linux-toradex.git/fs/ecryptfs/super.c, branch v2.6.35.1

fix a couple of ecryptfs leaks

2010-05-21T22:31:13+00:00

First of all, get_sb_nodev() grabs anon dev minor and we
never free it in ecryptfs ->kill_sb().  Moreover, on one
of the failure exits in ecryptfs_get_sb() we leak things -
it happens before we set ->s_root and ->put_super() won't
be called in that case.  Solution: kill ->put_super(), do
all that stuff in ->kill_sb().  And use kill_anon_sb() instead
of generic_shutdown_super() to deal with anon dev leak.

Signed-off-by: Al Viro

ecryptfs: add bdi backing to mount session

2010-04-22T10:22:04+00:00

This ensures that dirty data gets flushed properly.

Signed-off-by: Jens Axboe

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6

2010-04-19T21:20:32+00:00

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
  eCryptfs: Turn lower lookup error messages into debug messages
  eCryptfs: Copy lower directory inode times and size on link
  ecryptfs: fix use with tmpfs by removing d_drop from ecryptfs_destroy_inode
  ecryptfs: fix error code for missing xattrs in lower fs
  eCryptfs: Decrypt symlink target for stat size
  eCryptfs: Strip metadata in xattr flag in encrypted view
  eCryptfs: Clear buffer before reading in metadata xattr
  eCryptfs: Rename ecryptfs_crypt_stat.num_header_bytes_at_front
  eCryptfs: Fix metadata in xattr feature regression

ecryptfs: fix use with tmpfs by removing d_drop from ecryptfs_destroy_inode

2010-04-19T19:42:13+00:00

Since tmpfs has no persistent storage, it pins all its dentries in memory
so they have d_count=1 when other file systems would have d_count=0.
->lookup is only used to create new dentries. If the caller doesn't
instantiate it, it's freed immediately at dput(). ->readdir reads
directly from the dcache and depends on the dentries being hashed.

When an ecryptfs mount is mounted, it associates the lower file and dentry
with the ecryptfs files as they're accessed. When it's umounted and
destroys all the in-memory ecryptfs inodes, it fput's the lower_files and
d_drop's the lower_dentries. Commit 4981e081 added this and a d_delete in
2008 and several months later commit caeeeecf removed the d_delete. I
believe the d_drop() needs to be removed as well.

The d_drop effectively hides any file that has been accessed via ecryptfs
from the underlying tmpfs since it depends on it being hashed for it to
be accessible. I've removed the d_drop on my development node and see no
ill effects with basic testing on both tmpfs and persistent storage.

As a side effect, after ecryptfs d_drops the dentries on tmpfs, tmpfs
BUGs on umount. This is due to the dentries being unhashed.
tmpfs->kill_sb is kill_litter_super which calls d_genocide to drop
the reference pinning the dentry. It skips unhashed and negative dentries,
but shrink_dcache_for_umount_subtree doesn't. Since those dentries
still have an elevated d_count, we get a BUG().

This patch removes the d_drop call and fixes both issues.

This issue was reported at:
https://bugzilla.novell.com/show_bug.cgi?id=567887

Reported-by:  Árpád Bíró 
Signed-off-by: Jeff Mahoney 
Cc: Dustin Kirkland 
Cc: stable@kernel.org
Signed-off-by: Tyler Hicks

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30T13:02:32+00:00

percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files.  percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.

percpu.h -> slab.h dependency is about to be removed.  Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability.  As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.

  http://userweb.kernel.org/~tj/misc/slabh-sweep.py

The script does the followings.

* Scan files for gfp and slab usages and update includes such that
  only the necessary includes are there.  ie. if only gfp is used,
  gfp.h, if slab is used, slab.h.

* When the script inserts a new include, it looks at the include
  blocks and try to put the new include such that its order conforms
  to its surrounding.  It's put in the include block which contains
  core kernel includes, in the same order that the rest are ordered -
  alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
  doesn't seem to be any matching order.

* If the script can't find a place to put a new include (mostly
  because the file doesn't have fitting include block), it prints out
  an error message indicating which .h file needs to be added to the
  file.

The conversion was done in the following steps.

1. The initial automatic conversion of all .c files updated slightly
   over 4000 files, deleting around 700 includes and adding ~480 gfp.h
   and ~3000 slab.h inclusions.  The script emitted errors for ~400
   files.

2. Each error was manually checked.  Some didn't need the inclusion,
   some needed manual addition while adding it to implementation .h or
   embedding .c file was more appropriate for others.  This step added
   inclusions to around 150 files.

