1
0
Fork 0
alistair23-linux/fs/ext4
Qian Cai 6772387e82 ext4: fix a data race at inode->i_blocks
commit 28936b62e7 upstream.

inode->i_blocks could be accessed concurrently as noticed by KCSAN,

 BUG: KCSAN: data-race in ext4_do_update_inode [ext4] / inode_add_bytes

 write to 0xffff9a00d4b982d0 of 8 bytes by task 22100 on cpu 118:
  inode_add_bytes+0x65/0xf0
  __inode_add_bytes at fs/stat.c:689
  (inlined by) inode_add_bytes at fs/stat.c:702
  ext4_mb_new_blocks+0x418/0xca0 [ext4]
  ext4_ext_map_blocks+0x1a6b/0x27b0 [ext4]
  ext4_map_blocks+0x1a9/0x950 [ext4]
  _ext4_get_block+0xfc/0x270 [ext4]
  ext4_get_block_unwritten+0x33/0x50 [ext4]
  __block_write_begin_int+0x22e/0xae0
  __block_write_begin+0x39/0x50
  ext4_write_begin+0x388/0xb50 [ext4]
  ext4_da_write_begin+0x35f/0x8f0 [ext4]
  generic_perform_write+0x15d/0x290
  ext4_buffered_write_iter+0x11f/0x210 [ext4]
  ext4_file_write_iter+0xce/0x9e0 [ext4]
  new_sync_write+0x29c/0x3b0
  __vfs_write+0x92/0xa0
  vfs_write+0x103/0x260
  ksys_write+0x9d/0x130
  __x64_sys_write+0x4c/0x60
  do_syscall_64+0x91/0xb05
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

 read to 0xffff9a00d4b982d0 of 8 bytes by task 8 on cpu 65:
  ext4_do_update_inode+0x4a0/0xf60 [ext4]
  ext4_inode_blocks_set at fs/ext4/inode.c:4815
  ext4_mark_iloc_dirty+0xaf/0x160 [ext4]
  ext4_mark_inode_dirty+0x129/0x3e0 [ext4]
  ext4_convert_unwritten_extents+0x253/0x2d0 [ext4]
  ext4_convert_unwritten_io_end_vec+0xc5/0x150 [ext4]
  ext4_end_io_rsv_work+0x22c/0x350 [ext4]
  process_one_work+0x54f/0xb90
  worker_thread+0x80/0x5f0
  kthread+0x1cd/0x1f0
  ret_from_fork+0x27/0x50

 4 locks held by kworker/u256:0/8:
  #0: ffff9a025abc4328 ((wq_completion)ext4-rsv-conversion){+.+.}, at: process_one_work+0x443/0xb90
  #1: ffffab5a862dbe20 ((work_completion)(&ei->i_rsv_conversion_work)){+.+.}, at: process_one_work+0x443/0xb90
  #2: ffff9a025a9d0f58 (jbd2_handle){++++}, at: start_this_handle+0x1c1/0x9d0 [jbd2]
  #3: ffff9a00d4b985d8 (&(&ei->i_raw_lock)->rlock){+.+.}, at: ext4_do_update_inode+0xaa/0xf60 [ext4]
 irq event stamp: 3009267
 hardirqs last  enabled at (3009267): [<ffffffff980da9b7>] __find_get_block+0x107/0x790
 hardirqs last disabled at (3009266): [<ffffffff980da8f9>] __find_get_block+0x49/0x790
 softirqs last  enabled at (3009230): [<ffffffff98a0034c>] __do_softirq+0x34c/0x57c
 softirqs last disabled at (3009223): [<ffffffff97cc67a2>] irq_exit+0xa2/0xc0

 Reported by Kernel Concurrency Sanitizer on:
 CPU: 65 PID: 8 Comm: kworker/u256:0 Tainted: G L 5.6.0-rc2-next-20200221+ #7
 Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 07/10/2019
 Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work [ext4]

The plain read is outside of inode->i_lock critical section which
results in a data race. Fix it by adding READ_ONCE() there.

