From 00e0afb658bf180a521ee693df204d9bccc6e58a Mon Sep 17 00:00:00 2001 From: Jules Irenge Date: Mon, 13 Apr 2020 22:42:40 +0100 Subject: [PATCH 1/9] fsnotify: Add missing annotation for fsnotify_finish_user_wait() and for fsnotify_prepare_user_wait() Sparse reports warnings at fsnotify_prepare_user_wait() and at fsnotify_finish_user_wait() warning: context imbalance in fsnotify_finish_user_wait() - wrong count at exit warning: context imbalance in fsnotify_prepare_user_wait() - unexpected unlock The root cause is the missing annotation at fsnotify_finish_user_wait() and at fsnotify_prepare_user_wait() fsnotify_prepare_user_wait() has an extra annotation __release() that only tell Sparse and not GCC to shutdown the warning Add the missing __acquires(&fsnotify_mark_srcu) annotation Add the missing __releases(&fsnotify_mark_srcu) annotation Add the __release(&fsnotify_mark_srcu) annotation. Link: https://lore.kernel.org/r/20200413214240.15245-1-jbi.octave@gmail.com Signed-off-by: Jules Irenge Signed-off-by: Jan Kara --- fs/notify/mark.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/notify/mark.c b/fs/notify/mark.c index 1d96216dffd1..8387937b9d01 100644 --- a/fs/notify/mark.c +++ b/fs/notify/mark.c @@ -325,13 +325,16 @@ static void fsnotify_put_mark_wake(struct fsnotify_mark *mark) } bool fsnotify_prepare_user_wait(struct fsnotify_iter_info *iter_info) + __releases(&fsnotify_mark_srcu) { int type; fsnotify_foreach_obj_type(type) { /* This can fail if mark is being removed */ - if (!fsnotify_get_mark_safe(iter_info->marks[type])) + if (!fsnotify_get_mark_safe(iter_info->marks[type])) { + __release(&fsnotify_mark_srcu); goto fail; + } } /* @@ -350,6 +353,7 @@ bool fsnotify_prepare_user_wait(struct fsnotify_iter_info *iter_info) } void fsnotify_finish_user_wait(struct fsnotify_iter_info *iter_info) + __acquires(&fsnotify_mark_srcu) { int type; From 7b26aa243d3c4d9a564e87c17dc4317a67727335 Mon Sep 17 00:00:00 2001 From: youngjun Date: Sun, 26 Apr 2020 07:33:16 -0700 Subject: [PATCH 2/9] inotify: Fix error return code assignment flow. If error code is initialized -EINVAL, there is no need to assign -EINVAL. Link: https://lore.kernel.org/r/20200426143316.29877-1-her0gyugyu@gmail.com Signed-off-by: youngjun Signed-off-by: Jan Kara --- fs/notify/inotify/inotify_user.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c index 81ffc8629fc4..f88bbcc9efeb 100644 --- a/fs/notify/inotify/inotify_user.c +++ b/fs/notify/inotify/inotify_user.c @@ -764,20 +764,18 @@ SYSCALL_DEFINE2(inotify_rm_watch, int, fd, __s32, wd) struct fsnotify_group *group; struct inotify_inode_mark *i_mark; struct fd f; - int ret = 0; + int ret = -EINVAL; f = fdget(fd); if (unlikely(!f.file)) return -EBADF; /* verify that this is indeed an inotify instance */ - ret = -EINVAL; if (unlikely(f.file->f_op != &inotify_fops)) goto out; group = f.file->private_data; - ret = -EINVAL; i_mark = inotify_idr_find(group, wd); if (unlikely(!i_mark)) goto out; From 374ad001f762e4e4c736c5e2455e9949555459ab Mon Sep 17 00:00:00 2001 From: "Gustavo A. R. Silva" Date: Thu, 7 May 2020 13:52:30 -0500 Subject: [PATCH 3/9] fanotify: Replace zero-length array with flexible-array The current codebase makes use of the zero-length array language extension to the C90 standard, but the preferred mechanism to declare variable-length types such as these ones is a flexible array member[1][2], introduced in C99: struct foo { int stuff; struct boo array[]; }; By making use of the mechanism above, we will get a compiler warning in case the flexible array does not occur last in the structure, which will help us prevent some kind of undefined behavior bugs from being inadvertently introduced[3] to the codebase from now on. Also, notice that, dynamic memory allocations won't be affected by this change: "Flexible array members have incomplete type, and so the sizeof operator may not be applied. As a quirk of the original implementation of zero-length arrays, sizeof evaluates to zero."