lkml.org 
[lkml]   [2020]   [Feb]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] fs: fix a data race in i_size_write/i_size_read
Date
inode::i_size could be accessed concurently as noticed by KCSAN,

BUG: KCSAN: data-race in iomap_do_writepage / iomap_write_end

write to 0xffff8bf68fc0cac0 of 8 bytes by task 7484 on cpu 71:
iomap_write_end+0xea/0x530
i_size_write at include/linux/fs.h:888
(inlined by) iomap_write_end at fs/iomap/buffered-io.c:782
iomap_write_actor+0x132/0x200
iomap_apply+0x245/0x8a5
iomap_file_buffered_write+0xbd/0xf0
xfs_file_buffered_aio_write+0x1c2/0x790 [xfs]
xfs_file_write_iter+0x232/0x2d0 [xfs]
new_sync_write+0x29c/0x3b0
__vfs_write+0x92/0xa0
vfs_write+0x103/0x260
ksys_write+0x9d/0x130
__x64_sys_write+0x4c/0x60
do_syscall_64+0x91/0xb05
entry_SYSCALL_64_after_hwframe+0x49/0xbe

read to 0xffff8bf68fc0cac0 of 8 bytes by task 5901 on cpu 70:
iomap_do_writepage+0xf4/0x450
i_size_read at include/linux/fs.h:866
(inlined by) iomap_do_writepage at fs/iomap/buffered-io.c:1558
write_cache_pages+0x523/0xb20
iomap_writepages+0x47/0x80
xfs_vm_writepages+0xc7/0x100 [xfs]
do_writepages+0x5e/0x130
__writeback_single_inode+0xd5/0xb20
writeback_sb_inodes+0x429/0x910
__writeback_inodes_wb+0xc4/0x150
wb_writeback+0x47b/0x830
wb_workfn+0x688/0x930
process_one_work+0x54f/0xb90
worker_thread+0x80/0x5f0
kthread+0x1cd/0x1f0
ret_from_fork+0x27/0x50

Reported by Kernel Concurrency Sanitizer on:
CPU: 70 PID: 5901 Comm: kworker/u257:2 Tainted: G L 5.6.0-rc2-next-20200218+ #2
Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 07/10/2019
Workqueue: writeback wb_workfn (flush-254:0)

The write is protected by exclusive inode::i_rwsem (in
xfs_file_buffered_aio_write()) but the read is not. A shattered value
could introduce a logic bug. Fixed it using a pair of WRITE/READ_ONCE().

Signed-off-by: Qian Cai <cai@lca.pw>
---
include/linux/fs.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 3cd4fe6b845e..25f98da90cf3 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -863,7 +863,7 @@ static inline loff_t i_size_read(const struct inode *inode)
preempt_enable();
return i_size;
#else
- return inode->i_size;
+ return READ_ONCE(inode->i_size);
#endif
}

@@ -885,7 +885,7 @@ static inline void i_size_write(struct inode *inode, loff_t i_size)
inode->i_size = i_size;
preempt_enable();
#else
- inode->i_size = i_size;
+ WRITE_ONCE(inode->i_size, i_size);
#endif
}

--
2.21.0 (Apple Git-122.2)
\
 
 \ /
  Last update: 2020-02-19 05:05    [W:0.052 / U:0.120 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site