jan 2014 14:42:39 -0700 | From | Matthew Wilcox <> | Subject | Re: [PATCH] vfs: Fix possible NULL pointer dereference in inode_permission() |
| |
On Thu, Jan 09, 2014 at 04:27:31PM -0500, Steven Rostedt wrote: > Note, the crash came from stressing the deletion and reading of debugfs > files. I was not able to recreate this via normal files. But I'm not > sure they are safe. It may just be that the race window is much harder > to hit.
But "normal" files have a 'destroy_inode' method. So you've basically only fixed it for debugfs (and maybe a few other unusual filesystems). Why doesn't the code look like this:
static void i_callback(struct rcu_head *head) { struct inode *inode = container_of(head, struct inode, i_rcu); __destroy_inode(inode); if (inode->i_sb->s_op->destroy_inode) inode->i_sb->s_op->destroy_inode(inode); else kmem_cache_free(inode_cachep, inode); }
static void destroy_inode(struct inode *inode) { BUG_ON(!list_empty(&inode->i_lru)); call_rcu(&inode->i_rcu, i_callback); }
We'd then have to get rid of all the call_rcu() invocations in individual filesystems' destroy_inode methods, but that doesn't sound like a bad thing to me.
-- Matthew Wilcox Intel Open Source Technology Centre "Bill, look, we understand that you're interested in selling us this operating system, but compare it to ours. We can't possibly take such a retrograde step."
| |