linux-kernel - Re: [PATCH] fat: fix data-race between fat12_ent_put() and fat_mirror

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202509030347.6cUT1zxe-lkp@intel.com>
Date: Wed, 3 Sep 2025 03:56:54 +0800
From: kernel test robot <lkp@...el.com>
To: YangWen <anmuxixixi@...il.com>, hirofumi@...l.parknet.co.jp
Cc: oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org,
	YangWen <anmuxixixi@...il.com>
Subject: Re: [PATCH] fat: fix data-race between fat12_ent_put() and
 fat_mirror_bhs()

Hi YangWen,

kernel test robot noticed the following build errors:

[auto build test ERROR on brauner-vfs/vfs.all]
[also build test ERROR on linus/master v6.17-rc4 next-20250902]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/YangWen/fat-fix-data-race-between-fat12_ent_put-and-fat_mirror_bhs/20250902-162253
base:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git vfs.all
patch link:    https://lore.kernel.org/r/20250902081727.7146-1-anmuxixixi%40gmail.com
patch subject: [PATCH] fat: fix data-race between fat12_ent_put() and fat_mirror_bhs()
config: csky-randconfig-002-20250903 (https://download.01.org/0day-ci/archive/20250903/202509030347.6cUT1zxe-lkp@intel.com/config)
compiler: csky-linux-gcc (GCC) 15.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250903/202509030347.6cUT1zxe-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509030347.6cUT1zxe-lkp@intel.com/

All errors (new ones prefixed by >>):

   fs/fat/fatent.c: In function 'fat_mirror_bhs':
>> fs/fat/fatent.c:382:25: error: called object 'is_fat12' is not a function or function pointer
     382 |         bool is_fat12 = is_fat12(sbi);
         |                         ^~~~~~~~
   fs/fat/fatent.c:382:14: note: declared here
     382 |         bool is_fat12 = is_fat12(sbi);
         |              ^~~~~~~~


vim +/is_fat12 +382 fs/fat/fatent.c

   374	
   375	/* FIXME: We can write the blocks as more big chunk. */
   376	static int fat_mirror_bhs(struct super_block *sb, struct buffer_head **bhs,
   377				  int nr_bhs)
   378	{
   379		struct msdos_sb_info *sbi = MSDOS_SB(sb);
   380		struct buffer_head *c_bh;
   381		int err, n, copy;
 > 382		bool is_fat12 = is_fat12(sbi);
   383	
   384		err = 0;
   385		for (copy = 1; copy < sbi->fats; copy++) {
   386			sector_t backup_fat = sbi->fat_length * copy;
   387	
   388			for (n = 0; n < nr_bhs; n++) {
   389				c_bh = sb_getblk(sb, backup_fat + bhs[n]->b_blocknr);
   390				if (!c_bh) {
   391					err = -ENOMEM;
   392					goto error;
   393				}
   394				/* Avoid race with userspace read via bdev */
   395				lock_buffer(c_bh);
   396				/*
   397				 * For FAT12, protect memcpy() of the source sector
   398				 * against concurrent 12-bit entry updates in
   399				 * fat12_ent_put(), otherwise we may copy a torn
   400				 * pair of bytes into the mirror FAT.
   401				 */
   402				if (is_fat12)
   403					spin_lock(&fat12_entry_lock);
   404				memcpy(c_bh->b_data, bhs[n]->b_data, sb->s_blocksize);
   405				if (is_fat12)
   406					spin_unlock(&fat12_entry_lock);
   407				set_buffer_uptodate(c_bh);
   408				unlock_buffer(c_bh);
   409				mark_buffer_dirty_inode(c_bh, sbi->fat_inode);
   410				if (sb->s_flags & SB_SYNCHRONOUS)
   411					err = sync_dirty_buffer(c_bh);
   412				brelse(c_bh);
   413				if (err)
   414					goto error;
   415			}
   416		}
   417	error:
   418		return err;
   419	}
   420	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki