Revision 8aef18845266f5c05904c610088f2d1ed58f6be3 authored by Al Viro on 16 June 2011, 14:10:06 UTC, committed by Al Viro on 16 June 2011, 15:28:16 UTC
[Kudos to dhowells for tracking that crap down] If two processes attempt to cause automounting on the same mountpoint at the same time, the vfsmount holding the mountpoint will be left with one too few references on it, causing a BUG when the kernel tries to clean up. The problem is that lock_mount() drops the caller's reference to the mountpoint's vfsmount in the case where it finds something already mounted on the mountpoint as it transits to the mounted filesystem and replaces path->mnt with the new mountpoint vfsmount. During a pathwalk, however, we don't take a reference on the vfsmount if it is the same as the one in the nameidata struct, but do_add_mount() doesn't know this. The fix is to make sure we have a ref on the vfsmount of the mountpoint before calling do_add_mount(). However, if lock_mount() doesn't transit, we're then left with an extra ref on the mountpoint vfsmount which needs releasing. We can handle that in follow_managed() by not making assumptions about what we can and what we cannot get from lookup_mnt() as the current code does. The callers of follow_managed() expect that reference to path->mnt will be grabbed iff path->mnt has been changed. follow_managed() and follow_automount() keep track of whether such reference has been grabbed and assume that it'll happen in those and only those cases that'll have us return with changed path->mnt. That assumption is almost correct - it breaks in case of racing automounts and in even harder to hit race between following a mountpoint and a couple of mount --move. The thing is, we don't need to make that assumption at all - after the end of loop in follow_manage() we can check if path->mnt has ended up unchanged and do mntput() if needed. The BUG can be reproduced with the following test program: #include <stdio.h> #include <sys/types.h> #include <sys/stat.h> #include <unistd.h> #include <sys/wait.h> int main(int argc, char **argv) { int pid, ws; struct stat buf; pid = fork(); stat(argv[1], &buf); if (pid > 0) wait(&ws); return 0; } and the following procedure: (1) Mount an NFS volume that on the server has something else mounted on a subdirectory. For instance, I can mount / from my server: mount warthog:/ /mnt -t nfs4 -r On the server /data has another filesystem mounted on it, so NFS will see a change in FSID as it walks down the path, and will mark /mnt/data as being a mountpoint. This will cause the automount code to be triggered. !!! Do not look inside the mounted fs at this point !!! (2) Run the above program on a file within the submount to generate two simultaneous automount requests: /tmp/forkstat /mnt/data/testfile (3) Unmount the automounted submount: umount /mnt/data (4) Unmount the