Re: NULL pointer dereference when access /proc/net

[Al Viro]

On Tue, Apr 27, 2021 at 01:16:44AM +0800, haosdent wrote:
> > really should not assume ->d_inode stable
> 
> Hi, Alexander, sorry to disturb you again. Today I try to check what
> `dentry->d_inode` and `nd->link_inode` looks like when `dentry` is
> already been killed in `__dentry_kill`.
> 
> ```
> nd->last.name: net/sockstat, dentry->d_lockref.count: -128,
> dentry->d_inode: (nil), nd->link_inode: 0xffffffffab299966
> nd->last.name: net/sockstat, dentry->d_lockref.count: -128,
> dentry->d_inode: (nil), nd->link_inode: 0xffffffffab299966
> nd->last.name: net/sockstat, dentry->d_lockref.count: -128,
> dentry->d_inode: (nil), nd->link_inode: 0xffffffffab299966
> ```
> 
> It looks like `dentry->d_inode` could be NULL while `nd->link_inode`
> is always has value.
> But this make me confuse, by right `nd->link_inode` is get from
> `dentry->d_inode`, right?

It's sampled from there, yes.  And in RCU mode there's nothing to
prevent a previously positive dentry from getting negative and/or
killed.  ->link_inode (used to - it's gone these days) go with
->seq, which had been sampled from dentry->d_seq before fetching
->d_inode and then verified to have ->d_seq remain unchanged.
That gives you "dentry used to have this inode at the time it
had this d_seq", and that's what gets used to validate the sucker
when we switch to non-RCU mode (look at legitimize_links()).

IOW, we know that
	* at some point during the pathwalk that sucker had this inode
	* the inode won't get freed until we drop out of RCU mode
	* if we need to go to non-RCU (and thus grab dentry references)
while we still need that inode, we will verify that nothing has happened
to that link (same ->d_seq, so it still refers to the same inode) and
grab dentry reference, making sure it won't go away or become negative
under us.  Or we'll fail (in case something _has_ happened to dentry)
and repeat the entire thing in non-RCU mode.