| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <18916dd5-67cc-fe21-f78b-8a6dfbcb1c97@kernel.org>
Date: Mon, 13 Feb 2023 17:47:45 +0800
From: Chao Yu <chao@...nel.org>
To: Daeho Jeong <daeho43@...il.com>, linux-kernel@...r.kernel.org,
linux-f2fs-devel@...ts.sourceforge.net, kernel-team@...roid.com
Cc: Daeho Jeong <daehojeong@...gle.com>,
syzbot+823000d23b3400619f7c@...kaller.appspotmail.com
Subject: Re: [f2fs-dev] [PATCH] f2fs: synchronize atomic write aborts
On 2023/2/10 2:18, Daeho Jeong wrote:
> From: Daeho Jeong <daehojeong@...gle.com>
>
> To fix a race condition between atomic write aborts, I use the inode
> lock and make COW inode to be re-usable thoroughout the whole
> atomic file inode lifetime.
>
> Reported-by: syzbot+823000d23b3400619f7c@...kaller.appspotmail.com
> Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
> Signed-off-by: Daeho Jeong <daehojeong@...gle.com>
> ---
> fs/f2fs/file.c | 44 +++++++++++++++++++++++++++++---------------
> fs/f2fs/inode.c | 11 +++++++++--
> fs/f2fs/segment.c | 3 ---
> fs/f2fs/super.c | 2 --
> 4 files changed, 38 insertions(+), 22 deletions(-)
>
> diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> index 300eae8b5415..6436c52e7913 100644
> --- a/fs/f2fs/file.c
> +++ b/fs/f2fs/file.c
> @@ -1863,7 +1863,10 @@ static int f2fs_release_file(struct inode *inode, struct file *filp)
> atomic_read(&inode->i_writecount) != 1)
> return 0;
>
> + inode_lock(inode);
> f2fs_abort_atomic_write(inode, true);
> + inode_unlock(inode);
> +
> return 0;
> }
>
> @@ -1878,8 +1881,12 @@ static int f2fs_file_flush(struct file *file, fl_owner_t id)
> * before dropping file lock, it needs to do in ->flush.
> */
> if (F2FS_I(inode)->atomic_write_task == current &&
> - (current->flags & PF_EXITING))
> + (current->flags & PF_EXITING)) {
> + inode_lock(inode);
> f2fs_abort_atomic_write(inode, true);
> + inode_unlock(inode);
> + }
> +
> return 0;
> }
>
> @@ -2085,19 +2092,28 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
> goto out;
> }
>
> - /* Create a COW inode for atomic write */
> - pinode = f2fs_iget(inode->i_sb, fi->i_pino);
> - if (IS_ERR(pinode)) {
> - f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
> - ret = PTR_ERR(pinode);
> - goto out;
> - }
> + /* Check if the inode already has a COW inode */
> + if (fi->cow_inode == NULL) {
> + /* Create a COW inode for atomic write */
> + pinode = f2fs_iget(inode->i_sb, fi->i_pino);
> + if (IS_ERR(pinode)) {
> + f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
> + ret = PTR_ERR(pinode);
> + goto out;
> + }
>
> - ret = f2fs_get_tmpfile(mnt_userns, pinode, &fi->cow_inode);
> - iput(pinode);
> - if (ret) {
> - f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
> - goto out;
> + ret = f2fs_get_tmpfile(mnt_userns, pinode, &fi->cow_inode);
> + iput(pinode);
> + if (ret) {
> + f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
> + goto out;
> + }
> +
> + set_inode_flag(fi->cow_inode, FI_COW_FILE);
> + clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);
> + } else {
> + /* Reuse the already created COW inode */
> + f2fs_do_truncate_blocks(fi->cow_inode, 0, true);
> }
>
> f2fs_write_inode(inode, NULL);
> @@ -2105,8 +2121,6 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
> stat_inc_atomic_inode(inode);
>
> set_inode_flag(inode, FI_ATOMIC_FILE);
> - set_inode_flag(fi->cow_inode, FI_COW_FILE);
> - clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);
>
> isize = i_size_read(inode);
> fi->original_i_size = isize;
> diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
> index 28c9c72dda2a..7bf660d4cad9 100644
> --- a/fs/f2fs/inode.c
> +++ b/fs/f2fs/inode.c
> @@ -777,11 +777,18 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc)
> void f2fs_evict_inode(struct inode *inode)
> {
> struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
> - nid_t xnid = F2FS_I(inode)->i_xattr_nid;
> + struct f2fs_inode_info *fi = F2FS_I(inode);
> + nid_t xnid = fi->i_xattr_nid;
> int err = 0;
>
> f2fs_abort_atomic_write(inode, true);
>
> + if (fi->cow_inode) {
> + clear_inode_flag(fi->cow_inode, FI_COW_FILE);
> + iput(fi->cow_inode);
> + fi->cow_inode = NULL;
> + }
It looks "fi->cow_inode = NULL" here may race w/ cow_inode allocation in
f2fs_ioc_start_atomic_write due to f2fs_write_inode() has not been covered
by inode_lock()? IIUC.
Thanks,
> +
> trace_f2fs_evict_inode(inode);
> truncate_inode_pages_final(&inode->i_data);
>
> @@ -866,7 +873,7 @@ void f2fs_evict_inode(struct inode *inode)
> stat_dec_inline_inode(inode);
> stat_dec_compr_inode(inode);
> stat_sub_compr_blocks(inode,
> - atomic_read(&F2FS_I(inode)->i_compr_blocks));
> + atomic_read(&fi->i_compr_blocks));
>
> if (likely(!f2fs_cp_error(sbi) &&
> !is_sbi_flag_set(sbi, SBI_CP_DISABLED)))
> diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
> index ead3f35f501d..719329c1808c 100644
> --- a/fs/f2fs/segment.c
> +++ b/fs/f2fs/segment.c
> @@ -192,9 +192,6 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)
> if (!f2fs_is_atomic_file(inode))
> return;
>
> - clear_inode_flag(fi->cow_inode, FI_COW_FILE);
> - iput(fi->cow_inode);
> - fi->cow_inode = NULL;
> release_atomic_write_cnt(inode);
> clear_inode_flag(inode, FI_ATOMIC_COMMITTED);
> clear_inode_flag(inode, FI_ATOMIC_REPLACE);
> diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
> index c11a161ba5be..aa55dc12aff2 100644
> --- a/fs/f2fs/super.c
> +++ b/fs/f2fs/super.c
> @@ -1427,8 +1427,6 @@ static int f2fs_drop_inode(struct inode *inode)
> atomic_inc(&inode->i_count);
> spin_unlock(&inode->i_lock);
>
> - f2fs_abort_atomic_write(inode, true);
> -
> /* should remain fi->extent_tree for writepage */
> f2fs_destroy_extent_node(inode);
>
Powered by blists - more mailing lists