original mount: umount /mnt At this point the kernel should throw a BUG with something like the following: BUG: Dentry ffff880032e3c5c0{i=2,n=} still in use (1) [unmount of nfs4 0:12] Note that the bug appears on the root dentry of the original mount, not the mountpoint and not the submount because sys_umount() hasn't got to its final mntput_no_expire() yet, but this isn't so obvious from the call trace: [<ffffffff8117cd82>] shrink_dcache_for_umount+0x69/0x82 [<ffffffff8116160e>] generic_shutdown_super+0x37/0x15b [<ffffffffa00fae56>] ? nfs_super_return_all_delegations+0x2e/0x1b1 [nfs] [<ffffffff811617f3>] kill_anon_super+0x1d/0x7e [<ffffffffa00d0be1>] nfs4_kill_super+0x60/0xb6 [nfs] [<ffffffff81161c17>] deactivate_locked_super+0x34/0x83 [<ffffffff811629ff>] deactivate_super+0x6f/0x7b [<ffffffff81186261>] mntput_no_expire+0x18d/0x199 [<ffffffff811862a8>] mntput+0x3b/0x44 [<ffffffff81186d87>] release_mounts+0xa2/0xbf [<ffffffff811876af>] sys_umount+0x47a/0x4ba [<ffffffff8109e1ca>] ? trace_hardirqs_on_caller+0x1fd/0x22f [<ffffffff816ea86b>] system_call_fastpath+0x16/0x1b as do_umount() is inlined. However, you can see release_mounts() in there. Note also that it may be necessary to have multiple CPU cores to be able to trigger this bug. Tested-by: Jeff Layton <jlayton@redhat.com> Tested-by: Ian Kent <raven@themaw.net> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
1 parent 50338b8
File | Mode | Size |
---|---|---|
Kconfig | -rw-r--r-- | 41.6 KB |
Makefile | -rw-r--r-- | 5.1 KB |
abituguru.c | -rw-r--r-- | 52.0 KB |
abituguru3.c | -rw-r--r-- | 40.7 KB |
acpi_power_meter.c | -rw-r--r-- | 23.8 KB |
ad7414.c | -rw-r--r-- | 7.1 KB |
ad7418.c | -rw-r--r-- | 8.1 KB |
adcxx.c | -rw-r--r-- | 6.8 KB |
adm1021.c | -rw-r--r-- | 14.2 KB |
adm1025.c | -rw-r--r-- | 18.4 KB |
adm1026.c | -rw-r--r-- | 58.4 KB |
adm1029.c | -rw-r--r-- | 12.5 KB |
adm1031.c | -rw-r--r-- | 33.7 KB |
adm1275.c | -rw-r--r-- | 3.1 KB |
adm9240.c | -rw-r--r-- | 24.0 KB |
ads1015.c | -rw-r--r-- | 8.4 KB |
ads7828.c | -rw-r--r-- | 7.8 KB |
ads7871.c | -rw-r--r-- | 6.8 KB |
adt7411.c | -rw-r--r-- | 9.9 KB |
adt7462.c | -rw-r--r-- | 59.1 KB |
adt7470.c | -rw-r--r-- | 41.3 KB |
adt7475.c | -rw-r--r-- | 46.7 KB |
amc6821.c | -rw-r--r-- | 28.3 KB |
applesmc.c | -rw-r--r-- | 31.5 KB |
asb100.c | -rw-r--r-- | 27.9 KB |
asc7621.c | -rw-r--r-- | 35.0 KB |
asus_atk0110.c | -rw-r--r-- | 33.1 KB |
atxp1.c | -rw-r--r-- | 9.2 KB |
coretemp.c | -rw-r--r-- | 21.5 KB |
dme1737.c | -rw-r--r-- | 78.2 KB |
ds1621.c | -rw-r--r-- | 9.6 KB |
ds620.c | -rw-r--r-- | 8.6 KB |
emc1403.c | -rw-r--r-- | 10.9 KB |
emc2103.c | -rw-r--r-- | 20.9 KB |
emc6w201.c | -rw-r--r-- | 16.1 KB |
f71805f.c | -rw-r--r-- | 48.0 KB |
f71882fg.c | -rw-r--r-- | 82.3 KB |
f75375s.c | -rw-r--r-- | 21.3 KB |
fam15h_power.c | -rw-r--r-- | 5.9 KB |
fschmd.c | -rw-r--r-- | 40.6 KB |
g760a.c | -rw-r--r-- | 6.7 KB |
