linux-kernel - Re: [PATCH v2] ext4: fix race condition between buffer write and page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c20befb7-cd2e-019a-57d4-35da70e0f534@huawei.com>
Date:   Mon, 5 Jun 2023 10:17:29 +0800
From:   Baokun Li <libaokun1@...wei.com>
To:     Theodore Ts'o <tytso@....edu>
CC:     <linux-ext4@...r.kernel.org>, <adilger.kernel@...ger.ca>,
        <jack@...e.cz>, <ritesh.list@...il.com>,
        <linux-kernel@...r.kernel.org>, <jun.nie@...aro.org>,
        <ebiggers@...nel.org>, <yi.zhang@...wei.com>,
        <yangerkun@...wei.com>, <yukuai3@...wei.com>,
        <syzbot+a158d886ca08a3fecca4@...kaller.appspotmail.com>,
        <stable@...r.kernel.org>, Baokun Li <libaokun1@...wei.com>
Subject: Re: [PATCH v2] ext4: fix race condition between buffer write and
 page_mkwrite

On 2023/6/4 11:04, Theodore Ts'o wrote:
> I tried testing to see if this fixed [1], and it appears to be
> triggering a lockdep warning[2] at this line in the patch:
>
> [1] https://syzkaller.appspot.com/bug?extid=f4582777a19ec422b517
> [2] https://syzkaller.appspot.com/x/report.txt?x=17260843280000
>
>> diff --git a/fs/ext4/file.c b/fs/ext4/file.c
>> index d101b3b0c7da..9df82d72eb90 100644
>> --- a/fs/ext4/file.c
>> +++ b/fs/ext4/file.c
>> @@ -808,6 +809,27 @@ static int ext4_file_mmap(struct file *file, struct vm_area_struct *vma)
>>   	if (!daxdev_mapping_supported(vma, dax_dev))
>>   		return -EOPNOTSUPP;
>>   
>> +	/*
>> +	 * Writing via mmap has no logic to handle inline data, so we
>> +	 * need to call ext4_convert_inline_data() to convert the inode
>> +	 * to normal format before doing so, otherwise a BUG_ON will be
>> +	 * triggered in ext4_writepages() due to the
>> +	 * EXT4_STATE_MAY_INLINE_DATA flag. Moreover, we need to grab
>> +	 * i_rwsem during conversion, since clearing and setting the
>> +	 * inline data flag may race with ext4_buffered_write_iter()
>> +	 * to trigger a BUG_ON.
>> +	 */
>> +	if (ext4_has_feature_inline_data(sb) &&
>> +	    vma->vm_flags & VM_SHARED && vma->vm_flags & VM_MAYWRITE) {
>> +		int err;
>> +
>> +		inode_lock(inode); <=================== LOCKDEP warning
>> +		err = ext4_convert_inline_data(inode);
>> +		inode_unlock(inode);
>> +		if (err)
>> +			return err;
>> +	}
>
> The details of the lockdep warning from [2], which appears to be a
> mmap(2) racing with a buffered write(2) are below.  Could you take a
> look?
>
> Thanks!
>
> 					- Ted

Sorry for the late reply!

Had a look at this question which is similar to the one Honza mentioned 
earlier.
Concurrency between write and mmap as follows can lead to ABBA deadlocks:

     CPU0                   CPU1
   write(2)                mmap(2)
ext4_file_write_iter
  ext4_buffered_write_iter
   inode_lock(inode)  ---> LOCK A
   generic_perform_write
                          ksys_mmap_pgoff
                           vm_mmap_pgoff
                            mmap_write_lock_killable(mm) ---> LOCK B
                            do_mmap
                             mmap_region
                              call_mmap
                               ext4_file_mmap
                                inode_lock(inode)  ---> try LOCK A again
    fault_in_iov_iter_readable              |
     fault_in_readable                      |
      asm_exc_page_fault                ABBA deadlock
       handle_page_fault                    |
        do_user_addr_fault                  |
         mmap_read_lock(mm) ---> try LOCK B again


Thanks!
-- 
With Best Regards,
Baokun Li
.