lkml.org 
[lkml]   [2018]   [Sep]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.18 161/235] configfs: fix registered group removal
    Date
    4.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Mike Christie <mchristi@redhat.com>

    [ Upstream commit cc57c07343bd071cdf1915a91a24ab7d40c9b590 ]

    This patch fixes a bug where configfs_register_group had added
    a group in a tree, and userspace has done a rmdir on a dir somewhere
    above that group and we hit a kernel crash. The problem is configfs_rmdir
    will detach everything under it and unlink groups on the default_groups
    list. It will not unlink groups added with configfs_register_group so when
    configfs_unregister_group is called to drop its references to the group/items
    we crash when we try to access the freed dentrys.

    The patch just adds a check for if a rmdir has been done above
    us and if so just does the unlink part of unregistration.

    Sorry if you are getting this multiple times. I thouhgt I sent
    this to some of you and lkml, but I do not see it.

    Signed-off-by: Mike Christie <mchristi@redhat.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Joel Becker <jlbec@evilplan.org>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/configfs/dir.c | 11 +++++++++++
    1 file changed, 11 insertions(+)

    --- a/fs/configfs/dir.c
    +++ b/fs/configfs/dir.c
    @@ -1777,6 +1777,16 @@ void configfs_unregister_group(struct co
    struct dentry *dentry = group->cg_item.ci_dentry;
    struct dentry *parent = group->cg_item.ci_parent->ci_dentry;

    + mutex_lock(&subsys->su_mutex);
    + if (!group->cg_item.ci_parent->ci_group) {
    + /*
    + * The parent has already been unlinked and detached
    + * due to a rmdir.
    + */
    + goto unlink_group;
    + }
    + mutex_unlock(&subsys->su_mutex);
    +
    inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
    spin_lock(&configfs_dirent_lock);
    configfs_detach_prep(dentry, NULL);
    @@ -1791,6 +1801,7 @@ void configfs_unregister_group(struct co
    dput(dentry);

    mutex_lock(&subsys->su_mutex);
    +unlink_group:
    unlink_group(group);
    mutex_unlock(&subsys->su_mutex);
    }

    \
     
     \ /
      Last update: 2018-09-24 14:50    [W:2.782 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site