DPDK patches and discussions
 help / color / mirror / Atom feed
From: Neil Horman <nhorman@tuxdriver.com>
To: Pavel Boldin <pboldin@mirantis.com>
Cc: dev@dpdk.org
Subject: Re: [dpdk-dev] [PATCH] Fix `eventfd_link' module leakages and races
Date: Mon, 16 Mar 2015 13:55:56 -0400	[thread overview]
Message-ID: <20150316175556.GF16238@hmsreliant.think-freely.org> (raw)
In-Reply-To: <1426524059-30886-1-git-send-email-pboldin+dpdk@mirantis.com>

On Mon, Mar 16, 2015 at 06:40:59PM +0200, Pavel Boldin wrote:
> From: Pavel Boldin <pboldin@mirantis.com>
> 
> The `eventfd_link' module provides an API to "steal" fd from another
> process had been written with a bug that leaks `struct file' because of the
> extra reference counter increment and missing `fput' call.
> 
> The other bug is using another process' `task_struct' without incrementing
> a reference counter.
> 
> Fix these bugs and refactor the module.
> ---
>  examples/vhost/eventfd_link/eventfd_link.c | 236 ++++++++++++++++-------------
>  1 file changed, 130 insertions(+), 106 deletions(-)
> 
> diff --git a/examples/vhost/eventfd_link/eventfd_link.c b/examples/vhost/eventfd_link/eventfd_link.c
> index 69470ba..9f1f8fb 100644
> --- a/examples/vhost/eventfd_link/eventfd_link.c
> +++ b/examples/vhost/eventfd_link/eventfd_link.c
> @@ -42,15 +42,15 @@
>   * get_files_struct is copied from fs/file.c
>   */
>  struct files_struct *
> -get_files_struct (struct task_struct *task)
> +get_files_struct(struct task_struct *task)
>  {
>  	struct files_struct *files;
>  
> -	task_lock (task);
> +	task_lock(task);
>  	files = task->files;
>  	if (files)
> -		atomic_inc (&files->count);
> -	task_unlock (task);
> +		atomic_inc(&files->count);
> +	task_unlock(task);
>  
>  	return files;
>  }
> @@ -59,117 +59,142 @@ get_files_struct (struct task_struct *task)
>   * put_files_struct is extracted from fs/file.c
>   */
>  void
> -put_files_struct (struct files_struct *files)
> +put_files_struct(struct files_struct *files)
>  {
> -	if (atomic_dec_and_test (&files->count))
> -	{
> +	if (atomic_dec_and_test(&files->count))
>  		BUG ();
> +}
> +
> +static struct file *
> +fget_from_files(struct files_struct *files, unsigned fd)
> +{
> +	struct file *file;
> +
> +	rcu_read_lock();
> +	file = fcheck_files(files, fd);
> +	if (file)
> +	{
> +		if (file->f_mode & FMODE_PATH
> +			|| !atomic_long_inc_not_zero(&file->f_count))
> +		    file = NULL;
>  	}
> +	rcu_read_unlock();
> +
> +	return file;
> +}
> +
> +static int
> +close_fd(unsigned fd)
> +{
> +	struct file *file;
> +	struct files_struct *files = current->files;
> +	struct fdtable *fdt;
> +
> +	spin_lock(&files->file_lock);
> +	fdt = files_fdtable(files);
> +	if (fd >= fdt->max_fds)
> +		goto out_unlock;
> +	file = fdt->fd[fd];
> +	if (!file)
> +		goto out_unlock;
> +	rcu_assign_pointer(fdt->fd[fd], NULL);
> +	__clear_bit(fd, fdt->close_on_exec);
> +	spin_unlock(&files->file_lock);
> +	return filp_close(file, files);
> +
> +out_unlock:
> +	spin_unlock(&files->file_lock);
> +	return -EBADF;
>  }
>  
>  
>  static long
> -eventfd_link_ioctl (struct file *f, unsigned int ioctl, unsigned long arg)
> +eventfd_link_ioctl_copy(unsigned long arg)
>  {
> -	void __user *argp = (void __user *) arg;
> +	long ret = -EFAULT;
