From: bugzilla-daemon@bugzilla.kernel.org
To: linux-xfs@vger.kernel.org
Subject: [Bug 207713] New: xfs: data races on ip->i_itemp->ili_fields in xfs_inode_clean()
Date: Wed, 13 May 2020 03:02:10 +0000 [thread overview]
Message-ID: <bug-207713-201763@https.bugzilla.kernel.org/> (raw)
https://bugzilla.kernel.org/show_bug.cgi?id=207713
Bug ID: 207713
Summary: xfs: data races on ip->i_itemp->ili_fields in
xfs_inode_clean()
Product: File System
Version: 2.5
Kernel Version: 5.4
Hardware: All
OS: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: XFS
Assignee: filesystem_xfs@kernel-bugs.kernel.org
Reporter: baijiaju1990@gmail.com
Regression: No
The function xfs_inode_clean() is concurrently executed with the functions
xfs_inode_item_format_data_fork(), xfs_trans_log_inode() and
xfs_inode_item_format() at runtime in the following call contexts:
Thread 1:
xfsaild()
xfsaild_push()
xfsaild_push_item()
xfs_inode_item_push()
xfs_iflush()
xfs_iflush_cluster()
xfs_inode_clean()
Thread 2 (case 1):
xfs_file_write_iter()
xfs_file_buffered_aio_write()
xfs_file_aio_write_checks()
xfs_vn_update_time()
xfs_trans_commit()
__xfs_trans_commit()
xfs_log_commit_cil()
xlog_cil_insert_items()
xlog_cil_insert_format_items()
xfs_inode_item_format()
xfs_inode_item_format_data_fork()
Thread 2 (case 2):
xfs_file_write_iter()
xfs_file_buffered_aio_write()
xfs_file_aio_write_checks()
xfs_vn_update_time()
xfs_trans_log_inode()
Thread 2 (case 3):
xfs_file_write_iter()
xfs_file_buffered_aio_write()
xfs_file_aio_write_checks()
xfs_vn_update_time()
xfs_trans_commit()
__xfs_trans_commit()
xfs_log_commit_cil()
xlog_cil_insert_items()
xlog_cil_insert_format_items()
xfs_inode_item_format()
In xfs_inode_clean():
return !ip->i_itemp || !(ip->i_itemp->ili_fields & XFS_ILOG_ALL);
In xfs_inode_item_format_data_fork() (case 1):
iip->ili_fields &=
~(XFS_ILOG_DDATA | XFS_ILOG_DBROOT | XFS_ILOG_DEV);
In xfs_trans_log_inode() (case 2):
ip->i_itemp->ili_fields |= flags;
In xfs_inode_item_format() (case 3):
iip->ili_fields &=
~(XFS_ILOG_ADATA | XFS_ILOG_ABROOT | XFS_ILOG_AEXT);
The variables ip->i_itemp->ili_fields and iip->ili_fields access the same
memory, and thus data races can occur.
These data race were found and actually reproduced by our concurrency fuzzer.
I am not sure whether these data races are harmful and how to fix them
properly, so I want to listen to your opinions, thanks :)
--
You are receiving this mail because:
You are watching the assignee of the bug.
next reply other threads:[~2020-05-13 3:02 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-13 3:02 bugzilla-daemon [this message]
2020-05-13 4:06 ` [Bug 207713] New: xfs: data races on ip->i_itemp->ili_fields in xfs_inode_clean() Dave Chinner
2020-05-13 4:31 ` [Bug 207713] " bugzilla-daemon
2020-05-13 8:00 ` bugzilla-daemon
2020-05-13 13:36 ` bugzilla-daemon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-207713-201763@https.bugzilla.kernel.org/ \
--to=bugzilla-daemon@bugzilla.kernel.org \
--cc=linux-xfs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox