original development tree for Linux kernel GTP module; now long in mainline.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

161 lines
5.0 KiB

/* -*- mode: c; c-basic-offset:8; -*-
* vim: noexpandtab sw=8 ts=8 sts=0:
*
* configfs_internal.h - Internal stuff for configfs
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public
* License as published by the Free Software Foundation; either
* version 2 of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
* You should have received a copy of the GNU General Public
* License along with this program; if not, write to the
* Free Software Foundation, Inc., 59 Temple Place - Suite 330,
* Boston, MA 021110-1307, USA.
*
* Based on sysfs:
* sysfs is Copyright (C) 2001, 2002, 2003 Patrick Mochel
*
* configfs Copyright (C) 2005 Oracle. All rights reserved.
*/
#include <linux/slab.h>
#include <linux/list.h>
#include <linux/spinlock.h>
struct configfs_dirent {
atomic_t s_count;
int s_dependent_count;
struct list_head s_sibling;
struct list_head s_children;
struct list_head s_links;
void * s_element;
int s_type;
umode_t s_mode;
struct dentry * s_dentry;
struct iattr * s_iattr;
configfs: Silence lockdep on mkdir() and rmdir() When attaching default groups (subdirs) of a new group (in mkdir() or in configfs_register()), configfs recursively takes inode&#39;s mutexes along the path from the parent of the new group to the default subdirs. This is needed to ensure that the VFS will not race with operations on these sub-dirs. This is safe for the following reasons: - the VFS allows one to lock first an inode and second one of its children (The lock subclasses for this pattern are respectively I_MUTEX_PARENT and I_MUTEX_CHILD); - from this rule any inode path can be recursively locked in descending order as long as it stays under a single mountpoint and does not follow symlinks. Unfortunately lockdep does not know (yet?) how to handle such recursion. I&#39;ve tried to use Peter Zijlstra&#39;s lock_set_subclass() helper to upgrade i_mutexes from I_MUTEX_CHILD to I_MUTEX_PARENT when we know that we might recursively lock some of their descendant, but this usage does not seem to fit the purpose of lock_set_subclass() because it leads to several i_mutex locked with subclass I_MUTEX_PARENT by the same task. &gt;From inside configfs it is not possible to serialize those recursive locking with a top-level one, because mkdir() and rmdir() are already called with inodes locked by the VFS. So using some mutex_lock_nest_lock() is not an option. I am proposing two solutions: 1) one that wraps recursive mutex_lock()s with lockdep_off()/lockdep_on(). 2) (as suggested earlier by Peter Zijlstra) one that puts the i_mutexes recursively locked in different classes based on their depth from the top-level config_group created. This induces an arbitrary limit (MAX_LOCK_DEPTH - 2 == 46) on the nesting of configfs default groups whenever lockdep is activated but this limit looks reasonably high. Unfortunately, this also isolates VFS operations on configfs default groups from the others and thus lowers the chances to detect locking issues. Nobody likes solution 1), which I can understand. This patch implements solution 2). However lockdep is still not happy with configfs_depend_item(). Next patch reworks the locking of configfs_depend_item() and finally makes lockdep happy. [ Note: This hides a few locking interactions with the VFS from lockdep. That was my big concern, because we like lockdep&#39;s protection. However, the current state always dumps a spurious warning. The locking is correct, so I tell people to ignore the warning and that we&#39;ll keep our eyes on the locking to make sure it stays correct. With this patch, we eliminate the warning. We do lose some of the lockdep protections, but this only means that we still have to keep our eyes on the locking. We&#39;re going to do that anyway. -- Joel ] Signed-off-by: Louis Rilling &lt;louis.rilling@kerlabs.com&gt; Signed-off-by: Joel Becker &lt;joel.becker@oracle.com&gt;
13 years ago
#ifdef CONFIG_LOCKDEP
int s_depth;
#endif
};
#define CONFIGFS_ROOT 0x0001
#define CONFIGFS_DIR 0x0002
#define CONFIGFS_ITEM_ATTR 0x0004
#define CONFIGFS_ITEM_LINK 0x0020
#define CONFIGFS_USET_DIR 0x0040
#define CONFIGFS_USET_DEFAULT 0x0080
#define CONFIGFS_USET_DROPPING 0x0100
#define CONFIGFS_USET_IN_MKDIR 0x0200