Link: https://lore.kernel.org/r/20200222043258.2279-1-cai@lca.pw
Signed-off-by: Qian Cai <cai@lca.pw>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:50:21 +02:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile ext4: add basic fs-verity support 2019-08-12 19:33:50 -07:00
acl.c ext4: compare old and new mode before setting update_mode flag 2018-12-10 00:22:38 -05:00
acl.h ext4: fix up remaining files with SPDX cleanups 2017-12-17 22:00:59 -05:00
balloc.c ext4: fix potential race between online resizing and write operations 2020-02-28 17:22:22 +01:00
bitmap.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
block_validity.c ext4: add cond_resched() to ext4_protect_reserved_inode 2020-02-19 19:52:59 +01:00
dir.c ext4: fix checksum errors with indexed dirs 2020-02-19 19:52:59 +01:00
ext4.h ext4: fix race between writepages and enabling EXT4_EXTENTS_FL 2020-02-28 17:22:23 +01:00
ext4_extents.h ext4: adjust reserved cluster count when removing extents 2018-10-01 14:25:08 -04:00
ext4_jbd2.c ext4: shutdown should not prevent get_write_access 2018-02-18 22:07:36 -05:00
ext4_jbd2.h ext4: use jbd2_inode dirty range scoping 2019-06-20 17:26:26 -04:00
extents.c ext4: fix warning inside ext4_convert_unwritten_extents_endio 2019-08-22 22:53:46 -04:00
extents_status.c ext4: use percpu_counters for extent_status cache hits/misses 2019-08-28 11:19:23 -04:00
extents_status.h ext4: use percpu_counters for extent_status cache hits/misses 2019-08-28 11:19:23 -04:00
file.c ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT 2020-02-24 08:36:24 +01:00
fsmap.c ext4: fix miscellaneous sparse warnings 2019-05-12 04:49:47 -04:00
fsmap.h ext4: fix up remaining files with SPDX cleanups 2017-12-17 22:00:59 -05:00
fsync.c Revert "ext4: use ext4_write_inode() when fsyncing w/o a journal" 2019-01-31 23:41:11 -05:00
hash.c ext4: fix kernel oops caused by spurious casefold flag 2019-09-03 01:43:17 -04:00
ialloc.c ext4: fix potential race between s_flex_groups online resizing and access 2020-02-28 17:22:22 +01:00
indirect.c ext4: clean up kerneldoc warnigns when building with W=1 2019-06-19 16:30:03 -04:00
inline.c ext4: set error return correctly when ext4_htree_store_dirent fails 2019-08-12 14:29:38 -04:00
inode.c ext4: fix a data race at inode->i_blocks 2020-04-17 10:50:21 +02:00
ioctl.c Added new ext4 debugging ioctls to allow userspace to get information 2019-09-21 13:37:39 -07:00
mballoc.c ext4: fix potential race between s_flex_groups online resizing and access 2020-02-28 17:22:22 +01:00
mballoc.h ext4: fix up remaining files with SPDX cleanups 2017-12-17 22:00:59 -05:00
migrate.c ext4: fix race between writepages and enabling EXT4_EXTENTS_FL 2020-02-28 17:22:23 +01:00
mmp.c ext4: don't assume that mmp_nodename/bdevname have NUL 2020-02-19 19:52:58 +01:00
move_extent.c ext4: use jbd2_inode dirty range scoping 2019-06-20 17:26:26 -04:00
namei.c ext4: add cond_resched() to __ext4_find_entry() 2020-02-28 17:22:22 +01:00
page-io.c ext4: fix deadlock allocating crypto bounce page from mempool 2020-02-11 04:35:32 -08:00
readpage.c ext4: fix deadlock allocating bio_post_read_ctx from mempool 2020-02-24 08:36:29 +01:00
resize.c ext4: fix potential race between s_flex_groups online resizing and access 2020-02-28 17:22:22 +01:00
super.c ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() 2020-03-05 16:43:41 +01:00
symlink.c ext4: switch to fscrypt_get_symlink() 2018-01-11 22:10:40 -05:00
sysfs.c ext4: add basic fs-verity support 2019-08-12 19:33:50 -07:00
truncate.h ext4: handle layout changes to pinned DAX mappings 2018-07-29 17:00:22 -04:00
verity.c ext4: add basic fs-verity support 2019-08-12 19:33:50 -07:00
xattr.c ext4: ignore e_value_offs for xattrs with value-in-ea-inode 2019-04-10 00:37:36 -04:00
xattr.h ext4: add extra checks to ext4_xattr_block_get() 2018-03-30 20:04:11 -04:00
xattr_security.c ext4: use XATTR_CREATE in ext4_initxattrs() 2018-05-10 11:52:14 -04:00
xattr_trusted.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xattr_user.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00