>  	struct task_struct *task_target = NULL;
> -	struct file *file;
> -	struct files_struct *files;
> -	struct fdtable *fdt;
> +	struct file *target_file = NULL;
> +	struct files_struct *target_files = NULL;
>  	struct eventfd_copy eventfd_copy;
> +	struct pid *pid;
> +
> +	if (copy_from_user(&eventfd_copy, (void __user*)arg,
> +			    sizeof(struct eventfd_copy)))
> +		goto out;
> +
> +	/*
> +	 * Find the task struct for the target pid
> +	 */
> +	pid = find_vpid(eventfd_copy.target_pid);
> +	if (pid == NULL) {
> +		printk(KERN_INFO "Unable to find pid %d\n",
> +			eventfd_copy.target_pid);
> +		goto out;
> +	}
> +
> +	task_target = get_pid_task(pid, PIDTYPE_PID);
> +	if (task_target == NULL) {
> +		printk(KERN_INFO "Failed to get task for pid %d\n",
> +			eventfd_copy.target_pid);
> +		goto out;
> +	}
> +
> +	ret = close_fd(eventfd_copy.source_fd);
> +	if (ret)
> +		goto out_task;
> +	ret = -EFAULT;
> +
> +	/*
> +	 * Find the file struct associated with the target fd.
> +	 */
> +
> +	target_files = get_files_struct(task_target);
> +	if (target_files == NULL) {
> +		printk (KERN_INFO "Failed to get target files struct\n");
> +		goto out_task;
> +	}
> +
> +	target_file = fget_from_files(target_files, eventfd_copy.target_fd);
> +
> +	if (target_file == NULL) {
> +		printk (KERN_INFO "Failed to get file from target pid\n");
> +		goto out_target_files;
> +	}
> +
> +
> +	/*
> +	 * Install the file struct from the target process into the
> +	 * file desciptor of the source process,
> +	 */
> +
> +	fd_install(eventfd_copy.source_fd, target_file);
> +
> +	ret = 0;
> +
> +out_target_files:
> +	put_files_struct(target_files);
> +out_task:
> +	put_task_struct(task_target);
> +out:
> +	return ret;
> +}
> +
> +static long
> +eventfd_link_ioctl(struct file *f, unsigned int ioctl, unsigned long arg)
> +{
> +	long ret;
>  
>  	switch (ioctl)
>  	{
>  		case EVENTFD_COPY:
> -			if (copy_from_user (&eventfd_copy, argp, sizeof (struct eventfd_copy)))
> -				return -EFAULT;
> -
> -			/*
> -			 * Find the task struct for the target pid
> -			 */
> -			task_target =
> -				pid_task (find_vpid (eventfd_copy.target_pid), PIDTYPE_PID);
> -			if (task_target == NULL)
> -			{
> -				printk (KERN_DEBUG "Failed to get mem ctx for target pid\n");
> -				return -EFAULT;
> -			}
> -
> -			files = get_files_struct (current);
> -			if (files == NULL)
> -			{
> -				printk (KERN_DEBUG "Failed to get files struct\n");
> -				return -EFAULT;
> -			}
> -
> -			rcu_read_lock ();
> -			file = fcheck_files (files, eventfd_copy.source_fd);
> -			if (file)
> -			{
> -				if (file->f_mode & FMODE_PATH
> -						|| !atomic_long_inc_not_zero (&file->f_count))
> -					file = NULL;
> -			}
> -			rcu_read_unlock ();
> -			put_files_struct (files);
> -
> -			if (file == NULL)
> -			{
> -				printk (KERN_DEBUG "Failed to get file from source pid\n");
> -				return 0;
> -			}
> -
> -			/*
> -			 * Release the existing eventfd in the source process
> -			 */
> -			spin_lock (&files->file_lock);
> -			fput(file);
> -			filp_close (file, files);
> -			fdt = files_fdtable (files);
> -			fdt->fd[eventfd_copy.source_fd] = NULL;
> -			spin_unlock (&files->file_lock);
> -
> -			/*
> -			 * Find the file struct associated with the target fd.