3. The script was run again and the output was compared to the edits
   from #2 to make sure no file was left behind.

4. Several build tests were done and a couple of problems were fixed.
   e.g. lib/decompress_*.c used malloc/free() wrappers around slab
   APIs requiring slab.h to be added manually.

5. The script was run on all .h files but without automatically
   editing them as sprinkling gfp.h and slab.h inclusions around .h
   files could easily lead to inclusion dependency hell.  Most gfp.h
   inclusion directives were ignored as stuff from gfp.h was usually
   wildly available and often used in preprocessor macros.  Each
   slab.h inclusion directive was examined and added manually as
   necessary.

6. percpu.h was updated not to include slab.h.

7. Build test were done on the following configurations and failures
   were fixed.  CONFIG_GCOV_KERNEL was turned off for all tests (as my
   distributed build env didn't work with gcov compiles) and a few
   more options had to be turned off depending on archs to make things
   build (like ipr on powerpc/64 which failed due to missing writeq).

   * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
   * powerpc and powerpc64 SMP allmodconfig
   * sparc and sparc64 SMP allmodconfig
   * ia64 SMP allmodconfig
   * s390 SMP allmodconfig
   * alpha SMP allmodconfig
   * um on x86_64 SMP allmodconfig

8. percpu.h modifications were reverted so that it could be applied as
   a separate patch and serve as bisection point.

Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.

Signed-off-by: Tejun Heo 
Guess-its-ok-by: Christoph Lameter 
Cc: Ingo Molnar 
Cc: Lee Schermerhorn

ecryptfs: Remove unneeded locking that triggers lockdep false positives

2009-09-23T14:10:30+00:00

In ecryptfs_destroy_inode(), inode_info->lower_file_mutex is locked,
and just after the mutex is unlocked, the code does:

 	kmem_cache_free(ecryptfs_inode_info_cache, inode_info);

This means that if another context could possibly try to take the same
mutex as ecryptfs_destroy_inode(), then it could end up getting the
mutex just before the data structure containing the mutex is freed.
So any such use would be an obvious use-after-free bug (catchable with
slab poisoning or mutex debugging), and therefore the locking in
ecryptfs_destroy_inode() is not needed and can be dropped.

Similarly, in ecryptfs_destroy_crypt_stat(), crypt_stat->keysig_list_mutex
is locked, and then the mutex is unlocked just before the code does:

 	memset(crypt_stat, 0, sizeof(struct ecryptfs_crypt_stat));

Therefore taking this mutex is similarly not necessary.

Removing this locking fixes false-positive lockdep reports such as the
following (and they are false-positives for exactly the same reason
that the locking is not needed):

=================================
[ INFO: inconsistent lock state ]
2.6.31-2-generic #14~rbd3
---------------------------------
inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage.
kswapd0/323 [HC0[0]:SC0[0]:HE1:SE1] takes:
 (&inode_info->lower_file_mutex){+.+.?.}, at: [] ecryptfs_destroy_inode+0x34/0x100
{RECLAIM_FS-ON-W} state was registered at:
  [] mark_held_locks+0x6c/0xa0
  [] lockdep_trace_alloc+0xaf/0xe0
  [] kmem_cache_alloc+0x41/0x1a0
  [] get_empty_filp+0x7a/0x1a0
  [] dentry_open+0x36/0xc0
  [] ecryptfs_privileged_open+0x5c/0x2e0
  [] ecryptfs_init_persistent_file+0xa3/0xe0
  [] ecryptfs_lookup_and_interpose_lower+0x278/0x380
  [] ecryptfs_lookup+0x12a/0x250
  [] real_lookup+0xea/0x160
  [] do_lookup+0xb8/0xf0
  [] __link_path_walk+0x518/0x870
  [] path_walk+0x5c/0xc0
  [] do_path_lookup+0x5b/0xa0
  [] user_path_at+0x57/0xa0
  [] vfs_fstatat+0x3c/0x80
  [] vfs_stat+0x1b/0x20
  [] sys_newstat+0x24/0x50
  [] system_call_fastpath+0x16/0x1b
  [] 0xffffffffffffffff
irq event stamp: 7811
hardirqs last  enabled at (7811): [] call_rcu+0x5f/0x90
hardirqs last disabled at (7810): [] call_rcu+0x33/0x90
softirqs last  enabled at (3764): [] __do_softirq+0x14a/0x220
softirqs last disabled at (3751): [] call_softirq+0x1c/0x30