[1] sizeof(flexible-array-member) triggers a warning because flexible array members have incomplete type[1]. There are some instances of code in which the sizeof operator is being incorrectly/erroneously applied to zero-length arrays and the result is zero. Such instances may be hiding some bugs. So, this work (flexible-array member conversions) will also help to get completely rid of those sorts of issues. This issue was found with the help of Coccinelle. [1] https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html [2] https://github.com/KSPP/linux/issues/21 [3] commit 76497732932f ("cxgb3/l2t: Fix undefined behaviour") Link: https://lore.kernel.org/r/20200507185230.GA14229@embeddedor Signed-off-by: Gustavo A. R. Silva Signed-off-by: Jan Kara --- fs/notify/fanotify/fanotify.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/notify/fanotify/fanotify.h b/fs/notify/fanotify/fanotify.h index 35bfbf4a7aac..8ce7ccfc4b0d 100644 --- a/fs/notify/fanotify/fanotify.h +++ b/fs/notify/fanotify/fanotify.h @@ -89,7 +89,7 @@ struct fanotify_name_event { __kernel_fsid_t fsid; struct fanotify_fh dir_fh; u8 name_len; - char name[0]; + char name[]; }; static inline struct fanotify_name_event * From ab3c4da0ad12fb8b4c80ab2d98ce214a58e00c04 Mon Sep 17 00:00:00 2001 From: Fabian Frederick Date: Tue, 12 May 2020 20:17:15 +0200 Subject: [PATCH 4/9] fanotify: prefix should_merge() Prefix function with fanotify_ like others. Link: https://lore.kernel.org/r/20200512181715.405728-1-fabf@skynet.be Signed-off-by: Fabian Frederick Reviewed-by: Amir Goldstein Signed-off-by: Jan Kara --- fs/notify/fanotify/fanotify.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c index 5435a40f82be..95480d3dcff7 100644 --- a/fs/notify/fanotify/fanotify.c +++ b/fs/notify/fanotify/fanotify.c @@ -70,7 +70,7 @@ static bool fanotify_name_event_equal(struct fanotify_name_event *fne1, return !memcmp(fne1->name, fne2->name, fne1->name_len); } -static bool should_merge(struct fsnotify_event *old_fsn, +static bool fanotify_should_merge(struct fsnotify_event *old_fsn, struct fsnotify_event *new_fsn) { struct fanotify_event *old, *new; @@ -129,7 +129,7 @@ static int fanotify_merge(struct list_head *list, struct fsnotify_event *event) return 0; list_for_each_entry_reverse(test_event, list, list) { - if (should_merge(test_event, event)) { + if (fanotify_should_merge(test_event, event)) { FANOTIFY_E(test_event)->mask |= new->mask; return 1; } From 191e1656d18c47d8815f6618431a387d99944884 Mon Sep 17 00:00:00 2001 From: Fabian Frederick Date: Tue, 12 May 2020 20:18:03 +0200 Subject: [PATCH 5/9] fsnotify: add mutex destroy Call mutex_destroy() before freeing notification group. This only adds some additional debug checks when mutex debugging is enabled but still it may be useful. Link: https://lore.kernel.org/r/20200512181803.405832-1-fabf@skynet.be Signed-off-by: Fabian Frederick Reviewed-by: Amir Goldstein Signed-off-by: Jan Kara --- fs/notify/group.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/notify/group.c b/fs/notify/group.c index 133f723aca07..a4a4b1c64d32 100644 --- a/fs/notify/group.c +++ b/fs/notify/group.c @@ -25,6 +25,7 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group) group->ops->free_group_priv(group); mem_cgroup_put(group->memcg); + mutex_destroy(&group->mark_mutex); kfree(group); } From c5e443cb7b6ce6c6a5f49640359f6e834d6a6ed4 Mon Sep 17 00:00:00 2001 From: Fabian Frederick Date: Tue, 12 May 2020 20:18:36 +0200 Subject: [PATCH 6/9] fanotify: remove reference to fill_event_metadata() fill_event_metadata() was removed in commit bb2f7b4542c7 ("fanotify: open code fill_event_metadata()") Link: https://lore.kernel.org/r/20200512181836.405879-1-fabf@skynet.be Signed-off-by: Fabian Frederick Reviewed-by: Amir Goldstein Signed-off-by: Jan Kara --- fs/notify/fanotify/fanotify_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c index 42cb794c62ac..02a314acc757 100644 --- a/fs/notify/fanotify/fanotify_user.c +++ b/fs/notify/fanotify/fanotify_user.c @@ -328,7 +328,7 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group, ret = -EFAULT; /* * Sanity check copy size in case get_one_event() and - * fill_event_metadata() event_len sizes ever get out of sync. + * event_len sizes ever get out of sync. */ if (WARN_ON_ONCE(metadata.event_len > count)) goto out_close_fd; From 5a449099b9d5b0a1ac23c1cdbda4bfbaf4b27076 Mon Sep 17 00:00:00 2001 From: Fabian Frederick Date: Tue, 12 May 2020 20:19:06 +0200 Subject: [PATCH 7/9] fsnotify: Remove proc_fs.h include proc_fs.h was already included in fdinfo.h Link: https://lore.kernel.org/r/20200512181906.405927-1-fabf@skynet.be Signed-off-by: Fabian Frederick Reviewed-by: Amir Goldstein Signed-off-by: Jan Kara --- fs/notify/fdinfo.