diff options
author | Neel Natu <neelnatu@google.com> | 2024-01-28 00:46:36 +0100 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-01-31 00:57:26 +0100 |
commit | 05d8f255867e3196565bb31a911a437697fab094 (patch) | |
tree | 6c3ecce5291ede90cdcfae6384dcf7c9c0d6cc50 /fs/kernfs | |
parent | kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and... (diff) | |
download | linux-05d8f255867e3196565bb31a911a437697fab094.tar.xz linux-05d8f255867e3196565bb31a911a437697fab094.zip |
kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
Prior to this change 'on->nr_mmapped' tracked the total number of
mmaps across all of its associated open files via kernfs_fop_mmap().
Thus if the file descriptor associated with a kernfs_open_file was
mmapped 10 times then we would have: 'of->mmapped = true' and
'of_on(of)->nr_mmapped = 10'.
The problem is that closing or draining a 'of->mmapped' file would
only decrement one from the 'of_on(of)->nr_mmapped' counter.
For e.g. we have this from kernfs_unlink_open_file():
if (of->mmapped)
on->nr_mmapped--;
The WARN_ON_ONCE(on->nr_mmapped) in kernfs_drain_open_files() is
easy to reproduce by:
1. opening a (mmap-able) kernfs file.
2. mmap-ing that file more than once (mapping just once masks the issue).
3. trigger a drain of that kernfs file.
Modulo out-of-tree patches I was able to trigger this reliably by
identifying pci device nodes in sysfs that have resource regions
that are mmap-able and that don't have any driver attached to them
(steps 1 and 2). For step 3 we can "echo 1 > remove" to trigger a
kernfs_drain.
Signed-off-by: Neel Natu <neelnatu@google.com>
Link: https://lore.kernel.org/r/20240127234636.609265-1-neelnatu@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/kernfs')
-rw-r--r-- | fs/kernfs/file.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c index ffa4565c275a..e9df2f87072c 100644 --- a/fs/kernfs/file.c +++ b/fs/kernfs/file.c @@ -483,9 +483,11 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma) goto out_put; rc = 0; - of->mmapped = true; - of_on(of)->nr_mmapped++; - of->vm_ops = vma->vm_ops; + if (!of->mmapped) { + of->mmapped = true; + of_on(of)->nr_mmapped++; + of->vm_ops = vma->vm_ops; + } vma->vm_ops = &kernfs_vm_ops; out_put: kernfs_put_active(of->kn); |