mirror of
https://github.com/torvalds/linux.git
synced 2024-11-22 04:02:20 +00:00
31ad74b202
At present, the object->file has the NULL pointer dereference problem in
ondemand-mode. The root cause is that the allocated fd and object->file
lifetime are inconsistent, and the user-space invocation to anon_fd uses
object->file. Following is the process that triggers the issue:
[write fd] [umount]
cachefiles_ondemand_fd_write_iter
fscache_cookie_state_machine
cachefiles_withdraw_cookie
if (!file) return -ENOBUFS
cachefiles_clean_up_object
cachefiles_unmark_inode_in_use
fput(object->file)
object->file = NULL
// file NULL pointer dereference!
__cachefiles_write(..., file, ...)
Fix this issue by add an additional reference count to the object->file
before write/llseek, and decrement after it finished.
Fixes: c838305450
("cachefiles: notify the user daemon when looking up cookie")
Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
Link: https://lore.kernel.org/r/20241107110649.3980193-5-wozizhi@huawei.com
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
459 lines
12 KiB
C
459 lines
12 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/* FS-Cache interface to CacheFiles
|
|
*
|
|
* Copyright (C) 2021 Red Hat, Inc. All Rights Reserved.
|
|
* Written by David Howells (dhowells@redhat.com)
|
|
*/
|
|
|
|
#include <linux/slab.h>
|
|
#include <linux/mount.h>
|
|
#include <linux/xattr.h>
|
|
#include <linux/file.h>
|
|
#include <linux/falloc.h>
|
|
#include <trace/events/fscache.h>
|
|
#include "internal.h"
|
|
|
|
static atomic_t cachefiles_object_debug_id;
|
|
|
|
/*
|
|
* Allocate a cache object record.
|
|
*/
|
|
static
|
|
struct cachefiles_object *cachefiles_alloc_object(struct fscache_cookie *cookie)
|
|
{
|
|
struct fscache_volume *vcookie = cookie->volume;
|
|
struct cachefiles_volume *volume = vcookie->cache_priv;
|
|
struct cachefiles_object *object;
|
|
|
|
_enter("{%s},%x,", vcookie->key, cookie->debug_id);
|
|
|
|
object = kmem_cache_zalloc(cachefiles_object_jar, GFP_KERNEL);
|
|
if (!object)
|
|
return NULL;
|
|
|
|
if (cachefiles_ondemand_init_obj_info(object, volume)) {
|
|
kmem_cache_free(cachefiles_object_jar, object);
|
|
return NULL;
|
|
}
|
|
|
|
refcount_set(&object->ref, 1);
|
|
|
|
spin_lock_init(&object->lock);
|
|
INIT_LIST_HEAD(&object->cache_link);
|
|
object->volume = volume;
|
|
object->debug_id = atomic_inc_return(&cachefiles_object_debug_id);
|
|
object->cookie = fscache_get_cookie(cookie, fscache_cookie_get_attach_object);
|
|
|
|
fscache_count_object(vcookie->cache);
|
|
trace_cachefiles_ref(object->debug_id, cookie->debug_id, 1,
|
|
cachefiles_obj_new);
|
|
return object;
|
|
}
|
|
|
|
/*
|
|
* Note that an object has been seen.