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/notify/fdinfo.c b/fs/notify/fdinfo.c index ef83f4020554..f0d6b54be412 100644 --- a/fs/notify/fdinfo.c +++ b/fs/notify/fdinfo.c @@ -11,7 +11,6 @@ #include #include #include -#include #include #include "inotify/inotify.h" From 5e23663b49e1e8ee6b805356259e3062edac5e2b Mon Sep 17 00:00:00 2001 From: Fabian Frederick Date: Tue, 12 May 2020 20:19:21 +0200 Subject: [PATCH 8/9] fanotify: don't write with size under sizeof(response) fanotify_write() only aligned copy_from_user size to sizeof(response) for higher values. This patch avoids all values below as suggested by Amir Goldstein and set to response size unconditionally. Link: https://lore.kernel.org/r/20200512181921.405973-1-fabf@skynet.be Signed-off-by: Fabian Frederick Reviewed-by: Amir Goldstein Signed-off-by: Jan Kara --- fs/notify/fanotify/fanotify_user.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c index 02a314acc757..63b5dffdca9e 100644 --- a/fs/notify/fanotify/fanotify_user.c +++ b/fs/notify/fanotify/fanotify_user.c @@ -487,8 +487,10 @@ static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t group = file->private_data; - if (count > sizeof(response)) - count = sizeof(response); + if (count < sizeof(response)) + return -EINVAL; + + count = sizeof(response); pr_debug("%s: group=%p count=%zu\n", __func__, group, count); From 2f02fd3fa13e51713b630164f8a8e5b42de8283b Mon Sep 17 00:00:00 2001 From: Amir Goldstein Date: Sun, 24 May 2020 10:24:41 +0300 Subject: [PATCH 9/9] fanotify: fix ignore mask logic for events on child and on dir The comments in fanotify_group_event_mask() say: "If the event is on dir/child and this mark doesn't care about events on dir/child, don't send it!" Specifically, mount and filesystem marks do not care about events on child, but they can still specify an ignore mask for those events. For example, a group that has: - A mount mark with mask 0 and ignore_mask FAN_OPEN - An inode mark on a directory with mask FAN_OPEN | FAN_OPEN_EXEC with flag FAN_EVENT_ON_CHILD A child file open for exec would be reported to group with the FAN_OPEN event despite the fact that FAN_OPEN is in ignore mask of mount mark, because the mark iteration loop skips over non-inode marks for events on child when calculating the ignore mask. Move ignore mask calculation to the top of the iteration loop block before excluding marks for events on dir/child. Link: https://lore.kernel.org/r/20200524072441.18258-1-amir73il@gmail.com Reported-by: Jan Kara Link: https://lore.kernel.org/linux-fsdevel/20200521162443.GA26052@quack2.suse.cz/ Fixes: 55bf882c7f13 "fanotify: fix merging marks masks with FAN_ONDIR" Fixes: b469e7e47c8a "fanotify: fix handling of events on child..." Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara --- fs/notify/fanotify/fanotify.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c index 95480d3dcff7..e22fd8f8c281 100644 --- a/fs/notify/fanotify/fanotify.c +++ b/fs/notify/fanotify/fanotify.c @@ -232,6 +232,10 @@ static u32 fanotify_group_event_mask(struct fsnotify_group *group, if (!fsnotify_iter_should_report_type(iter_info, type)) continue; mark = iter_info->marks[type]; + + /* Apply ignore mask regardless of ISDIR and ON_CHILD flags */ + marks_ignored_mask |= mark->ignored_mask; + /* * If the event is on dir and this mark doesn't care about * events on dir, don't send it! @@ -249,7 +253,6 @@ static u32 fanotify_group_event_mask(struct fsnotify_group *group, continue; marks_mask |= mark->mask; - marks_ignored_mask |= mark->ignored_mask; } test_mask = event_mask & marks_mask & ~marks_ignored_mask;