> -			 */
> -
> -			files = get_files_struct (task_target);
> -			if (files == NULL)
> -			{
> -				printk (KERN_DEBUG "Failed to get files struct\n");
> -				return -EFAULT;
> -			}
> -
> -			rcu_read_lock ();
> -			file = fcheck_files (files, eventfd_copy.target_fd);
> -			if (file)
> -			{
> -				if (file->f_mode & FMODE_PATH
> -						|| !atomic_long_inc_not_zero (&file->f_count))
> -					file = NULL;
> -			}
> -			rcu_read_unlock ();
> -			put_files_struct (files);
> -
> -			if (file == NULL)
> -			{
> -				printk (KERN_DEBUG "Failed to get file from target pid\n");
> -				return 0;
> -			}
> -
> -
> -			/*
> -			 * Install the file struct from the target process into the
> -			 * file desciptor of the source process,
> -			 */
> -
> -			fd_install (eventfd_copy.source_fd, file);
> -
> -			return 0;
> -
> +			ret = eventfd_link_ioctl_copy(arg);
> +			break;
>  		default:
> -			return -ENOIOCTLCMD;
> +			ret = -ENOIOCTLCMD;
> +			break;
>  	}
> +
> +	return ret;
>  }
>  
>  static const struct file_operations eventfd_link_fops = {
> @@ -184,21 +209,20 @@ static struct miscdevice eventfd_link_misc = {
>  };
>  
>  static int __init
> -eventfd_link_init (void)
> +eventfd_link_init(void)
>  {
> -	printk(KERN_INFO "eventfd_link is broken, use it at your risk\n");
> -	return misc_register (&eventfd_link_misc);
> +	return misc_register(&eventfd_link_misc);
>  }
>  
> -module_init (eventfd_link_init);
> +module_init(eventfd_link_init);
>  
>  static void __exit
> -eventfd_link_exit (void)
> +eventfd_link_exit(void)
>  {
> -	misc_deregister (&eventfd_link_misc);
> +	misc_deregister(&eventfd_link_misc);
>  }
>  
> -module_exit (eventfd_link_exit);
> +module_exit(eventfd_link_exit);
>  
>  MODULE_VERSION ("0.0.1");
>  MODULE_LICENSE ("GPL v2");
> -- 
> 1.9.1
> 
> 
You need to respin this.  This library has since moved to another location in
the tree
Neil

  reply	other threads:[~2015-03-16 17:56 UTC|newest]

Thread overview: 58+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-03-16 16:40 Pavel Boldin
2015-03-16 17:55 ` Neil Horman [this message]
2015-03-17  1:29 ` Ouyang, Changchun
2015-03-20 15:57   ` Pavel Boldin
2015-03-18 13:16 ` [dpdk-dev] [PATCH v2] " Pavel Boldin
2015-03-23 11:15   ` Thomas Monjalon
2015-03-23 11:36     ` Pavel Boldin
2015-03-23 11:44       ` Thomas Monjalon
2015-03-23 15:15   ` [dpdk-dev] [PATCH v3] vhost: Refactor module `eventfd_link' Pavel Boldin
2015-04-02 17:01     ` [dpdk-dev] [PATCH v4 0/5] " Pavel Boldin
2015-04-02 17:01       ` [dpdk-dev] [PATCH v4 1/5] vhost: eventfd_link: moving ioctl to a function Pavel Boldin
2015-05-07  7:57         ` Xie, Huawei
     [not found]           ` <CACf4_B8MDfkaEk5jMjMbEw9F8LsBVLA9TUWwOBU=SCAxzFmSFw@mail.gmail.com>
2015-05-18  6:06             ` Xie, Huawei
2015-05-18  9:16               ` Pavel Boldin
2015-06-18  3:08             ` Xie, Huawei
2015-04-02 17:01       ` [dpdk-dev] [PATCH v4 2/5] vhost: eventfd_link: add function fget_from_files Pavel Boldin
2015-04-02 17:01       ` [dpdk-dev] [PATCH v4 3/5] vhost: eventfd_link: fix ioctl return values Pavel Boldin
2015-04-02 17:01       ` [dpdk-dev] [PATCH v4 4/5] vhost: eventfd_link: replace copy-pasted sys_close Pavel Boldin
