From: "Darrick J. Wong" <darrick.wong@oracle.com>
To: Christoph Hellwig <hch@infradead.org>
Cc: linux-xfs@vger.kernel.org
Subject: Re: [PATCH 1/7] xfs: fix toctou race when locking an inode to access the data map
Date: Tue, 31 Jan 2017 13:40:07 -0800 [thread overview]
Message-ID: <20170131214007.GI9134@birch.djwong.org> (raw)
In-Reply-To: <20170131194520.GG9134@birch.djwong.org>
On Tue, Jan 31, 2017 at 11:45:20AM -0800, Darrick J. Wong wrote:
> On Tue, Jan 31, 2017 at 05:26:58AM -0800, Christoph Hellwig wrote:
> > On Mon, Jan 30, 2017 at 04:23:10PM -0800, Darrick J. Wong wrote:
> > > From: Darrick J. Wong <darrick.wong@oracle.com>
> > >
> > > We use di_format and if_flags to decide whether we're grabbing the ilock
> > > in btree mode (btree extents not loaded) or shared mode (anything else),
> > > but the state of those fields can be changed by other threads that are
> > > also trying to load the btree extents -- IFEXTENTS gets set before the
> > > _bmap_read_extents call and cleared if it fails. Therefore, once we've
> > > grabbed the shared ilock we have to re-check the fields to see if we
> > > actually need to upgrade to the exclusive ilock in order to try loading
> > > the extents.
> > >
> > > Without this patch, we trigger ilock assert failures when a bunch of
> > > threads try to access a btree format directory with a corrupt bmbt root
> > > and corrupt the incore data structures, leading to a crash.
> >
> > I see the problem here, but I really don't like the fix. Instead
> > I'd much rather check for a new flag that tells that the extent list
> > hasn't been read, which can only be cleared under the exclusive
> > ilock. That way we shouldn't need any additional relocking or
> > checks.
>
> I'm confused --
>
> I thought XFS_IFEXTENTS means "extents have been read", which is the
> inverse of the flag you propose. AFAICT the bit is only ever set (or
> cleared) with ILOCK_EXCL held, so the problem here is that we're
> performing an unlocked read of if_flags prior to actually taking the
> lock that we need.
>
> On the other hand, I /think/ it's the case that none of the functions
> called in _iread_extents actually cares about IFEXTENTS being set, so
> perhaps an alternative could be to avoid setting the bit until we've
> successfully read in all the bmbt records?
>
> I'll try that out and report back.
Seems to work, will send a revised patch.
--D
>
> --D
>
> >
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2017-01-31 21:40 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-31 0:23 [PATCH 0/7] xfs: random fixes Darrick J. Wong
2017-01-31 0:23 ` [PATCH 1/7] xfs: fix toctou race when locking an inode to access the data map Darrick J. Wong
2017-01-31 3:01 ` Eric Sandeen
2017-01-31 13:26 ` Christoph Hellwig
2017-01-31 19:45 ` Darrick J. Wong
2017-01-31 21:40 ` Darrick J. Wong [this message]
2017-02-01 2:34 ` [PATCH v2 " Darrick J. Wong
2017-02-01 14:48 ` Christoph Hellwig
2017-01-31 0:23 ` [PATCH 2/7] xfs: fail _dir_open when readahead fails Darrick J. Wong
2017-01-31 4:12 ` Eric Sandeen
2017-01-31 13:29 ` Christoph Hellwig
2017-01-31 0:23 ` [PATCH 3/7] xfs: filter out obviously bad btree pointers Darrick J. Wong
2017-01-31 4:39 ` Eric Sandeen
2017-01-31 20:09 ` Darrick J. Wong
2017-01-31 20:37 ` Eric Sandeen
2017-01-31 0:23 ` [PATCH 4/7] xfs: check for obviously bad level values in the bmbt root Darrick J. Wong
2017-01-31 13:31 ` Christoph Hellwig
2017-01-31 0:23 ` [PATCH 5/7] xfs: verify free block header fields Darrick J. Wong
2017-01-31 13:42 ` Christoph Hellwig
2017-01-31 0:23 ` [PATCH 6/7] xfs: allow unwritten extents in the CoW fork Darrick J. Wong
2017-02-01 2:35 ` [PATCH v2 " Darrick J. Wong
2017-02-01 18:06 ` Christoph Hellwig
2017-01-31 0:23 ` [PATCH 7/7] xfs: mark speculative prealloc CoW fork extents unwritten Darrick J. Wong
2017-01-31 13:41 ` Christoph Hellwig
2017-01-31 19:11 ` Darrick J. Wong
2017-02-01 1:28 ` Darrick J. Wong
2017-02-01 2:36 ` [PATCH v2 " Darrick J. Wong
2017-02-01 18:36 ` Christoph Hellwig
2017-02-02 15:04 ` Brian Foster
2017-02-02 17:04 ` Darrick J. Wong
2017-02-02 19:42 ` Brian Foster
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170131214007.GI9134@birch.djwong.org \
--to=darrick.wong@oracle.com \
--cc=hch@infradead.org \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).