All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jason Xing <kerneljasonxing@gmail.com>
To: tytso@mit.edu, adilger.kernel@dilger.ca
Cc: linux-ext4@vger.kernel.org, kerneljasonxing@gmail.com,
	Jason Xing <kernelxing@tencent.com>
Subject: [PATCH] ext4: fix a data-race around bg_free_blocks_count_lo
Date: Sun, 12 May 2024 14:42:03 +0800	[thread overview]
Message-ID: <20240512064203.63067-2-kerneljasonxing@gmail.com> (raw)
In-Reply-To: <20240512064203.63067-1-kerneljasonxing@gmail.com>

From: Jason Xing <kernelxing@tencent.com>

KCSAN reported a data-race issue due to two different cpus accessing
this member.

BUG: KCSAN: data-race in ext4_free_inodes_count / ext4_free_inodes_set

write to 0xffff888104a9e00e of 2 bytes by task 4435 on cpu 0:
 ext4_free_inodes_set+0x1f/0x80 fs/ext4/super.c:397
 __ext4_new_inode+0x15c8/0x2290 fs/ext4/ialloc.c:1216
 ext4_symlink+0x242/0x580 fs/ext4/namei.c:3393
 vfs_symlink+0xc2/0x1a0 fs/namei.c:4475
 do_symlinkat+0xe3/0x320 fs/namei.c:4501
 __do_sys_symlinkat fs/namei.c:4517 [inline]
 __se_sys_symlinkat fs/namei.c:4514 [inline]
 __x64_sys_symlinkat+0x62/0x70 fs/namei.c:4514
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffff888104a9e00e of 2 bytes by task 4440 on cpu 1:
 ext4_free_inodes_count+0x1c/0x80 fs/ext4/super.c:341
 __ext4_new_inode+0xb71/0x2290 fs/ext4/ialloc.c:1040
 ext4_symlink+0x242/0x580 fs/ext4/namei.c:3393
 vfs_symlink+0xc2/0x1a0 fs/namei.c:4475
 do_symlinkat+0xe3/0x320 fs/namei.c:4501
 __do_sys_symlinkat fs/namei.c:4517 [inline]
 __se_sys_symlinkat fs/namei.c:4514 [inline]
 __x64_sys_symlinkat+0x62/0x70 fs/namei.c:4514
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x185c -> 0x185b

Signed-off-by: Jason Xing <kernelxing@tencent.com>
---
 fs/ext4/super.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index cf817a6a6e27..6db71cc1e5cd 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -338,7 +338,7 @@ ext4_fsblk_t ext4_inode_table(struct super_block *sb,
 __u32 ext4_free_group_clusters(struct super_block *sb,
 			       struct ext4_group_desc *bg)
 {
-	return le16_to_cpu(bg->bg_free_blocks_count_lo) |
+	return le16_to_cpu(READ_ONCE(bg->bg_free_blocks_count_lo)) |
 		(EXT4_DESC_SIZE(sb) >= EXT4_MIN_DESC_SIZE_64BIT ?
 		 (__u32)le16_to_cpu(bg->bg_free_blocks_count_hi) << 16 : 0);
 }
@@ -394,7 +394,7 @@ void ext4_inode_table_set(struct super_block *sb,
 void ext4_free_group_clusters_set(struct super_block *sb,
 				  struct ext4_group_desc *bg, __u32 count)
 {
-	bg->bg_free_blocks_count_lo = cpu_to_le16((__u16)count);
+	WRITE_ONCE(bg->bg_free_blocks_count_lo, cpu_to_le16((__u16)count));
 	if (EXT4_DESC_SIZE(sb) >= EXT4_MIN_DESC_SIZE_64BIT)
 		bg->bg_free_blocks_count_hi = cpu_to_le16(count >> 16);
 }
-- 
2.37.3


      reply	other threads:[~2024-05-12  6:42 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-05-12  6:42 [PATCH] ext4: fix a data-race around bg_free_inodes_count_lo Jason Xing
2024-05-12  6:42 ` Jason Xing [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240512064203.63067-2-kerneljasonxing@gmail.com \
    --to=kerneljasonxing@gmail.com \
    --cc=adilger.kernel@dilger.ca \
    --cc=kernelxing@tencent.com \
    --cc=linux-ext4@vger.kernel.org \
    --cc=tytso@mit.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.