[PATCH] configfs: Prevent userspace from creating new entries under attaching directories process 1: process 2: configfs_mkdir(&#34;A&#34;) attach_group(&#34;A&#34;) attach_item(&#34;A&#34;) d_instantiate(&#34;A&#34;) populate_groups(&#34;A&#34;) mutex_lock(&#34;A&#34;) attach_group(&#34;A/B&#34;) attach_item(&#34;A&#34;) d_instantiate(&#34;A/B&#34;) mkdir(&#34;A/B/C&#34;) do_path_lookup(&#34;A/B/C&#34;, LOOKUP_PARENT) ok lookup_create(&#34;A/B/C&#34;) mutex_lock(&#34;A/B&#34;) ok configfs_mkdir(&#34;A/B/C&#34;) ok attach_group(&#34;A/C&#34;) attach_item(&#34;A/C&#34;) d_instantiate(&#34;A/C&#34;) populate_groups(&#34;A/C&#34;) mutex_lock(&#34;A/C&#34;) attach_group(&#34;A/C/D&#34;) attach_item(&#34;A/C/D&#34;) failure mutex_unlock(&#34;A/C&#34;) detach_groups(&#34;A/C&#34;) nothing to do mkdir(&#34;A/C/E&#34;) do_path_lookup(&#34;A/C/E&#34;, LOOKUP_PARENT) ok lookup_create(&#34;A/C/E&#34;) mutex_lock(&#34;A/C&#34;) ok configfs_mkdir(&#34;A/C/E&#34;) ok detach_item(&#34;A/C&#34;) d_delete(&#34;A/C&#34;) mutex_unlock(&#34;A&#34;) detach_groups(&#34;A&#34;) mutex_lock(&#34;A/B&#34;) detach_group(&#34;A/B&#34;) detach_groups(&#34;A/B&#34;) nothing since no _default_ group detach_item(&#34;A/B&#34;) mutex_unlock(&#34;A/B&#34;) d_delete(&#34;A/B&#34;) detach_item(&#34;A&#34;) d_delete(&#34;A&#34;) Two bugs: 1/ &#34;A/B/C&#34; and &#34;A/C/E&#34; are created, but never removed while their parent are removed in the end. The same could happen with symlink() instead of mkdir(). 2/ &#34;A&#34; and &#34;A/C&#34; inodes are not locked while detach_item() is called on them, which may probably confuse VFS. This commit fixes 1/, tagging new directories with CONFIGFS_USET_CREATING before building the inode and instantiating the dentry, and validating the whole group+default groups hierarchy in a second pass by clearing CONFIGFS_USET_CREATING. mkdir(), symlink(), lookup(), and dir_open() simply return -ENOENT if called in (or linking to) a directory tagged with CONFIGFS_USET_CREATING. This does not prevent userspace from calling stat() successfuly on such directories, but this prevents userspace from adding (children to | symlinking from/to | read/write attributes of | listing the contents of) not validated items. In other words, userspace will not interact with the subsystem on a new item until the new item creation completes correctly. It was first proposed to re-use CONFIGFS_USET_IN_MKDIR instead of a new flag CONFIGFS_USET_CREATING, but this generated conflicts when checking the target of a new symlink: a valid target directory in the middle of attaching a new user-created child item could be wrongly detected as being attached. 2/ is fixed by next commit. Signed-off-by: Louis Rilling &lt;louis.rilling@kerlabs.com&gt; Signed-off-by: Joel Becker &lt;joel.becker@oracle.com&gt; Signed-off-by: Mark Fasheh &lt;mfasheh@suse.com&gt;
14 years ago
#define CONFIGFS_USET_CREATING 0x0400
#define CONFIGFS_NOT_PINNED (CONFIGFS_ITEM_ATTR)
extern struct mutex configfs_symlink_mutex;
extern spinlock_t configfs_dirent_lock;
extern struct kmem_cache *configfs_dir_cachep;
extern int configfs_is_root(struct config_item *item);
extern struct inode * configfs_new_inode(umode_t mode, struct configfs_dirent *, struct super_block *);
extern int configfs_create(struct dentry *, umode_t mode, int (*init)(struct inode *));
extern int configfs_inode_init(void);
extern void configfs_inode_exit(void);
extern int configfs_create_file(struct config_item *, const struct configfs_attribute *);
extern int configfs_make_dirent(struct configfs_dirent *,
struct dentry *, void *, umode_t, int);
[PATCH] configfs: Prevent userspace from creating new entries under attaching directories process 1: process 2: configfs_mkdir(&#34;A&#34;) attach_group(&#34;A&#34;) attach_item(&#34;A&#34;) d_instantiate(&#34;A&#34;) populate_groups(&#34;A&#34;) mutex_lock(&#34;A&#34;) attach_group(&#34;A/B&#34;) attach_item(&#34;A&#34;) d_instantiate(&#34;A/B&#34;) mkdir(&#34;A/B/C&#34;) do_path_lookup(&#34;A/B/C&#34;, LOOKUP_PARENT) ok lookup_create(&#34;A/B/C&#34;) mutex_lock(&#34;A/B&#34;) ok configfs_mkdir(&#34;A/B/C&#34;) ok attach_group(&#34;A/C&#34;) attach_item(&#34;A/C&#34;) d_instantiate(&#34;A/C&#34;) populate_groups(&#34;A/C&#34;) mutex_lock(&#34;A/C&#34;) attach_group(&#34;A/C/D&#34;) attach_item(&#34;A/C/D&#34;) failure mutex_unlock(&#34;A/C&#34;) detach_groups(&#34;A/C&#34;) nothing to do mkdir(&#34;A/C/E&#34;) do_path_lookup(&#34;A/C/E&#34;, LOOKUP_PARENT) ok lookup_create(&#34;A/C/E&#34;) mutex_lock(&#34;A/C&#34;) ok configfs_mkdir(&#34;A/C/E&#34;) ok detach_item(&#34;A/C&#34;) d_delete(&#34;A/C&#34;) mutex_unlock(&#34;A&#34;) detach_groups(&#34;A&#34;) mutex_lock(&#34;A/B&#34;) detach_group(&#34;A/B&#34;) detach_groups(&#34;A/B&#34;) nothing since no _default_ group detach_item(&#34;A/B&#34;) mutex_unlock(&#34;A/B&#34;) d_delete(&#34;A/B&#34;) detach_item(&#34;A&#34;) d_delete(&#34;A&#34;) Two bugs: 1/ &#34;A/B/C&#34; and &#34;A/C/E&#34; are created, but never removed while their parent are removed in the end. The same could happen with symlink() instead of mkdir(). 