lkml.org 
[lkml]   [2012]   [Mar]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Race inotify_rm_watch vs umount
    On 03/06/2012 04:02 PM, Joseph Salisbury wrote:
    >
    >
    > Forwarded conversation
    > Subject: *Race inotify_rm_watch vs umount*
    > ------------------------
    >
    > From: *OGAWA Hirofumi* <hirofumi@mail.parknet.co.jp
    > <mailto:hirofumi@mail.parknet.co.jp>>
    > Date: Fri, Jun 10, 2011 at 7:20 AM
    > To: John McCutchan <john@johnmccutchan.com
    > <mailto:john@johnmccutchan.com>>, Robert Love <rlove@rlove.org
    > <mailto:rlove@rlove.org>>, Eric Paris <eparis@redhat.com
    > <mailto:eparis@redhat.com>>
    > Cc: linux-kernel@vger.kernel.org <mailto:linux-kernel@vger.kernel.org>,
    > linux-fsdevel@vger.kernel.org <mailto:linux-fsdevel@vger.kernel.org>
    >
    >
    > Hi,
    >
    > I'm looking the race inotify_rm_watch() vs umount(). This race become the
    > cause of Oops. You can see the oops at
    >
    > https://bugzilla.kernel.org/show_bug.cgi?id=22602
    >
    > So, what race?
    >
    > umount inotify_rm_watch
    > ... fsnotify_destroy_mark()
    > fsnotify_destroy_inode_mark()
    > /* removed from
    > i_fsnotify_marks */
    > generic_shutdown_super()
    > fsnotify_unmount_inodes()
    > put_super()
    > iput()
    > iput_final()
    > /* this is after
    > put_super() */
    >
    > Like above, inotify doesn't guarantee to call final iput() before
    > put_super(). With this violation, FS driver can oops.
    >
    > Well, so, what are requested for inotify? We can't simply take
    > sb->s_umount in inotify_rm_watch()?
    >
    > Any ideas?
    >
    > Thanks.
    > --
    > OGAWA Hirofumi <hirofumi@mail.parknet.co.jp
    > <mailto:hirofumi@mail.parknet.co.jp>>
    > --
    > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    > the body of a message to majordomo@vger.kernel.org
    > <mailto:majordomo@vger.kernel.org>
    > More majordomo info at http://vger.kernel.org/majordomo-info.html
    > Please read the FAQ at http://www.tux.org/lkml/
    >
    > ----------
    > From: *Eric Paris* <eparis@redhat.com <mailto:eparis@redhat.com>>
    > Date: Fri, Jun 10, 2011 at 9:46 AM
    > To: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp
    > <mailto:hirofumi@mail.parknet.co.jp>>
    > Cc: John McCutchan <john@johnmccutchan.com
    > <mailto:john@johnmccutchan.com>>, Robert Love <rlove@rlove.org
    > <mailto:rlove@rlove.org>>, linux-kernel@vger.kernel.org
    > <mailto:linux-kernel@vger.kernel.org>, linux-fsdevel@vger.kernel.org
    > <mailto:linux-fsdevel@vger.kernel.org>
    >
    >
    > Ok, I see what you are saying, I'll see what I can do. I'm a little
    > scared to call something like iput() under a lock though. I might be
    > able to make the bigest lock a mutex and fix this....
    >
    > I'll add this to my test suite.
    >
    > -Eric
    > >
    > > umount inotify_rm_watch
    > > ... fsnotify_destroy_mark()
    > > fsnotify_destroy_inode_mark()
    > > /* removed from
    > i_fsnotify_marks */
    > > generic_shutdown_super()
    > > fsnotify_unmount_inodes()
    > > put_super()
    > > iput()
    > > iput_final()
    > > /* this is after
    > put_super() */
    > >
    > > Like above, inotify doesn't guarantee to call final iput() before
    > > put_super(). With this violation, FS driver can oops.
    > >
    > > Well, so, what are requested for inotify? We can't simply take
    > > sb->s_umount in inotify_rm_watch()?
    > >
    > > Any ideas?
    > >
    > > Thanks.
    >
    >
    > --
    >
    > ----------
    > From: *Al Viro* <viro@zeniv.linux.org.uk <mailto:viro@zeniv.linux.org.uk>>
    > Date: Fri, Jun 10, 2011 at 10:35 AM
    > To: Eric Paris <eparis@redhat.com <mailto:eparis@redhat.com>>
    > Cc: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp
    > <mailto:hirofumi@mail.parknet.co.jp>>, John McCutchan
    > <john@johnmccutchan.com <mailto:john@johnmccutchan.com>>, Robert Love
    > <rlove@rlove.org <mailto:rlove@rlove.org>>, linux-kernel@vger.kernel.org
    > <mailto:linux-kernel@vger.kernel.org>, linux-fsdevel@vger.kernel.org
    > <mailto:linux-fsdevel@vger.kernel.org>
    >
    >
    > Which lock would that be? I don't see any good candidates in there...
    >
    >

    Hello,

    It appears this bug still exists in the 3.2 kernel[0]. There was some
    discussion about this bug in this thread and in the bug[1]. However,
    there haven't been any updates in a while.

    Has there been any further findings on this issue?

    Thanks,

    Joe


    [0] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/922906
    [1] https://bugzilla.kernel.org/show_bug.cgi?id=22602


    \
     
     \ /
      Last update: 2012-03-06 22:13    [from the cache]
    ©2003-2014 Jasper Spaans. hosted at Digital Ocean