other info that might help us debug this:
2 locks held by kswapd0/323:
 #0:  (shrinker_rwsem){++++..}, at: [] shrink_slab+0x3d/0x190
 #1:  (&type->s_umount_key#35){.+.+..}, at: [] prune_dcache+0xd1/0x1b0

stack backtrace:
Pid: 323, comm: kswapd0 Tainted: G         C 2.6.31-2-generic #14~rbd3
Call Trace:
 [] print_usage_bug+0x18c/0x1a0
 [] ? check_usage_forwards+0x0/0xc0
 [] mark_lock_irq+0xf2/0x280
 [] mark_lock+0x137/0x1d0
 [] ? fsnotify_clear_marks_by_inode+0x30/0xf0
 [] mark_irqflags+0xc6/0x1a0
 [] __lock_acquire+0x287/0x430
 [] lock_acquire+0xa5/0x150
 [] ? ecryptfs_destroy_inode+0x34/0x100
 [] ? __lock_acquire+0x237/0x430
 [] __mutex_lock_common+0x4d/0x3d0
 [] ? ecryptfs_destroy_inode+0x34/0x100
 [] ? fsnotify_clear_marks_by_inode+0x30/0xf0
 [] ? ecryptfs_destroy_inode+0x34/0x100
 [] ? _raw_spin_unlock+0x5e/0xb0
 [] mutex_lock_nested+0x46/0x60
 [] ecryptfs_destroy_inode+0x34/0x100
 [] destroy_inode+0x87/0xd0
 [] generic_delete_inode+0x12c/0x1a0
 [] iput+0x62/0x70
 [] dentry_iput+0x98/0x110
 [] d_kill+0x50/0x80
 [] prune_one_dentry+0xa3/0xc0
 [] __shrink_dcache_sb+0x271/0x290
 [] prune_dcache+0x109/0x1b0
 [] shrink_dcache_memory+0x3f/0x50
 [] shrink_slab+0x12d/0x190
 [] balance_pgdat+0x4d7/0x640
 [] ? finish_task_switch+0x40/0x150
 [] ? isolate_pages_global+0x0/0x60
 [] kswapd+0x117/0x170
 [] ? autoremove_wake_function+0x0/0x40
 [] ? kswapd+0x0/0x170
 [] kthread+0x9e/0xb0
 [] child_rip+0xa/0x20
 [] ? restore_args+0x0/0x30
 [] ? kthread+0x0/0xb0
 [] ? child_rip+0x0/0x20

Signed-off-by: Roland Dreier 
Signed-off-by: Tyler Hicks

push BKL down into ->put_super

2009-06-12T01:36:07+00:00

Move BKL into ->put_super from the only caller.  A couple of
filesystems had trivial enough ->put_super (only kfree and NULLing of
s_fs_info + stuff in there) to not get any locking: coda, cramfs, efs,
hugetlbfs, omfs, qnx4, shmem, all others got the full treatment.  Most
of them probably don't need it, but I'd rather sort that out individually.
Preferably after all the other BKL pushdowns in that area.

[AV: original used to move lock_super() down as well; these changes are
removed since we don't do lock_super() at all in generic_shutdown_super()
now]
[AV: fuse, btrfs and xfs are known to need no damn BKL, exempt]

Signed-off-by: Christoph Hellwig 
Signed-off-by: Al Viro

eCryptfs: Remove ecryptfs_unlink_sigs warnings

2009-04-22T09:08:46+00:00

A feature was added to the eCryptfs umount helper to automatically
unlink the keys used for an eCryptfs mount from the kernel keyring upon
umount.  This patch keeps the unrecognized mount option warnings for
ecryptfs_unlink_sigs out of the logs.

Signed-off-by: Tyler Hicks

eCryptfs: Print FNEK sig properly in /proc/mounts

2009-04-22T08:54:13+00:00

The filename encryption key signature is not properly displayed in
/proc/mounts.  The "ecryptfs_sig=" mount option name is displayed for
all global authentication tokens, included those for filename keys.

This patch checks the global authentication token flags to determine if
the key is a FEKEK or FNEK and prints the appropriate mount option name
before the signature.

Signed-off-by: Tyler Hicks

ecryptfs: remove debug as mount option, and warn if set via modprobe

2008-02-06T18:41:12+00:00

ecryptfs_debug really should not be a mount option; it is not per-mount,
but rather sets a global "ecryptfs_verbosity" variable which affects all
mounted filesysytems.  It's already settable as a module load option,
I think we can leave it at that.

Also, if set, since secret values come out in debug messages, kick
things off with a stern warning.

Signed-off-by: Eric Sandeen 
Acked-by: Mike Halcrow 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds