tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that
dentry->d_fsdata points to, and ->d_revalidate() is called in rcu
pathwalk mode with nothing but rcu_read_lock() held. The dentry itself
stays around for such a walker, but tracefs_d_release() drops its
reference to the eventfs_inode when the dentry is killed, and
release_ei() then frees it after a grace period of eventfs_srcu. An
SRCU grace period doesn't wait for rcu_read_lock() sections, so the
walker can read an eventfs_inode that is already gone.
With a pathwalk held up in tracefs_d_revalidate() while the dentry goes
away:
BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90
Read of size 1 at addr ff1100010152d8d0 by task walker/97
Call Trace:
<TASK>
tracefs_d_revalidate+0x76/0x90
lookup_fast+0x320/0x640
path_lookupat+0x160/0xb00
filename_lookup+0x1f1/0x5b0
vfs_statx+0xd7/0x3b0
vfs_fstatat+0x4d/0x90
__do_sys_newfstatat+0xa0/0x100
do_syscall_64+0x10e/0x5e0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
[...]
Allocated by task 1:
__kmalloc_cache_noprof+0x249/0x560
eventfs_create_dir+0x7a/0x590
event_create_dir+0x2fb/0xcf0
trace_add_event_call+0xbf/0x150
[...]
Freed by task 11:
kfree+0x1db/0x5b0
srcu_invoke_callbacks+0x3a3/0x620
process_one_work+0x937/0x1810
worker_thread+0x4f1/0xd60
Before commit 8e556432477e ("eventfs: Use SRCU for freeing
eventfs_inodes") release_ei() used call_rcu(), which covered the walker,
while eventfs_iterate() needs the SRCU grace period. Wait for both and
chain call_rcu() from the SRCU callback.
Fixes: 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes")
Cc: [email protected]
Signed-off-by: Christian Brauner (Amutable) <[email protected]>
---
Reproducer: delay.c holds a task named walker in tracefs_d_revalidate()
in rcu pathwalk mode for two seconds and repro.c frees the eventfs_inode
of its dentry meanwhile. The keep event keeps the rcuwalk directory
around.
echo 'p:rcuwalk/keep do_sys_openat2' >> /sys/kernel/tracing/kprobe_events
echo 'p:rcuwalk/ev do_sys_openat2' >> /sys/kernel/tracing/kprobe_events
insmod delay.ko
./repro
Without this patch that gives the splat above, with it it runs clean.
delay.c:
#include <linux/delay.h>
#include <linux/kprobes.h>
#include <linux/module.h>
#include <linux/namei.h>
/* keep a task named "walker" in tracefs_d_revalidate() in rcu pathwalk */
static int pre(struct kprobe *p, struct pt_regs *regs)
{
if ((regs_get_kernel_argument(regs, 3) & LOOKUP_RCU) &&
!strcmp(current->comm, "walker"))
mdelay(2000);
return 0;
}
static struct kprobe kp = {
.symbol_name = "tracefs_d_revalidate",
.pre_handler = pre,
};
static int __init delay_init(void)
{
return register_kprobe(&kp);
}
static void __exit delay_exit(void)
{
unregister_kprobe(&kp);
}
module_init(delay_init);
module_exit(delay_exit);
MODULE_LICENSE("GPL");
repro.c:
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <sched.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <unistd.h>
static void pin(int cpu)
{
cpu_set_t set;
CPU_ZERO(&set);
CPU_SET(cpu, &set);
sched_setaffinity(0, sizeof(set), &set);
}
static void *walker(void *arg)
{
struct stat st;
pin(1);
prctl(PR_SET_NAME, "walker");
stat("ev", &st);
return NULL;
}
int main(void)
{
struct stat st;
pthread_t t;
int fd;
pin(0);
chdir("/sys/kernel/tracing/events/rcuwalk");
stat("ev", &st);
/* sets ->is_freed, the dentry stays hashed and holds the ei */
fd = open("/sys/kernel/tracing/kprobe_events", O_WRONLY | O_APPEND);
write(fd, "-:rcuwalk/ev\n", 13);
close(fd);
pthread_create(&t, NULL, walker, NULL);
sleep(1);
/* ->d_revalidate() says 0, the dentry is killed and drops the ei */
stat("ev", &st);
pthread_join(t, NULL);
return 0;
}
---
fs/tracefs/event_inode.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 6e3513b13cfa..090aca946717 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -91,6 +91,14 @@ static void free_ei_rcu(struct rcu_head *rcu)
}
}
+/* read under eventfs_srcu and, by tracefs_d_revalidate(), in rcu pathwalk */
+static void free_ei_srcu(struct rcu_head *rcu)
+{
+ struct eventfs_inode *ei = container_of(rcu, struct eventfs_inode, rcu);
+
+ call_rcu(&ei->rcu, free_ei_rcu);
+}
+
/*
* eventfs_inode reference count management.
*
@@ -112,7 +120,7 @@ static void release_ei(struct kref *ref)
entry->release(entry->name, ei->data);
}
- call_srcu(&eventfs_srcu, &ei->rcu, free_ei_rcu);
+ call_srcu(&eventfs_srcu, &ei->rcu, free_ei_srcu);
}
static inline void put_ei(struct eventfs_inode *ei)
--
2.53.0
