linux-ext4 - Re: [PATCH v2] ext4: Fix occasional generic/418 failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 15 Apr 2021 13:39:22 +0200
From:   Jan Kara <jack@...e.cz>
To:     Dave Chinner <david@...morbit.com>
Cc:     Jan Kara <jack@...e.cz>, Ted Tso <tytso@....edu>,
        linux-ext4@...r.kernel.org, Eric Whitney <enwlinux@...il.com>,
        stable@...r.kernel.org
Subject: Re: [PATCH v2] ext4: Fix occasional generic/418 failure

On Thu 15-04-21 12:47:24, Dave Chinner wrote:
> On Wed, Apr 14, 2021 at 03:14:53PM +0200, Jan Kara wrote:
> > Eric has noticed that after pagecache read rework, generic/418 is
> > occasionally failing for ext4 when blocksize < pagesize. In fact, the
> > pagecache rework just made hard to hit race in ext4 more likely. The
> > problem is that since ext4 conversion of direct IO writes to iomap
> > framework (commit 378f32bab371), we update inode size after direct IO
> > write only after invalidating page cache. Thus if buffered read sneaks
> > at unfortunate moment like:
> > 
> > CPU1 - write at offset 1k                       CPU2 - read from offset 0
> > iomap_dio_rw(..., IOMAP_DIO_FORCE_WAIT);
> >                                                 ext4_readpage();
> > ext4_handle_inode_extension()
> > 
> > the read will zero out tail of the page as it still sees smaller inode
> > size and thus page cache becomes inconsistent with on-disk contents with
> > all the consequences.
> > 
> > Fix the problem by moving inode size update into end_io handler which
> > gets called before the page cache is invalidated.
> > 
> > Reported-by: Eric Whitney <enwlinux@...il.com>
> > Fixes: 378f32bab371 ("ext4: introduce direct I/O write using iomap infrastructure")
> > CC: stable@...r.kernel.org
> > Signed-off-by: Jan Kara <jack@...e.cz>
> > ---
> >  fs/ext4/file.c | 20 ++++++++++++++++----
> >  1 file changed, 16 insertions(+), 4 deletions(-)
> > 
> > Eric, can you please try whether this patch fixes the failures you are
> > occasionally seeing?
> > 
> > Changes since v1:
> > * Rewritten the fix to avoid the need for separate transaction handle for
> >   orphan list update
> > 
> > diff --git a/fs/ext4/file.c b/fs/ext4/file.c
> > index 194f5d00fa32..be1e80af61be 100644
> > --- a/fs/ext4/file.c
> > +++ b/fs/ext4/file.c
> > @@ -371,15 +371,27 @@ static ssize_t ext4_handle_inode_extension(struct inode *inode, loff_t offset,
> >  static int ext4_dio_write_end_io(struct kiocb *iocb, ssize_t size,
> >  				 int error, unsigned int flags)
> >  {
> > -	loff_t offset = iocb->ki_pos;
> > +	loff_t pos = iocb->ki_pos;
> >  	struct inode *inode = file_inode(iocb->ki_filp);
> >  
> >  	if (error)
> >  		return error;
> >  
> > -	if (size && flags & IOMAP_DIO_UNWRITTEN)
> > -		return ext4_convert_unwritten_extents(NULL, inode,
> > -						      offset, size);
> > +	if (size && flags & IOMAP_DIO_UNWRITTEN) {
> > +		error = ext4_convert_unwritten_extents(NULL, inode, pos, size);
> > +		if (error < 0)
> > +			return error;
> > +	}
> > +	/*
> > +	 * If we are extending the file, we have to update i_size here before
> > +	 * page cache gets invalidated in iomap_dio_rw(). Otherwise racing
> > +	 * buffered reads could zero out too much from page cache pages. Update
> > +	 * of on-disk size will happen later in ext4_dio_write_iter() where
> > +	 * we have enough information to also perform orphan list handling etc.
> > +	 */
> > +	pos += size;
> > +	if (pos > i_size_read(inode))
> > +		i_size_write(inode, pos);
> 
> Might be worth explaining why this doesn't require locking to
> prevent racing completions from updating the inode size and
> potentially losing an EOF update. I know why but it might not be so
> obvious to others (DIO extending writes are serialised
> at submission in ext4) but it's probably worth having a comment
> similar to the one in xfs_dio_write_end_io() that explains why XFS
> needs locking.

Good idea. There's also the somewhat subtle reason why this completion for
non-extending write cannot race with truncate and falsely seeing pos >
i_size. I've added comments explaining that.

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR