lkml.org 
[lkml]   [2021]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH linux-4.19.y] VFS: Fix fuseblk memory leak caused by mount concurrency
From
Date
Please ignore this patch.

在 2021/10/13 12:01, ChenXiaoSong 写道:
> If two processes mount same superblock, memory leak occurs:
>
> CPU0 | CPU1
> do_new_mount | do_new_mount
> fs_set_subtype | fs_set_subtype
> kstrdup |
> | kstrdup
> memrory leak |
>
> Fix this by moving fs_set_subtype to mount_fs before up_write(&sb->s_umount).
>
> Linus's tree already have refactoring patchset [1], one of them can fix this bug:
> c30da2e981a7 (fuse: convert to use the new mount API)
>
> Since we did not merge the refactoring patchset in this branch, I create this patch.
>
> [1] https://patchwork.kernel.org/project/linux-fsdevel/patch/20190903113640.7984-3-mszeredi@redhat.com/
>
> Fixes: 9d412a43c3b2 (vfs: split off vfsmount-related parts of vfs_kern_mount())
> Cc: David Howells <dhowells@redhat.com>
> Signed-off-by: ChenXiaoSong <chenxiaosong2@huawei.com>
> ---
> fs/namespace.c | 26 --------------------------
> fs/super.c | 30 ++++++++++++++++++++++++++++++
> 2 files changed, 30 insertions(+), 26 deletions(-)
>
> diff --git a/fs/namespace.c b/fs/namespace.c
> index 2f3c6a0350a8..556fdd3b6a4e 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -2402,29 +2402,6 @@ static int do_move_mount(struct path *path, const char *old_name)
> return err;
> }
>
> -static struct vfsmount *fs_set_subtype(struct vfsmount *mnt, const char *fstype)
> -{
> - int err;
> - const char *subtype = strchr(fstype, '.');
> - if (subtype) {
> - subtype++;
> - err = -EINVAL;
> - if (!subtype[0])
> - goto err;
> - } else
> - subtype = "";
> -
> - mnt->mnt_sb->s_subtype = kstrdup(subtype, GFP_KERNEL);
> - err = -ENOMEM;
> - if (!mnt->mnt_sb->s_subtype)
> - goto err;
> - return mnt;
> -
> - err:
> - mntput(mnt);
> - return ERR_PTR(err);
> -}
> -
> /*
> * add a mount into a namespace's mount tree
> */
> @@ -2490,9 +2467,6 @@ static int do_new_mount(struct path *path, const char *fstype, int sb_flags,
> return -ENODEV;
>
> mnt = vfs_kern_mount(type, sb_flags, name, data);
> - if (!IS_ERR(mnt) && (type->fs_flags & FS_HAS_SUBTYPE) &&
> - !mnt->mnt_sb->s_subtype)
> - mnt = fs_set_subtype(mnt, fstype);
>
> put_filesystem(type);
> if (IS_ERR(mnt))
> diff --git a/fs/super.c b/fs/super.c
> index 9fb4553c46e6..b181878753bb 100644
> --- a/fs/super.c
> +++ b/fs/super.c
> @@ -1240,6 +1240,30 @@ struct dentry *mount_single(struct file_system_type *fs_type,
> }
> EXPORT_SYMBOL(mount_single);
>
> +static int fs_set_subtype(struct super_block *sb)
> +{
> + int err;
> + const char *fstype = sb->s_type->name;
> + const char *subtype = strchr(fstype, '.');
> + if (subtype) {
> + subtype++;
> + err = -EINVAL;
> + if (!subtype[0])
> + goto err;
> + } else {
> + subtype = "";
> + }
> +
> + sb->s_subtype = kstrdup(subtype, GFP_KERNEL);
> + err = -ENOMEM;
> + if (!sb->s_subtype)
> + goto err;
> + return 0;
> +
> +err:
> + return err;
> +}
> +
> struct dentry *
> mount_fs(struct file_system_type *type, int flags, const char *name, void *data)
> {
> @@ -1289,6 +1313,12 @@ mount_fs(struct file_system_type *type, int flags, const char *name, void *data)
> WARN((sb->s_maxbytes < 0), "%s set sb->s_maxbytes to "
> "negative value (%lld)\n", type->name, sb->s_maxbytes);
>
> + if ((sb->s_type->fs_flags & FS_HAS_SUBTYPE) && !sb->s_subtype) {
> + error = fs_set_subtype(sb);
> + if (error)
> + goto out_sb;
> + }
> +
> up_write(&sb->s_umount);
> free_secdata(secdata);
> return root;
>

\
 
 \ /
  Last update: 2021-10-13 10:34    [W:0.052 / U:0.308 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site