|
|
*/
|
|
void cachefiles_see_object(struct cachefiles_object *object,
|
|
enum cachefiles_obj_ref_trace why)
|
|
{
|
|
trace_cachefiles_ref(object->debug_id, object->cookie->debug_id,
|
|
refcount_read(&object->ref), why);
|
|
}
|
|
|
|
/*
|
|
* Increment the usage count on an object;
|
|
*/
|
|
struct cachefiles_object *cachefiles_grab_object(struct cachefiles_object *object,
|
|
enum cachefiles_obj_ref_trace why)
|
|
{
|
|
int r;
|
|
|
|
__refcount_inc(&object->ref, &r);
|
|
trace_cachefiles_ref(object->debug_id, object->cookie->debug_id, r, why);
|
|
return object;
|
|
}
|
|
|
|
/*
|
|
* dispose of a reference to an object
|
|
*/
|
|
void cachefiles_put_object(struct cachefiles_object *object,
|
|
enum cachefiles_obj_ref_trace why)
|
|
{
|
|
unsigned int object_debug_id = object->debug_id;
|
|
unsigned int cookie_debug_id = object->cookie->debug_id;
|
|
struct fscache_cache *cache;
|
|
bool done;
|
|
int r;
|
|
|
|
done = __refcount_dec_and_test(&object->ref, &r);
|
|
trace_cachefiles_ref(object_debug_id, cookie_debug_id, r, why);
|
|
if (done) {
|
|
_debug("- kill object OBJ%x", object_debug_id);
|
|
|
|
ASSERTCMP(object->file, ==, NULL);
|
|
|
|
kfree(object->d_name);
|
|
cachefiles_ondemand_deinit_obj_info(object);
|
|
cache = object->volume->cache->cache;
|
|
fscache_put_cookie(object->cookie, fscache_cookie_put_object);
|
|
object->cookie = NULL;
|
|
kmem_cache_free(cachefiles_object_jar, object);
|
|
fscache_uncount_object(cache);
|
|
}
|
|
|
|
_leave("");
|
|
}
|
|
|
|
/*
|
|
* Adjust the size of a cache file if necessary to match the DIO size. We keep
|
|
* the EOF marker a multiple of DIO blocks so that we don't fall back to doing
|
|
* non-DIO for a partial block straddling the EOF, but we also have to be
|
|
* careful of someone expanding the file and accidentally accreting the
|
|
* padding.
|
|
*/
|
|
static int cachefiles_adjust_size(struct cachefiles_object *object)
|
|
{
|
|
struct iattr newattrs;
|
|
struct file *file = object->file;
|
|
uint64_t ni_size;
|
|
loff_t oi_size;
|
|
int ret;
|
|
|
|
ni_size = object->cookie->object_size;
|
|
ni_size = round_up(ni_size, CACHEFILES_DIO_BLOCK_SIZE);
|
|
|
|
_enter("{OBJ%x},[%llu]",
|
|
object->debug_id, (unsigned long long) ni_size);
|
|
|
|
if (!file)
|
|
return -ENOBUFS;
|
|
|
|
oi_size = i_size_read(file_inode(file));
|
|
if (oi_size == ni_size)
|
|
return 0;
|
|
|
|
inode_lock(file_inode(file));
|
|
|
|
/* if there's an extension to a partial page at the end of the backing
|
|
* file, we need to discard the partial page so that we pick up new
|
|
* data after it */
|
|
if (oi_size & ~PAGE_MASK && ni_size > oi_size) {
|
|
_debug("discard tail %llx", oi_size);
|
|
newattrs.ia_valid = ATTR_SIZE;
|
|
newattrs.ia_size = oi_size & PAGE_MASK;
|
|
ret = cachefiles_inject_remove_error();
|
|
if (ret == 0)
|
|
ret = notify_change(&nop_mnt_idmap, file->f_path.dentry,
|
|
&newattrs, NULL);
|
|
if (ret < 0)
|
|
goto truncate_failed;
|
|
}
|
|
|
|
newattrs.ia_valid = ATTR_SIZE;
|
|
newattrs.ia_size = ni_size;
|
|
ret = cachefiles_inject_write_error();
|
|
if (ret == 0)
|
|
ret = notify_change(&nop_mnt_idmap, file->f_path.dentry,
|
|
&newattrs, NULL);
|
|
|
|
truncate_failed:
|
|
inode_unlock(file_inode(file));
|
|
|
|
if (ret < 0)
|
|
trace_cachefiles_io_error(NULL, file_inode(file), ret,
|
|
cachefiles_trace_notify_change_error);
