Re: [PATCH] ovl: check before dereferencing s_root field

[Jan Kara]

On Wed 17-09-25 21:42:00, Al Viro wrote:
> On Wed, Sep 17, 2025 at 01:07:45PM +0200, Amir Goldstein wrote:
> 
> > diff --git a/fs/dcache.c b/fs/dcache.c
> > index 60046ae23d514..8c9d0d6bb0045 100644
> > --- a/fs/dcache.c
> > +++ b/fs/dcache.c
> > @@ -1999,10 +1999,12 @@ struct dentry *d_make_root(struct inode *root_inode)
> > 
> >         if (root_inode) {
> >                 res = d_alloc_anon(root_inode->i_sb);
> > -               if (res)
> > +               if (res) {
> > +                       root_inode->i_opflags |= IOP_ROOT;
> >                         d_instantiate(res, root_inode);
> 
> Umm...  Not a good idea - if nothing else, root may end up
> being attached someplace (normal with nfs, for example).
> 
> But more fundamentally, once we are into ->kill_sb(), let alone
> generic_shutdown_super(), nobody should be playing silly buggers
> with the filesystem.  Sure, RCU accesses are possible, but messing
> around with fhandles?  ->s_root is not the only thing that might
> be no longer there.
> 
> What the fuck is fsnotify playing at?

The problem is fsnotify marks aren't shutdown until generic_shutdown_super()
calls fsnotify_sb_delete(). So until that moment fsnotify can be generating
events for the filesystem. Sure, userspace has no longer access to the fs
but stuff like delayed inode deletion or other in-kernel users can still
result in events being generated and these events may end up creating file
handles to report to userspace.

We have already uncovered with Amir quite a few moments how this is broken
so I agree that the best solution is to shutdown fsnotify before we call
shrink_dcache_for_umount(). The slight problem is this means iterating all
inodes in the sb which is costly when you have millions of them (this is
the reason why fsnotify_sb_delete() is currently called after
evict_inodes()). So it needs more work on fsnotify side...

								Honza
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR