From patchwork Tue Dec 18 13:46:42 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kara X-Patchwork-Id: 10735689 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 59A7F1575 for ; Tue, 18 Dec 2018 13:46:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 494C82A46F for ; Tue, 18 Dec 2018 13:46:57 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3D9242A478; Tue, 18 Dec 2018 13:46:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D01542A472 for ; Tue, 18 Dec 2018 13:46:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726690AbeLRNqz (ORCPT ); Tue, 18 Dec 2018 08:46:55 -0500 Received: from mx2.suse.de ([195.135.220.15]:44698 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726682AbeLRNqz (ORCPT ); Tue, 18 Dec 2018 08:46:55 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id DB266AE60; Tue, 18 Dec 2018 13:46:53 +0000 (UTC) Received: by quack2.suse.cz (Postfix, from userid 1000) id 390D11E150E; Tue, 18 Dec 2018 14:46:53 +0100 (CET) From: Jan Kara To: Al Viro Cc: , Jan Kara Subject: [PATCH 2/2] proc: Protect readers of /proc/mounts from remount Date: Tue, 18 Dec 2018 14:46:42 +0100 Message-Id: <20181218134642.21219-3-jack@suse.cz> X-Mailer: git-send-email 2.16.4 In-Reply-To: <20181218134642.21219-1-jack@suse.cz> References: <20181218134642.21219-1-jack@suse.cz> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Readers of /proc/mounts (and similar files) are currently unprotected from concurrently running remount on the filesystem they are reporting. This can not only result in bogus reported information but also in confusion in filesystems ->show_options callbacks resulting in use-after-free issues or similar (for example ext4 handling of quota file names is prone to such races). Fix the problem by protecting showing of mount information with sb->s_umount semaphore. Signed-off-by: Jan Kara --- fs/namespace.c | 36 +++++++++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index a7f91265ea67..3b7cd4465658 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -1263,7 +1263,7 @@ static void *m_next(struct seq_file *m, void *v, loff_t *pos) { struct proc_mounts *p = m->private; - p->cached_mount = seq_list_next(v, &p->ns->list, pos); + p->cached_mount = seq_list_next(p->cached_mount, &p->ns->list, pos); p->cached_index = *pos; return p->cached_mount; } @@ -1276,8 +1276,38 @@ static void m_stop(struct seq_file *m, void *v) static int m_show(struct seq_file *m, void *v) { struct proc_mounts *p = m->private; - struct mount *r = list_entry(v, struct mount, mnt_list); - return p->show(m, &r->mnt); + struct mount *r; + struct super_block *sb; + int ret; + +restart: + r = list_entry(v, struct mount, mnt_list); + sb = r->mnt.mnt_sb; + + /* Protect show function against racing remount */ + if (mount_trylock_super(sb)) + goto show; + /* + * Trylock failed. Since namepace_sem ranks below s_umount (through + * sb->s_umount > dir->i_rwsem > namespace_sem in the mount path), we + * have to drop it, wait for s_umount and then try again to guarantee + * forward progress. + */ + hold_sb(sb); + up_read(&namespace_sem); + down_read(&sb->s_umount); + down_read(&namespace_sem); + v = seq_list_start(&p->ns->list, p->cached_index); + if (!sb->s_root || v != p->cached_mount) { + drop_super(sb); + p->cached_event = p->ns->event; + p->cached_mount = v; + goto restart; + } +show: + ret = p->show(m, &r->mnt); + drop_super(sb); + return ret; } const struct seq_operations mounts_op = {