Re: [PATCH] debugfs: fix potential infinite loop in debugfs_remove_recursive

[Steven Rostedt]

On Thu, 31 Oct 2019 21:34:44 +0800
yu kuai <yukuai3@xxxxxxxxxx> wrote:

> debugfs_remove_recursive uses list_empty to judge weather a dentry has
> any subdentry or not. This can lead to infinite loop when any subdir is in
> use.
> 
> The problem was discoverd by the following steps in the console.
> 1. use debugfs_create_dir to create a dir and multiple subdirs(insmod);
> 2. cd to the subdir with depth not less than 2;
> 3. call debugfs_remove_recursive(rmmod).
> 
> After removing the subdir, the infinite loop is triggered bucause

  s/bucause/because/

> debugfs_remove_recursive uses list_empty to judge if the current dir
> doesn't have any subdentry, if so, remove the current dir and which
> will never happen.
> 
> Fix the problem by using simple_empty instead of list_empty.
> 
> Fixes: 776164c1faac ('debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)')
> Reported-by: chenxiang66@xxxxxxxxxxxxx
> Signed-off-by: yu kuai <yukuai3@xxxxxxxxxx>
> ---
>  fs/debugfs/inode.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
> index 7b975db..42b28acc 100644
> --- a/fs/debugfs/inode.c
> +++ b/fs/debugfs/inode.c
> @@ -773,8 +773,10 @@ void debugfs_remove_recursive(struct dentry *dentry)
>  		if (!simple_positive(child))
>  			continue;
>  
> -		/* perhaps simple_empty(child) makes more sense */
> -		if (!list_empty(&child->d_subdirs)) {
> +		/* use simple_empty to prevent infinite loop when any
> +		 * subdentry of child is in use
> +		 */

Nit, multi-line comments should be of the form:

	/*
	 * comment line 1
	 * comment line 2
	 */

Not

	/* comment line 1
	 * comment line 2
	 */

It's known that the networking folks like that method, but it's not
acceptable anywhere outside of networking.

> +		if (!simple_empty(child)) {

Have you tried this with lockdep enabled? I'm thinking that you might
get a splat with holding parent->d_lock and simple_empty(child) taking
the child->d_lock.

-- Steve


>  			spin_unlock(&parent->d_lock);
>  			inode_unlock(d_inode(parent));
>  			parent = child;