gl518sm.c | -rw-r--r-- | 22.6 KB |
gl520sm.c | -rw-r--r-- | 28.0 KB |
gpio-fan.c | -rw-r--r-- | 13.0 KB |
hwmon-vid.c | -rw-r--r-- | 8.7 KB |
hwmon.c | -rw-r--r-- | 3.3 KB |
i5k_amb.c | -rw-r--r-- | 16.1 KB |
ibmaem.c | -rw-r--r-- | 27.0 KB |
ibmpex.c | -rw-r--r-- | 15.0 KB |
it87.c | -rw-r--r-- | 66.7 KB |
jc42.c | -rw-r--r-- | 16.1 KB |
jz4740-hwmon.c | -rw-r--r-- | 5.4 KB |
k10temp.c | -rw-r--r-- | 6.7 KB |
k8temp.c | -rw-r--r-- | 9.4 KB |
lineage-pem.c | -rw-r--r-- | 15.7 KB |
lm63.c | -rw-r--r-- | 20.6 KB |
lm70.c | -rw-r--r-- | 5.9 KB |
lm73.c | -rw-r--r-- | 4.9 KB |
lm75.c | -rw-r--r-- | 11.6 KB |
lm75.h | -rw-r--r-- | 1.7 KB |
lm77.c | -rw-r--r-- | 13.1 KB |
lm78.c | -rw-r--r-- | 28.6 KB |
lm80.c | -rw-r--r-- | 19.6 KB |
lm83.c | -rw-r--r-- | 12.7 KB |
lm85.c | -rw-r--r-- | 48.5 KB |
lm87.c | -rw-r--r-- | 30.2 KB |
lm90.c | -rw-r--r-- | 44.6 KB |
lm92.c | -rw-r--r-- | 13.1 KB |
lm93.c | -rw-r--r-- | 83.2 KB |
lm95241.c | -rw-r--r-- | 12.3 KB |
ltc4151.c | -rw-r--r-- | 5.9 KB |
ltc4215.c | -rw-r--r-- | 8.3 KB |
ltc4245.c | -rw-r--r-- | 16.1 KB |
ltc4261.c | -rw-r--r-- | 7.9 KB |
max1111.c | -rw-r--r-- | 5.4 KB |
max16064.c | -rw-r--r-- | 2.5 KB |
max16065.c | -rw-r--r-- | 22.5 KB |
max1619.c | -rw-r--r-- | 10.3 KB |
max34440.c | -rw-r--r-- | 6.1 KB |
max6639.c | -rw-r--r-- | 18.9 KB |
max6642.c | -rw-r--r-- | 9.8 KB |
max6650.c | -rw-r--r-- | 19.6 KB |
max8688.c | -rw-r--r-- | 4.2 KB |
mc13783-adc.c | -rw-r--r-- | 6.8 KB |
pc87360.c | -rw-r--r-- | 55.1 KB |
pc87427.c | -rw-r--r-- | 40.3 KB |
pcf8591.c | -rw-r--r-- | 8.4 KB |
pmbus.c | -rw-r--r-- | 5.5 KB |
pmbus.h | -rw-r--r-- | 9.0 KB |
pmbus_core.c | -rw-r--r-- | 40.1 KB |
s3c-hwmon.c | -rw-r--r-- | 10.4 KB |
sch5627.c | -rw-r--r-- | 25.7 KB |
sht15.c | -rw-r--r-- | 29.0 KB |
sht21.c | -rw-r--r-- | 8.2 KB |
sis5595.c | -rw-r--r-- | 25.1 KB |
smm665.c | -rw-r--r-- | 21.2 KB |
smsc47b397.c | -rw-r--r-- | 9.8 KB |
smsc47m1.c | -rw-r--r-- | 24.7 KB |
smsc47m192.c | -rw-r--r-- | 20.7 KB |
thmc50.c | -rw-r--r-- | 14.0 KB |
tmp102.c | -rw-r--r-- | 8.5 KB |
tmp401.c | -rw-r--r-- | 18.3 KB |
tmp421.c | -rw-r--r-- | 8.5 KB |
twl4030-madc-hwmon.c | -rw-r--r-- | 4.8 KB |
ucd9000.c | -rw-r--r-- | 6.6 KB |
ucd9200.c | -rw-r--r-- | 5.6 KB |
ultra45_env.c | -rw-r--r-- | 8.4 KB |
via-cputemp.c | -rw-r--r-- | 7.6 KB |
via686a.c | -rw-r--r-- | 30.7 KB |
vt1211.c | -rw-r--r-- | 38.8 KB |
vt8231.c | -rw-r--r-- | 30.8 KB |
w83627ehf.c | -rw-r--r-- | 75.5 KB |
w83627hf.c | -rw-r--r-- | 54.2 KB |
w83781d.c | -rw-r--r-- | 57.1 KB |
w83791d.c | -rw-r--r-- | 50.3 KB |
w83792d.c | -rw-r--r-- | 56.0 KB |
w83793.c | -rw-r--r-- | 60.6 KB |
w83795.c | -rw-r--r-- | 62.1 KB |
w83l785ts.c | -rw-r--r-- | 8.4 KB |
w83l786ng.c | -rw-r--r-- | 21.7 KB |
wm831x-hwmon.c | -rw-r--r-- | 6.2 KB |
wm8350-hwmon.c | -rw-r--r-- | 4.0 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...