lkml.org 
[lkml]   [2023]   [Oct]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] eventfs: Hold eventfs_mutex when calling callback functions
On Mon, 30 Oct 2023 at 21:10, Steven Rostedt <rostedt@goodmis.org> wrote:
>
> From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
>
> The callback function that is used to create inodes and dentries is not
> protected by anything and the data that is passed to it could become
> stale. After eventfs_remove_dir() is called by the tracing system, it is
> free to remove the events that are associated to that directory.
> Unfortunately, that means the callbacks must not be called after that.
>
> CPU0 CPU1
> ---- ----
> eventfs_root_lookup() {
> eventfs_remove_dir() {
> mutex_lock(&event_mutex);
> ei->is_freed = set;
> mutex_unlock(&event_mutex);
> }
> kfree(event_call);
>
> for (...) {
> entry = &ei->entries[i];
> r = entry->callback() {
> call = data; // call == event_call above
> if (call->flags ...)
>
> [ USE AFTER FREE BUG ]
>
> The safest way to protect this is to wrap the callback with:
>
> mutex_lock(&eventfs_mutex);
> if (!ei->is_freed)
> r = entry->callback();
> else
> r = -1;
> mutex_unlock(&eventfs_mutex);
>
> This will make sure that the callback will not be called after it is
> freed. But now it needs to be known that the callback is called while
> holding internal eventfs locks, and that it must not call back into the
> eventfs / tracefs system. There's no reason it should anyway, but document
> that as well.
>
> Link: https://lore.kernel.org/all/CA+G9fYu9GOEbD=rR5eMR-=HJ8H6rMsbzDC2ZY5=Y50WpWAE7_Q@mail.gmail.com/
>
> Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
> Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>

> ---
> fs/tracefs/event_inode.c | 22 ++++++++++++++++++--
> include/linux/tracefs.h | 43 ++++++++++++++++++++++++++++++++++++++++


--
Linaro LKFT
https://lkft.linaro.org

\
 
 \ /
  Last update: 2023-10-30 22:41    [W:2.370 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site