2015-04-02 17:01       ` [dpdk-dev] [PATCH v4 5/5] vhost: eventfd_link: removing extra #includes Pavel Boldin
2015-04-16 11:48       ` [dpdk-dev] [PATCH v5 0/5] Refactor module `eventfd_link' Pavel Boldin
2015-04-16 11:48         ` [dpdk-dev] [PATCH v5 1/5] vhost: eventfd_link: moving ioctl to a function Pavel Boldin
2015-08-28 18:51           ` [dpdk-dev] [PATCH v5 1/4] vhost: eventfd_link: refactoring EVENTFD_COPY handler Pavel Boldin
2015-09-23 20:25             ` Pavel Boldin
2015-09-29 19:42               ` Thomas Monjalon
2015-09-29 23:29                 ` Pavel Boldin
2015-10-20  9:06             ` Xie, Huawei
2015-10-28 18:33             ` [dpdk-dev] [PATCH v6 0/3] vhost: eventfd_link refactoring Pavel Boldin
2015-10-29 18:33               ` Xie, Huawei
2015-10-30 19:10                 ` Thomas Monjalon
2015-10-28 18:33             ` [dpdk-dev] [PATCH v6 1/3] vhost: eventfd_link: refactoring EVENTFD_COPY handler Pavel Boldin
2015-10-28 18:33             ` [dpdk-dev] [PATCH v6 2/3] vhost: add EVENTFD_COPY2 ioctl Pavel Boldin
2015-10-28 18:33             ` [dpdk-dev] [PATCH v6 3/3] vhost: using EVENTFD_COPY2 Pavel Boldin
2015-08-28 18:51           ` [dpdk-dev] [PATCH v5 2/4] vhost: add EVENTFD_COPY2 ioctl Pavel Boldin
2015-10-20  9:43             ` Xie, Huawei
2015-08-28 18:51           ` [dpdk-dev] [PATCH v5 3/4] vhost: using EVENTFD_COPY2 Pavel Boldin
2015-10-20  9:52             ` Xie, Huawei
2015-10-21 12:16               ` Pavel Boldin
2015-10-26  1:45                 ` Xie, Huawei
2015-10-28 18:35                   ` Pavel Boldin
2015-08-28 18:51           ` [dpdk-dev] [PATCH v5 4/4] DO NOT MERGE: Tests for new eventfd_link module Pavel Boldin
2015-04-16 11:48         ` [dpdk-dev] [PATCH v5 2/5] vhost: eventfd_link: add function fget_from_files Pavel Boldin
2015-04-16 11:48         ` [dpdk-dev] [PATCH v5 3/5] vhost: eventfd_link: fix ioctl return values Pavel Boldin
2015-04-16 11:48         ` [dpdk-dev] [PATCH v5 4/5] vhost: eventfd_link: replace copy-pasted sys_close Pavel Boldin
2015-05-07  6:54           ` Xie, Huawei
2015-06-17 15:24             ` Thomas Monjalon
2015-07-09  0:59               ` Thomas Monjalon
2015-07-10 14:27               ` Xie, Huawei
2015-07-10 14:50                 ` Pavel Boldin
2015-07-10 15:32                   ` Xie, Huawei
2015-07-10 15:42                   ` Xie, Huawei
2015-07-10 15:49                     ` Thomas Monjalon
2015-07-10 16:06                       ` Xie, Huawei
2015-07-11 15:08                     ` Pavel Boldin
2015-07-13  1:59                       ` Xie, Huawei
2015-07-19 12:39                         ` Pavel Boldin
2015-04-16 11:48         ` [dpdk-dev] [PATCH v5 5/5] vhost: eventfd_link: removing extra #includes Pavel Boldin
2015-04-28 14:35         ` [dpdk-dev] [PATCH v5 0/5] Refactor module `eventfd_link' Thomas Monjalon
2015-05-04  5:29           ` Xie, Huawei

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150316175556.GF16238@hmsreliant.think-freely.org \
    --to=nhorman@tuxdriver.com \
    --cc=dev@dpdk.org \
    --cc=pboldin@mirantis.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).