In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb: client: fix busy dentry warning on unmount after DIO<\/p>\n
Commit c68337442f03 (“cifs: Fix busy dentry used after unmounting”) fixed
\nthe issue in cifs where deferred close of a file led to a dentry reference
\ncount not being released in umount, by flushing deferredclose_wq in
\ncifs_kill_sb() to solve it.<\/p>\n
However, the cifs DIO path suffers from the same busy-dentry problem caused
\nby a delayed dentry reference-count release:<\/p>\n
\t[dio]\t\t\t[cifsd]\t\t\t[close + umount]
\nnetfs_unbuffered_write_iter_locked
\n…
\n\t\t\t\tcifs_demultiplex_thread
\n netfs_unbuffered_write
\n cifs_issue_write
\n netfs_wait_for_in_progress_stream [1]
\n\t\t\t\t…
\n\t\t\t\t netfs_write_subrequest_terminated
\n\t\t\t\t netfs_subreq_clear_in_progress
\n\t\t\t\t netfs_wake_collector \/\/ wake [1]
\n\t\t\t\t netfs_put_subrequest
\n netfs_put_request
\n queue_work(system_dfl_wq, xxx) [2]
\n \/\/ dio write return\t\t\t\t\tcifs_close
\n\t\t\t\t\t\t\t _cifsFileInfo_put
\n\t\t\t\t\t\t\t \/\/ cfile->count 2->1
\n\t\t\t\t\t\t\t –cfile->count [3]<\/p>\n
\t\t\t\t\t\t\t\/\/ umount
\n\t\t\t\t\t\t\tcifs_kill_sb
\n\t\t\t\t\t\t\t kill_anon_super
\n\t\t\t\t\t\t\t \/\/ warning triggered!
\n\t\t\t\t\t\t\t shrink_dcache_for_umount [4]
\n[system_dfl_wq] [5]
\nnetfs_free_request
\n …
\n _cifsFileInfo_put
\n \/\/ cfile->count 1->0
\n –cfile->count
\n queue_work(fileinfo_put_wq, xxx)<\/p>\n
[fileinfo_put_wq] [6]
\ncifsFileInfo_put_work
\n cifsFileInfo_put_final
\n dput<\/p>\n
If the umount path is triggered before [5], it results warning:
\nBUG: Dentry 00000000eab1f070{i=9a917b66ae404fec,n=test} still in use (1)
\n[unmount of cifs cifs]<\/p>\n
The existing per-inode ictx->io_count wait in cifs_evict_inode() does not
\nhelp: it lives in the inode eviction path, which runs after
\nshrink_dcache_for_umount() has already warned about the busy dentries.<\/p>\n
Fix it by adding a per-superblock outstanding-rreq counter that is
\nincremented in cifs_init_request() and decremented in cifs_free_request().
\nIn cifs_kill_sb(), before kill_anon_super(), wait for this counter to reach
\n0 – which guarantees that all cleanup_work for this sb have run and thus
\nall relevant cfile puts are queued on fileinfo_put_wq or serverclose_wq.
\nThen drain the workqueue so the dentry refs are dropped.<\/p>\n
This is a targeted wait, not a flush of the system-wide system_dfl_wq.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb: client: fix busy dentry warning on unmount after DIO<\/p>\n
Commit c68337442f03 (“cifs: Fix busy dentry used after unmounting”) fixe<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6939","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}