[Bug 207713] New: xfs: data races on ip->i_itemp->ili_fields in xfs_inode_clean()

[bugzilla-daemon@bugzilla.kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=207713

            Bug ID: 207713
           Summary: xfs: data races on ip->i_itemp->ili_fields in
                    xfs_inode_clean()
           Product: File System
           Version: 2.5
    Kernel Version: 5.4
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: XFS
          Assignee: filesystem_xfs@kernel-bugs.kernel.org
          Reporter: baijiaju1990@gmail.com
        Regression: No

The function xfs_inode_clean() is concurrently executed with the functions
xfs_inode_item_format_data_fork(), xfs_trans_log_inode() and
xfs_inode_item_format() at runtime in the following call contexts:

Thread 1:
xfsaild()
  xfsaild_push()
    xfsaild_push_item()
      xfs_inode_item_push()
        xfs_iflush()
          xfs_iflush_cluster()
            xfs_inode_clean()

Thread 2 (case 1):
xfs_file_write_iter()
  xfs_file_buffered_aio_write()
    xfs_file_aio_write_checks()
      xfs_vn_update_time()
        xfs_trans_commit()
          __xfs_trans_commit()
            xfs_log_commit_cil()
              xlog_cil_insert_items()
                xlog_cil_insert_format_items()
                  xfs_inode_item_format()
                    xfs_inode_item_format_data_fork()

Thread 2 (case 2):
xfs_file_write_iter()
  xfs_file_buffered_aio_write()
    xfs_file_aio_write_checks()
      xfs_vn_update_time()
        xfs_trans_log_inode()

Thread 2 (case 3):
xfs_file_write_iter()
  xfs_file_buffered_aio_write()
    xfs_file_aio_write_checks()
      xfs_vn_update_time()
        xfs_trans_commit()
          __xfs_trans_commit()
            xfs_log_commit_cil()
              xlog_cil_insert_items()
                xlog_cil_insert_format_items()
                  xfs_inode_item_format()

In xfs_inode_clean():
  return !ip->i_itemp || !(ip->i_itemp->ili_fields & XFS_ILOG_ALL);

In xfs_inode_item_format_data_fork() (case 1):
  iip->ili_fields &=
        ~(XFS_ILOG_DDATA | XFS_ILOG_DBROOT | XFS_ILOG_DEV);

In xfs_trans_log_inode() (case 2):
  ip->i_itemp->ili_fields |= flags;

In xfs_inode_item_format() (case 3):
  iip->ili_fields &=
        ~(XFS_ILOG_ADATA | XFS_ILOG_ABROOT | XFS_ILOG_AEXT);

The variables ip->i_itemp->ili_fields and iip->ili_fields access the same
memory, and thus data races can occur.

These data race were found and actually reproduced by our concurrency fuzzer.

I am not sure whether these data races are harmful and how to fix them
properly, so I want to listen to your opinions, thanks :)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.