linux-kernel - [PATCH] ext4: fix a data race on EXT4_I(inode)->i

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <7460B276-0768-48B2-9862-529B74705E29@purdue.edu>
Date:   Tue, 13 Jun 2023 21:25:50 +0000
From:   "Gong, Sishuai" <sishuai@...due.edu>
To:     "Theodore Y. Ts'o" <tytso@....edu>,
        "adilger.kernel@...ger.ca" <adilger.kernel@...ger.ca>
CC:     "linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: [PATCH] ext4: fix a data race on EXT4_I(inode)->i_disksize

ext4_ext_truncate() might writing to the i_disksize while
ext4_fill_raw_inode() is reading the i_disksize.

The concurrent access can be reported by sanitizers
such as KCSAN but we can mask it using WRITE/READ_ONCE(). The same
fix is used in commit dce8e237100f60c ("ext4: fix a data race at
inode->i_disksize").

Signed-off-by: Sishuai Gong <sishuai@...due.edu>
---
 fs/ext4/extents.c | 2 +-
 fs/ext4/inode.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 35703dce23a3..367f338f60ee 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4396,7 +4396,7 @@ int ext4_ext_truncate(handle_t *handle, struct inode *inode)
 	 */
 
 	/* we have to know where to truncate from in crash case */
-	EXT4_I(inode)->i_disksize = inode->i_size;
+	WRITE_ONCE(EXT4_I(inode)->i_disksize, inode->i_size);
 	err = ext4_mark_inode_dirty(handle, inode);
 	if (err)
 		return err;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 02de439bf1f0..99b48ee26f1c 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4286,7 +4286,7 @@ static int ext4_fill_raw_inode(struct inode *inode, struct ext4_inode *raw_inode
 		raw_inode->i_file_acl_high =
 			cpu_to_le16(ei->i_file_acl >> 32);
 	raw_inode->i_file_acl_lo = cpu_to_le32(ei->i_file_acl);
-	ext4_isize_set(raw_inode, ei->i_disksize);
+	ext4_isize_set(raw_inode, READ_ONCE(ei->i_disksize));
 
 	raw_inode->i_generation = cpu_to_le32(inode->i_generation);
 	if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) {
-- 
2.25.1