lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <7460B276-0768-48B2-9862-529B74705E29@purdue.edu>
Date:   Tue, 13 Jun 2023 21:25:50 +0000
From:   "Gong, Sishuai" <sishuai@...due.edu>
To:     "Theodore Y. Ts'o" <tytso@....edu>,
        "adilger.kernel@...ger.ca" <adilger.kernel@...ger.ca>
CC:     "linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: [PATCH] ext4: fix a data race on EXT4_I(inode)->i_disksize

ext4_ext_truncate() might writing to the i_disksize while
ext4_fill_raw_inode() is reading the i_disksize.

The concurrent access can be reported by sanitizers
such as KCSAN but we can mask it using WRITE/READ_ONCE(). The same
fix is used in commit dce8e237100f60c ("ext4: fix a data race at
inode->i_disksize").

Signed-off-by: Sishuai Gong <sishuai@...due.edu>
---
 fs/ext4/extents.c | 2 +-
 fs/ext4/inode.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 35703dce23a3..367f338f60ee 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4396,7 +4396,7 @@ int ext4_ext_truncate(handle_t *handle, struct inode *inode)
 	 */
 
 	/* we have to know where to truncate from in crash case */
-	EXT4_I(inode)->i_disksize = inode->i_size;
+	WRITE_ONCE(EXT4_I(inode)->i_disksize, inode->i_size);
 	err = ext4_mark_inode_dirty(handle, inode);
 	if (err)
 		return err;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 02de439bf1f0..99b48ee26f1c 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4286,7 +4286,7 @@ static int ext4_fill_raw_inode(struct inode *inode, struct ext4_inode *raw_inode
 		raw_inode->i_file_acl_high =
 			cpu_to_le16(ei->i_file_acl >> 32);
 	raw_inode->i_file_acl_lo = cpu_to_le32(ei->i_file_acl);
-	ext4_isize_set(raw_inode, ei->i_disksize);
+	ext4_isize_set(raw_inode, READ_ONCE(ei->i_disksize));
 
 	raw_inode->i_generation = cpu_to_le32(inode->i_generation);
 	if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) {
-- 
2.25.1


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