Potential data race on the file->f_pos field between getdents and sendfile

Potential data race on the file->f_pos field between getdents and sendfile

[Meng Xu]

Hi VFS developers,

I am posting here a potential data race on the file->f_pos field
between getdents and sendfile. Following is the trace:

[Setup]
mkdir("foo", 511) = 0;
open("foo", 65536, 511) = 3;
dup2(3, 199) = 199;

create("bar", 511) = 4;
dup2(4, 198) = 198;

[Thread 1]
getdents(199, [some buffer], 3874);

__do_sys_getdents
  iterate_dir
    [WRITE] file->f_pos = ctx->pos;

[Thread 2]
sendfile(198, 199, NULL, 2163);

__do_sys_sendfile64
  do_sendfile
    [READ] pos = in.file->f_pos;

This may be a false data race, i.e., the behavior could be allowed by
POSIX as user might want to sendfile to a dirfd while the dirfd is
being iterated (although there is no obvious reason for doing so). I
am posting this here for more visibility and feel free to comment.

Best Regards,
Meng