|
|
if (ret == -EIO) {
|
|
cachefiles_io_error_obj(object, "Size set failed");
|
|
ret = -ENOBUFS;
|
|
}
|
|
|
|
_leave(" = %d", ret);
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* Attempt to look up the nominated node in this cache
|
|
*/
|
|
static bool cachefiles_lookup_cookie(struct fscache_cookie *cookie)
|
|
{
|
|
struct cachefiles_object *object;
|
|
struct cachefiles_cache *cache = cookie->volume->cache->cache_priv;
|
|
const struct cred *saved_cred;
|
|
bool success;
|
|
|
|
object = cachefiles_alloc_object(cookie);
|
|
if (!object)
|
|
goto fail;
|
|
|
|
_enter("{OBJ%x}", object->debug_id);
|
|
|
|
if (!cachefiles_cook_key(object))
|
|
goto fail_put;
|
|
|
|
cookie->cache_priv = object;
|
|
|
|
cachefiles_begin_secure(cache, &saved_cred);
|
|
|
|
success = cachefiles_look_up_object(object);
|
|
if (!success)
|
|
goto fail_withdraw;
|
|
|
|
cachefiles_see_object(object, cachefiles_obj_see_lookup_cookie);
|
|
|
|
spin_lock(&cache->object_list_lock);
|
|
list_add(&object->cache_link, &cache->object_list);
|
|
spin_unlock(&cache->object_list_lock);
|
|
cachefiles_adjust_size(object);
|
|
|
|
cachefiles_end_secure(cache, saved_cred);
|
|
_leave(" = t");
|
|
return true;
|
|
|
|
fail_withdraw:
|
|
cachefiles_end_secure(cache, saved_cred);
|
|
cachefiles_see_object(object, cachefiles_obj_see_lookup_failed);
|
|
fscache_caching_failed(cookie);
|
|
_debug("failed c=%08x o=%08x", cookie->debug_id, object->debug_id);
|
|
/* The caller holds an access count on the cookie, so we need them to
|
|
* drop it before we can withdraw the object.
|
|
*/
|
|
return false;
|
|
|
|
fail_put:
|
|
cachefiles_put_object(object, cachefiles_obj_put_alloc_fail);
|
|
fail:
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* Shorten the backing object to discard any dirty data and free up
|
|
* any unused granules.
|
|
*/
|
|
static bool cachefiles_shorten_object(struct cachefiles_object *object,
|
|
struct file *file, loff_t new_size)
|
|
{
|
|
struct cachefiles_cache *cache = object->volume->cache;
|
|
struct inode *inode = file_inode(file);
|
|
loff_t i_size, dio_size;
|
|
int ret;
|
|
|
|
dio_size = round_up(new_size, CACHEFILES_DIO_BLOCK_SIZE);
|
|
i_size = i_size_read(inode);
|
|
|
|
trace_cachefiles_trunc(object, inode, i_size, dio_size,
|
|
cachefiles_trunc_shrink);
|
|
ret = cachefiles_inject_remove_error();
|
|
if (ret == 0)
|
|
ret = vfs_truncate(&file->f_path, dio_size);
|
|
if (ret < 0) {
|
|
trace_cachefiles_io_error(object, file_inode(file), ret,
|
|
cachefiles_trace_trunc_error);
|
|
cachefiles_io_error_obj(object, "Trunc-to-size failed %d", ret);
|
|
cachefiles_remove_object_xattr(cache, object, file->f_path.dentry);
|
|
return false;
|
|
}
|
|
|
|
if (new_size < dio_size) {
|
|
trace_cachefiles_trunc(object, inode, dio_size, new_size,
|
|
cachefiles_trunc_dio_adjust);
|
|
ret = cachefiles_inject_write_error();
|
|
if (ret == 0)
|
|
ret = vfs_fallocate(file, FALLOC_FL_ZERO_RANGE,
|
|
new_size, dio_size - new_size);
|
|
if (ret < 0) {
|
|
trace_cachefiles_io_error(object, file_inode(file), ret,
|
|
cachefiles_trace_fallocate_error);
|
|
cachefiles_io_error_obj(object, "Trunc-to-dio-size failed %d", ret);
|
|
cachefiles_remove_object_xattr(cache, object, file->f_path.dentry);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Resize the backing object.