2/ &#34;A&#34; and &#34;A/C&#34; inodes are not locked while detach_item() is called on them, which may probably confuse VFS. This commit fixes 1/, tagging new directories with CONFIGFS_USET_CREATING before building the inode and instantiating the dentry, and validating the whole group+default groups hierarchy in a second pass by clearing CONFIGFS_USET_CREATING. mkdir(), symlink(), lookup(), and dir_open() simply return -ENOENT if called in (or linking to) a directory tagged with CONFIGFS_USET_CREATING. This does not prevent userspace from calling stat() successfuly on such directories, but this prevents userspace from adding (children to | symlinking from/to | read/write attributes of | listing the contents of) not validated items. In other words, userspace will not interact with the subsystem on a new item until the new item creation completes correctly. It was first proposed to re-use CONFIGFS_USET_IN_MKDIR instead of a new flag CONFIGFS_USET_CREATING, but this generated conflicts when checking the target of a new symlink: a valid target directory in the middle of attaching a new user-created child item could be wrongly detected as being attached. 2/ is fixed by next commit. Signed-off-by: Louis Rilling &lt;louis.rilling@kerlabs.com&gt; Signed-off-by: Joel Becker &lt;joel.becker@oracle.com&gt; Signed-off-by: Mark Fasheh &lt;mfasheh@suse.com&gt;
14 years ago
extern int configfs_dirent_is_ready(struct configfs_dirent *);
extern int configfs_add_file(struct dentry *, const struct configfs_attribute *, int);
extern void configfs_hash_and_remove(struct dentry * dir, const char * name);
extern const unsigned char * configfs_get_name(struct configfs_dirent *sd);
extern void configfs_drop_dentry(struct configfs_dirent *sd, struct dentry *parent);
extern int configfs_setattr(struct dentry *dentry, struct iattr *iattr);
extern struct dentry *configfs_pin_fs(void);
extern void configfs_release_fs(void);
extern struct rw_semaphore configfs_rename_sem;
extern const struct file_operations configfs_dir_operations;
extern const struct file_operations configfs_file_operations;
extern const struct file_operations bin_fops;
extern const struct inode_operations configfs_dir_inode_operations;
extern const struct inode_operations configfs_root_inode_operations;
extern const struct inode_operations configfs_symlink_inode_operations;
extern const struct dentry_operations configfs_dentry_ops;
extern int configfs_symlink(struct inode *dir, struct dentry *dentry,
const char *symname);
extern int configfs_unlink(struct inode *dir, struct dentry *dentry);
struct configfs_symlink {
struct list_head sl_list;
struct config_item *sl_target;
};
extern int configfs_create_link(struct configfs_symlink *sl,
struct dentry *parent,
struct dentry *dentry);
static inline struct config_item * to_item(struct dentry * dentry)
{
struct configfs_dirent * sd = dentry->d_fsdata;
return ((struct config_item *) sd->s_element);
}
static inline struct configfs_attribute * to_attr(struct dentry * dentry)
{
struct configfs_dirent * sd = dentry->d_fsdata;
return ((struct configfs_attribute *) sd->s_element);
}
static inline struct config_item *configfs_get_config_item(struct dentry *dentry)
{
struct config_item * item = NULL;
spin_lock(&dentry->d_lock);
if (!d_unhashed(dentry)) {
struct configfs_dirent * sd = dentry->d_fsdata;
if (sd->s_type & CONFIGFS_ITEM_LINK) {
struct configfs_symlink * sl = sd->s_element;
item = config_item_get(sl->sl_target);
} else
item = config_item_get(sd->s_element);
}
spin_unlock(&dentry->d_lock);
return item;
}
static inline void release_configfs_dirent(struct configfs_dirent * sd)
{
if (!(sd->s_type & CONFIGFS_ROOT)) {
kfree(sd->s_iattr);
kmem_cache_free(configfs_dir_cachep, sd);
}
}
static inline struct configfs_dirent * configfs_get(struct configfs_dirent * sd)
{
if (sd) {
WARN_ON(!atomic_read(&sd->s_count));
atomic_inc(&sd->s_count);
}
return sd;
}
static inline void configfs_put(struct configfs_dirent * sd)
{
WARN_ON(!atomic_read(&sd->s_count));
if (atomic_dec_and_test(&sd->s_count))
release_configfs_dirent(sd);
}