lkml.org 
[lkml]   [2018]   [Apr]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: general protection fault in kernfs_kill_sb
On Fri, Apr 20, 2018 at 09:31:58AM +0200, Michal Hocko wrote:
> On Fri 20-04-18 14:29:39, Tetsuo Handa wrote:
> > Eric Biggers wrote:
> > > But, there is still a related bug: when mounting sysfs, if register_shrinker()
> > > fails in sget_userns(), then kernfs_kill_sb() gets called, which frees the
> > > 'struct kernfs_super_info'. But, the 'struct kernfs_super_info' is also freed
> > > in kernfs_mount_ns() by:
> > >
> > > sb = sget_userns(fs_type, kernfs_test_super, kernfs_set_super, flags,
> > > &init_user_ns, info);
> > > if (IS_ERR(sb) || sb->s_fs_info != info)
> > > kfree(info);
> > > if (IS_ERR(sb))
> > > return ERR_CAST(sb);
> > >
> > > I guess the problem is that sget_userns() shouldn't take ownership of the 'info'
> > > if it returns an error -- but, it actually does if register_shrinker() fails,
> > > resulting in a double free.
> > >
> > > Here is a reproducer and the KASAN splat. This is on Linus' tree (87ef12027b9b)
> > > with vfs/for-linus merged in.
> >
> > I'm waiting for response from Michal Hocko regarding
> > http://lkml.kernel.org/r/201804111909.EGC64586.QSFLFJFOVHOOtM@I-love.SAKURA.ne.jp .
>
> I didn't plan to respond util all the Al's concerns with the existing
> scheme are resolved. This is not an urgent thing to fix so better fix it
> properly. Your API change is kinda ugly so it would be preferable to do
> it properly as suggested by Al. Maybe that will be more work but my
> understanding is that the resulting code would be better. If that is not
> the case then I do not really have any fundamental objection to your
> patch except it is ugly.

Okay, the fix was merged already as commit 8e04944f0ea8b8 ("mm,vmscan: Allow
preallocating memory for register_shrinker()."). Thanks Tetsuo!

- Eric

\
 
 \ /
  Last update: 2018-04-20 19:55    [W:0.646 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site