|
|
*/
|
|
static void cachefiles_resize_cookie(struct netfs_cache_resources *cres,
|
|
loff_t new_size)
|
|
{
|
|
struct cachefiles_object *object = cachefiles_cres_object(cres);
|
|
struct cachefiles_cache *cache = object->volume->cache;
|
|
struct fscache_cookie *cookie = object->cookie;
|
|
const struct cred *saved_cred;
|
|
struct file *file = cachefiles_cres_file(cres);
|
|
loff_t old_size = cookie->object_size;
|
|
|
|
_enter("%llu->%llu", old_size, new_size);
|
|
|
|
if (new_size < old_size) {
|
|
cachefiles_begin_secure(cache, &saved_cred);
|
|
cachefiles_shorten_object(object, file, new_size);
|
|
cachefiles_end_secure(cache, saved_cred);
|
|
object->cookie->object_size = new_size;
|
|
return;
|
|
}
|
|
|
|
/* The file is being expanded. We don't need to do anything
|
|
* particularly. cookie->initial_size doesn't change and so the point
|
|
* at which we have to download before doesn't change.
|
|
*/
|
|
cookie->object_size = new_size;
|
|
}
|
|
|
|
/*
|
|
* Commit changes to the object as we drop it.
|
|
*/
|
|
static void cachefiles_commit_object(struct cachefiles_object *object,
|
|
struct cachefiles_cache *cache)
|
|
{
|
|
bool update = false;
|
|
|
|
if (test_and_clear_bit(FSCACHE_COOKIE_LOCAL_WRITE, &object->cookie->flags))
|
|
update = true;
|
|
if (test_and_clear_bit(FSCACHE_COOKIE_NEEDS_UPDATE, &object->cookie->flags))
|
|
update = true;
|
|
if (update)
|
|
cachefiles_set_object_xattr(object);
|
|
|
|
if (test_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags))
|
|
cachefiles_commit_tmpfile(cache, object);
|
|
}
|
|
|
|
/*
|
|
* Finalise and object and close the VFS structs that we have.
|
|
*/
|
|
static void cachefiles_clean_up_object(struct cachefiles_object *object,
|
|
struct cachefiles_cache *cache)
|
|
{
|
|
struct file *file;
|
|
|
|
if (test_bit(FSCACHE_COOKIE_RETIRED, &object->cookie->flags)) {
|
|
if (!test_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags)) {
|
|
cachefiles_see_object(object, cachefiles_obj_see_clean_delete);
|
|
_debug("- inval object OBJ%x", object->debug_id);
|
|
cachefiles_delete_object(object, FSCACHE_OBJECT_WAS_RETIRED);
|
|
} else {
|
|
cachefiles_see_object(object, cachefiles_obj_see_clean_drop_tmp);
|
|
_debug("- inval object OBJ%x tmpfile", object->debug_id);
|
|
}
|
|
} else {
|
|
cachefiles_see_object(object, cachefiles_obj_see_clean_commit);
|
|
cachefiles_commit_object(object, cache);
|
|
}
|
|
|
|
cachefiles_unmark_inode_in_use(object, object->file);
|
|
|
|
spin_lock(&object->lock);
|
|
file = object->file;
|
|
object->file = NULL;
|
|
spin_unlock(&object->lock);
|
|
|
|
if (file)
|
|
fput(file);
|
|
}
|
|
|
|
/*
|
|
* Withdraw caching for a cookie.
