linux-kernel - Re: [f2fs-dev] [PATCH] f2fs: remove race condition in releasing cblocks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 8 May 2020 14:50:10 +0800
From:   Chao Yu <yuchao0@...wei.com>
To:     Daeho Jeong <daeho43@...il.com>, <linux-kernel@...r.kernel.org>,
        <linux-f2fs-devel@...ts.sourceforge.net>, <kernel-team@...roid.com>
CC:     Daeho Jeong <daehojeong@...gle.com>
Subject: Re: [f2fs-dev] [PATCH] f2fs: remove race condition in releasing
 cblocks

On 2020/5/8 12:25, Daeho Jeong wrote:
> From: Daeho Jeong <daehojeong@...gle.com>
> 
> Now, if writing pages and releasing compress blocks occur
> simultaneously, and releasing cblocks is executed more than one time
> to a file, then total block count of filesystem and block count of the
> file could be incorrect and damaged.
> 
> We have to execute releasing compress blocks only one time for a file
> without being interfered by writepages path.
> 
> Signed-off-by: Daeho Jeong <daehojeong@...gle.com>
> ---
>  fs/f2fs/file.c | 31 ++++++++++++++++++++++++-------
>  1 file changed, 24 insertions(+), 7 deletions(-)
> 
> diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> index 4aab4b42d8ba..a92bc51b9b28 100644
> --- a/fs/f2fs/file.c
> +++ b/fs/f2fs/file.c
> @@ -3488,6 +3488,7 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)
>  	pgoff_t page_idx = 0, last_idx;
>  	unsigned int released_blocks = 0;
>  	int ret;
> +	int writecount;
>  
>  	if (!f2fs_sb_has_compression(F2FS_I_SB(inode)))
>  		return -EOPNOTSUPP;

Before inode_lock(), there is one case we may jump to out label, in
this case, we may unlock inode incorrectly.

	if (!F2FS_I(inode)->i_compr_blocks)
		goto out;

> -
> -	inode_unlock(inode);
>  out:
> +	inode_unlock(inode);
> +
>  	mnt_drop_write_file(filp);

Thanks,