From: sashiko-bot@kernel.org
To: "Jinjie Ruan" <ruanjinjie@huawei.com>
Cc: linux-ext4@vger.kernel.org, tytso@mit.edu
Subject: Re: [PATCH v2 07/12] ext4: Fix out-of-bounds read in ext4_get_group_info()
Date: Wed, 02 Sep 2026 02:42:35 +0000 [thread overview]
Message-ID: <20260902024236.45D6C1F00A3D@smtp.kernel.org> (raw)
In-Reply-To: <20260901024234.135119-8-ruanjinjie@huawei.com>
> A plain read of s_groups_count in ext4_get_group_info() allows CPU
> load-load reordering. On weak memory models, speculative prefetch of
> s_group_info prior to the boundary check could lead to an out-of-bounds
> read if a concurrent online resize expands the array and increments
> s_groups_count.
>
> The data race occurs between the ioctl configuration path (holding the
> resize lock via ext4_resize_begin) and the lockless metadata lookup path:
>
> CPU 0 (Writer, Resize Lock) CPU 1 (Reader, Lockless)
> --------------------------- ------------------------
> ext4_ioctl()
> [EXT4_IOC_GROUP_ADD]
> ext4_ioctl_group_add()
> ext4_resize_begin() // Takes lock
> [ ... ]
> Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
> Cc: Zhang Yi <yi.zhang@huawei.com>
> Fixes: 5354b2af3406 ("ext4: allow ext4_get_group_info() to fail")
> Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40huawei.com
> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260901024234.135119-1-ruanjinjie@huawei.com?part=7
next prev parent reply other threads:[~2026-09-02 2:42 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-01 2:42 [PATCH v2 00/12] Convert barrier pairs to acquire/release for better performance Jinjie Ruan
2026-09-01 2:42 ` [PATCH v2 01/12] user_namespace: Use acquire/release for nr_extents synchronization Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 2:42 ` [PATCH v2 02/12] lib/vsprintf: Use acquire/release for ptr_key publication Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 2:42 ` [PATCH v2 03/12] fs: aio: Use acquire/release for ring->tail publication Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 2:42 ` [PATCH v2 04/12] fs: Use acquire/release for fdtable resize synchronization Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 2:42 ` [PATCH v2 05/12] pidfs: Use test_bit_acquire() for attr flag tests Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 2:42 ` [PATCH v2 06/12] super: Use acquire for SB_BORN check in super_cache_count() Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 2:42 ` [PATCH v2 07/12] ext4: Fix out-of-bounds read in ext4_get_group_info() Jinjie Ruan
2026-09-01 6:44 ` Zhang Yi
2026-09-01 13:55 ` Jan Kara
2026-09-02 2:42 ` sashiko-bot [this message]
2026-09-01 2:42 ` [PATCH v2 08/12] ext4: Convert group-count barrier protocol to acquire/release Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 2:42 ` [PATCH v2 09/12] soreuseport: publish num_socks with acquire/release Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 2:42 ` [PATCH v2 10/12] net: sched: act_gact: use acquire/release for tcfg_ptype Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 2:42 ` [PATCH v2 11/12] 8021q: Fix data race when publishing vlan net_device pointers Jinjie Ruan
2026-09-01 14:58 ` Jakub Kicinski
2026-09-02 6:46 ` Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 2:42 ` [PATCH v2 12/12] 8021q: publish vlan_devices_arrays entries with acquire/release Jinjie Ruan
2026-09-02 2:42 ` sashiko-bot
2026-09-01 3:06 ` [PATCH v2 00/12] Convert barrier pairs to acquire/release for better performance Kuniyuki Iwashima
2026-09-01 3:15 ` Jinjie Ruan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260902024236.45D6C1F00A3D@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=linux-ext4@vger.kernel.org \
--cc=ruanjinjie@huawei.com \
--cc=sashiko-reviews@lists.linux.dev \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox