lkml.org 
[lkml]   [2019]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] debugfs: fix potential infinite loop in debugfs_remove_recursive
From
Date
Thanks for your explanation

On 2019/11/14 4:17, Steven Rostedt wrote:
> On Thu, 31 Oct 2019 21:34:44 +0800
> yu kuai <yukuai3@huawei.com> wrote:
>
>> debugfs_remove_recursive uses list_empty to judge weather a dentry has
>> any subdentry or not. This can lead to infinite loop when any subdir is in
>> use.
>>
>> The problem was discoverd by the following steps in the console.
>> 1. use debugfs_create_dir to create a dir and multiple subdirs(insmod);
>> 2. cd to the subdir with depth not less than 2;
>> 3. call debugfs_remove_recursive(rmmod).
>>
>> After removing the subdir, the infinite loop is triggered bucause
>
> s/bucause/because/
>
>> debugfs_remove_recursive uses list_empty to judge if the current dir
>> doesn't have any subdentry, if so, remove the current dir and which
>> will never happen.
>>
>> Fix the problem by using simple_empty instead of list_empty.
>>
>> Fixes: 776164c1faac ('debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)')
>> Reported-by: chenxiang66@hisilicon.com
>> Signed-off-by: yu kuai <yukuai3@huawei.com>
>> ---
>> fs/debugfs/inode.c | 5 +++--
>> 1 file changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
>> index 7b975db..42b28acc 100644
>> --- a/fs/debugfs/inode.c
>> +++ b/fs/debugfs/inode.c
>> @@ -773,8 +773,10 @@ void debugfs_remove_recursive(struct dentry *dentry)
>> if (!simple_positive(child))
>> continue;
>>
>> - /* perhaps simple_empty(child) makes more sense */
>> - if (!list_empty(&child->d_subdirs)) {
>> + /* use simple_empty to prevent infinite loop when any
>> + * subdentry of child is in use
>> + */
>
> Nit, multi-line comments should be of the form:
>
> /*
> * comment line 1
> * comment line 2
> */
>
> Not
>
> /* comment line 1
> * comment line 2
> */
>
> It's known that the networking folks like that method, but it's not
> acceptable anywhere outside of networking.
>
Do you agree with that list_empty(&chile->d_subdirs) here is not
appropriate? Since it can't skip the subdirs that is not
simple_positive(simple_positive() will return false), which is the
reason of infinite loop.
>> + if (!simple_empty(child)) {
>
> Have you tried this with lockdep enabled? I'm thinking that you might
> get a splat with holding parent->d_lock and simple_empty(child) taking
> the child->d_lock.
The locks are taken and released in the right order:
take parent->d_lock
take child->d_lock
list_for_each_entry(c, &child->d_sundirs, d_child)
take c->d_lock
release c->d_lock
release child->d_lock
release parent->d_lock
I don't see anything wrong, am I missing something?

Thanks
Yu Kuai
>
> -- Steve
>
>
>> spin_unlock(&parent->d_lock);
>> inode_unlock(d_inode(parent));
>> parent = child;
>
>
> .
>

\
 
 \ /
  Last update: 2019-11-14 03:02    [W:0.066 / U:2.496 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site