| Message ID | 20190416175340.21068-49-viro@ZenIV.linux.org.uk (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [RFC,01/62] securityfs: fix use-after-free on symlink traversal | expand |
On Tue 16-04-19 18:53:27, Al Viro wrote: > From: Al Viro <viro@zeniv.linux.org.uk> > > we might want to drop ->destroy_inode() there - it's used only for > WARN_ON() now, and AFAICS that could be moved to ->evict_inode() > if we had one... > > Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> > --- > drivers/dax/super.c | 7 ++----- > 1 file changed, 2 insertions(+), 5 deletions(-) Added Dan to CC since I'm not sure how closely he follows fsdevel. The patch looks good to me FWIW so feel free to add: Reviewed-by: Jan Kara <jack@suse.cz> Honza > > diff --git a/drivers/dax/super.c b/drivers/dax/super.c > index 0a339b85133e..bbd57ca0634a 100644 > --- a/drivers/dax/super.c > +++ b/drivers/dax/super.c > @@ -412,11 +412,9 @@ static struct dax_device *to_dax_dev(struct inode *inode) > return container_of(inode, struct dax_device, inode); > } > > -static void dax_i_callback(struct rcu_head *head) > +static void dax_free_inode(struct inode *inode) > { > - struct inode *inode = container_of(head, struct inode, i_rcu); > struct dax_device *dax_dev = to_dax_dev(inode); > - > kfree(dax_dev->host); > dax_dev->host = NULL; > if (inode->i_rdev) > @@ -427,16 +425,15 @@ static void dax_i_callback(struct rcu_head *head) > static void dax_destroy_inode(struct inode *inode) > { > struct dax_device *dax_dev = to_dax_dev(inode); > - > WARN_ONCE(test_bit(DAXDEV_ALIVE, &dax_dev->flags), > "kill_dax() must be called before final iput()\n"); > - call_rcu(&inode->i_rcu, dax_i_callback); > } > > static const struct super_operations dax_sops = { > .statfs = simple_statfs, > .alloc_inode = dax_alloc_inode, > .destroy_inode = dax_destroy_inode, > + .free_inode = dax_free_inode, > .drop_inode = generic_delete_inode, > }; > > -- > 2.11.0 >
On Thu, Apr 18, 2019 at 5:16 AM Jan Kara <jack@suse.cz> wrote: > > On Tue 16-04-19 18:53:27, Al Viro wrote: > > From: Al Viro <viro@zeniv.linux.org.uk> > > > > we might want to drop ->destroy_inode() there - it's used only for > > WARN_ON() now, and AFAICS that could be moved to ->evict_inode() > > if we had one... > > > > Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> > > --- > > drivers/dax/super.c | 7 ++----- > > 1 file changed, 2 insertions(+), 5 deletions(-) > > Added Dan to CC since I'm not sure how closely he follows fsdevel. The > patch looks good to me FWIW so feel free to add: > > Reviewed-by: Jan Kara <jack@suse.cz> Thanks Jan. Acked-by: Dan Williams <dan.j.williams@intel.com> Al, I assume you'll merge this with the other free_inode changes.
diff --git a/drivers/dax/super.c b/drivers/dax/super.c index 0a339b85133e..bbd57ca0634a 100644 --- a/drivers/dax/super.c +++ b/drivers/dax/super.c @@ -412,11 +412,9 @@ static struct dax_device *to_dax_dev(struct inode *inode) return container_of(inode, struct dax_device, inode); } -static void dax_i_callback(struct rcu_head *head) +static void dax_free_inode(struct inode *inode) { - struct inode *inode = container_of(head, struct inode, i_rcu); struct dax_device *dax_dev = to_dax_dev(inode); - kfree(dax_dev->host); dax_dev->host = NULL; if (inode->i_rdev) @@ -427,16 +425,15 @@ static void dax_i_callback(struct rcu_head *head) static void dax_destroy_inode(struct inode *inode) { struct dax_device *dax_dev = to_dax_dev(inode); - WARN_ONCE(test_bit(DAXDEV_ALIVE, &dax_dev->flags), "kill_dax() must be called before final iput()\n"); - call_rcu(&inode->i_rcu, dax_i_callback); } static const struct super_operations dax_sops = { .statfs = simple_statfs, .alloc_inode = dax_alloc_inode, .destroy_inode = dax_destroy_inode, + .free_inode = dax_free_inode, .drop_inode = generic_delete_inode, };