|
|
*/
|
|
static void cachefiles_withdraw_cookie(struct fscache_cookie *cookie)
|
|
{
|
|
struct cachefiles_object *object = cookie->cache_priv;
|
|
struct cachefiles_cache *cache = object->volume->cache;
|
|
const struct cred *saved_cred;
|
|
|
|
_enter("o=%x", object->debug_id);
|
|
cachefiles_see_object(object, cachefiles_obj_see_withdraw_cookie);
|
|
|
|
if (!list_empty(&object->cache_link)) {
|
|
spin_lock(&cache->object_list_lock);
|
|
cachefiles_see_object(object, cachefiles_obj_see_withdrawal);
|
|
list_del_init(&object->cache_link);
|
|
spin_unlock(&cache->object_list_lock);
|
|
}
|
|
|
|
cachefiles_ondemand_clean_object(object);
|
|
|
|
if (object->file) {
|
|
cachefiles_begin_secure(cache, &saved_cred);
|
|
cachefiles_clean_up_object(object, cache);
|
|
cachefiles_end_secure(cache, saved_cred);
|
|
}
|
|
|
|
cookie->cache_priv = NULL;
|
|
cachefiles_put_object(object, cachefiles_obj_put_detach);
|
|
}
|
|
|
|
/*
|
|
* Invalidate the storage associated with a cookie.
|
|
*/
|
|
static bool cachefiles_invalidate_cookie(struct fscache_cookie *cookie)
|
|
{
|
|
struct cachefiles_object *object = cookie->cache_priv;
|
|
struct file *new_file, *old_file;
|
|
bool old_tmpfile;
|
|
|
|
_enter("o=%x,[%llu]", object->debug_id, object->cookie->object_size);
|
|
|
|
old_tmpfile = test_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags);
|
|
|
|
if (!object->file) {
|
|
fscache_resume_after_invalidation(cookie);
|
|
_leave(" = t [light]");
|
|
return true;
|
|
}
|
|
|
|
new_file = cachefiles_create_tmpfile(object);
|
|
if (IS_ERR(new_file))
|
|
goto failed;
|
|
|
|
/* Substitute the VFS target */
|
|
_debug("sub");
|
|
spin_lock(&object->lock);
|
|
|
|
old_file = object->file;
|
|
object->file = new_file;
|
|
object->content_info = CACHEFILES_CONTENT_NO_DATA;
|
|
set_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags);
|
|
set_bit(FSCACHE_COOKIE_NEEDS_UPDATE, &object->cookie->flags);
|
|
|
|
spin_unlock(&object->lock);
|
|
_debug("subbed");
|
|
|
|
/* Allow I/O to take place again */
|
|
fscache_resume_after_invalidation(cookie);
|
|
|
|
if (old_file) {
|
|
if (!old_tmpfile) {
|
|
struct cachefiles_volume *volume = object->volume;
|
|
struct dentry *fan = volume->fanout[(u8)cookie->key_hash];
|
|
|
|
inode_lock_nested(d_inode(fan), I_MUTEX_PARENT);
|
|
cachefiles_bury_object(volume->cache, object, fan,
|
|
old_file->f_path.dentry,
|
|
FSCACHE_OBJECT_INVALIDATED);
|
|
}
|
|
fput(old_file);
|
|
}
|
|
|
|
_leave(" = t");
|
|
return true;
|
|
|
|
failed:
|
|
_leave(" = f");
|
|
return false;
|
|
}
|
|
|
|
const struct fscache_cache_ops cachefiles_cache_ops = {
|
|
.name = "cachefiles",
|
|
.acquire_volume = cachefiles_acquire_volume,
|
|
.free_volume = cachefiles_free_volume,
|
|
.lookup_cookie = cachefiles_lookup_cookie,
|
|
.withdraw_cookie = cachefiles_withdraw_cookie,
|
|
.invalidate_cookie = cachefiles_invalidate_cookie,
|
|
.begin_operation = cachefiles_begin_operation,
|
|
.resize_cookie = cachefiles_resize_cookie,
|
|
.prepare_to_write = cachefiles_prepare_to_write,
|
|
};
|