linux-kernel - Re: [RFC] block integrity: Fix write after checksum calculation problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 7 Mar 2011 11:11:29 -0800
From:	"Darrick J. Wong" <djwong@...ibm.com>
To:	Andreas Dilger <adilger@...ger.ca>
Cc:	Chris Mason <chris.mason@...cle.com>, Jan Kara <jack@...e.cz>,
	Joel Becker <jlbec@...lplan.org>,
	"Martin K. Petersen" <martin.petersen@...cle.com>,
	Jens Axboe <axboe@...nel.dk>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	linux-fsdevel <linux-fsdevel@...r.kernel.org>,
	Mingming Cao <mcao@...ibm.com>,
	linux-scsi <linux-scsi@...r.kernel.org>
Subject: Re: [RFC] block integrity: Fix write after checksum calculation
	problem

On Fri, Mar 04, 2011 at 03:22:30PM -0700, Andreas Dilger wrote:
> On 2011-03-04, at 2:07 PM, Darrick J. Wong wrote:
> > Ok, here's what I have so far.  I took everyone's suggestions of where to add
> > calls to wait_on_page_writeback, which seems to handle the multiple-write case
> > adequately.  Unfortunately, it is still possible to generate checksum errors by
> > scribbling furiously on a mmap'd region, even after adding the writeback wait
> > in the ext4 writepage function.  Oddly, I couldn't break btrfs with mmap by
> > removing its wait_for_page_writeback call, so I suspect there's a bit more
> > going on in btrfs than I've been able to figure out.
> 
> Did you add this to ext4_page_mkwrite() or only ext4_writepage()?  It wasn't
> clear from your description above.

I added a wait_on_page_writeback to ext4_page_mkwrite which seems to have cut
down on the error message frequency, but it hasn't gone away entirely.

--D
> 
> > The set_memory_ro debugging trick didn't ferret out any write paths that I
> > didn't catch... though it did have the effect of causing occasional fsync()
> > deadlocks.  I suppose I could sprinkle in a few more of those write calls to
> > see what happens.
> > 
> > Either way, I'm emailing to ask everyone's advice since I've run out of ideas.
> > Or: Did I miss something?
> > 
> > Thanks all for the feedback so far!
> > 
> > --
> > fs: Wait for page writeback when rewrite detected
> > 
> > Signed-off-by: Darrick J. Wong <djwong@...ibm.com>
> > ---
> > 
> > fs/buffer.c     |    4 +++-
> > fs/ext4/inode.c |    3 +++
> > mm/filemap.c    |   15 +++++++++++++--
> > 3 files changed, 19 insertions(+), 3 deletions(-)
> > 
> > diff --git a/fs/buffer.c b/fs/buffer.c
> > index 2219a76..39e934c 100644
> > --- a/fs/buffer.c
> > +++ b/fs/buffer.c
> > @@ -2379,8 +2379,10 @@ block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
> > 			ret = VM_FAULT_OOM;
> > 		else /* -ENOSPC, -EIO, etc */
> > 			ret = VM_FAULT_SIGBUS;
> > -	} else
> > +	} else {
> > +		wait_on_page_writeback(page);
> > 		ret = VM_FAULT_LOCKED;
> > +	}
> > 
> > out:
> > 	return ret;
> > diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> > index 9f7f9e4..2364704 100644
> > --- a/fs/ext4/inode.c
> > +++ b/fs/ext4/inode.c
> > @@ -2730,12 +2730,15 @@ static int ext4_writepage(struct page *page,
> > 	struct inode *inode = page->mapping->host;
> > 
> > 	trace_ext4_writepage(inode, page);
> > +lock_page(page);
> > 	size = i_size_read(inode);
> > 	if (page->index == size >> PAGE_CACHE_SHIFT)
> > 		len = size & ~PAGE_CACHE_MASK;
> > 	else
> > 		len = PAGE_CACHE_SIZE;
> > 
> > +wait_on_page_writeback(page);
> > +
> > 	/*
> > 	 * If the page does not have buffers (for whatever reason),
> > 	 * try to create them using __block_write_begin.  If this
> > diff --git a/mm/filemap.c b/mm/filemap.c
> > index 83a45d3..f201d80 100644
> > --- a/mm/filemap.c
> > +++ b/mm/filemap.c
> > @@ -2217,8 +2217,8 @@ EXPORT_SYMBOL(generic_file_direct_write);
> >  * Find or create a page at the given pagecache position. Return the locked
> >  * page. This function is specifically for buffered writes.
> >  */
> > -struct page *grab_cache_page_write_begin(struct address_space *mapping,
> > -					pgoff_t index, unsigned flags)
> > +struct page *__grab_cache_page_write_begin(struct address_space *mapping,
> > +					   pgoff_t index, unsigned flags)
> > {
> > 	int status;
> > 	struct page *page;
> > @@ -2243,6 +2243,17 @@ repeat:
> > 	}
> > 	return page;
> > }
> > +struct page *grab_cache_page_write_begin(struct address_space *mapping,
> > +					pgoff_t index, unsigned flags)
> > +{
> > +	struct page *p;
> > +
> > +	p = __grab_cache_page_write_begin(mapping, index, flags);
> > +	if (p)
> > +		wait_on_page_writeback(p);
> > +
> > +	return p;
> > +}
> > EXPORT_SYMBOL(grab_cache_page_write_begin);
> > 
> > static ssize_t generic_perform_write(struct file *file,
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
> > the body of a message to majordomo@...r.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> 
> Cheers, Andreas
> 
> 
> 
> 
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/