From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:44932 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751726AbdDAReC (ORCPT ); Sat, 1 Apr 2017 13:34:02 -0400 Subject: Patch "xfs: fix toctou race when locking an inode to access the data map" has been added to the 4.9-stable tree To: darrick.wong@oracle.com, gregkh@linuxfoundation.org, hch@lst.de Cc: , From: Date: Sat, 01 Apr 2017 19:33:36 +0200 Message-ID: <14910680162538@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled xfs: fix toctou race when locking an inode to access the data map to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xfs-fix-toctou-race-when-locking-an-inode-to-access-the-data-map.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 4b5bd5bf3fb182dc504b1b64e0331300f156e756 Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Thu, 2 Feb 2017 15:13:57 -0800 Subject: xfs: fix toctou race when locking an inode to access the data map From: Darrick J. Wong commit 4b5bd5bf3fb182dc504b1b64e0331300f156e756 upstream. We use di_format and if_flags to decide whether we're grabbing the ilock in btree mode (btree extents not loaded) or shared mode (anything else), but the state of those fields can be changed by other threads that are also trying to load the btree extents -- IFEXTENTS gets set before the _bmap_read_extents call and cleared if it fails. We don't actually need to have IFEXTENTS set until after the bmbt records are successfully loaded and validated, which will fix the race between multiple threads trying to read the same directory. The next patch strengthens directory bmbt validation by refusing to open the directory if reading the bmbt to start directory readahead fails. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman --- fs/xfs/libxfs/xfs_inode_fork.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/fs/xfs/libxfs/xfs_inode_fork.c +++ b/fs/xfs/libxfs/xfs_inode_fork.c @@ -497,15 +497,14 @@ xfs_iread_extents( * We know that the size is valid (it's checked in iformat_btree) */ ifp->if_bytes = ifp->if_real_bytes = 0; - ifp->if_flags |= XFS_IFEXTENTS; xfs_iext_add(ifp, 0, nextents); error = xfs_bmap_read_extents(tp, ip, whichfork); if (error) { xfs_iext_destroy(ifp); - ifp->if_flags &= ~XFS_IFEXTENTS; return error; } xfs_validate_extents(ifp, nextents, XFS_EXTFMT_INODE(ip)); + ifp->if_flags |= XFS_IFEXTENTS; return 0; } /* Patches currently in stable-queue which might be from darrick.wong@oracle.com are queue-4.9/xfs-mark-speculative-prealloc-cow-fork-extents-unwritten.patch queue-4.9/xfs-fix-toctou-race-when-locking-an-inode-to-access-the-data-map.patch queue-4.9/xfs-use-iomap-new-flag-for-newly-allocated-delalloc-blocks.patch queue-4.9/xfs-handle-indlen-shortage-on-delalloc-extent-merge.patch queue-4.9/xfs-reject-all-unaligned-direct-writes-to-reflinked-files.patch queue-4.9/xfs-allow-unwritten-extents-in-the-cow-fork.patch queue-4.9/xfs-tune-down-agno-asserts-in-the-bmap-code.patch queue-4.9/xfs-verify-free-block-header-fields.patch queue-4.9/xfs-check-for-obviously-bad-level-values-in-the-bmbt-root.patch queue-4.9/xfs-don-t-fail-xfs_extent_busy-allocation.patch queue-4.9/xfs-sync-eofblocks-scans-under-iolock-are-livelock-prone.patch queue-4.9/xfs-use-per-ag-reservations-for-the-finobt.patch queue-4.9/xfs-pull-up-iolock-from-xfs_free_eofblocks.patch queue-4.9/xfs-fail-_dir_open-when-readahead-fails.patch queue-4.9/xfs-reset-b_first_retry_time-when-clear-the-retry-status-of-xfs_buf_t.patch queue-4.9/xfs-update-ctime-and-mtime-on-clone-destinatation-inodes.patch queue-4.9/xfs-only-update-mount-resv-fields-on-success-in-__xfs_ag_resv_init.patch queue-4.9/xfs-split-indlen-reservations-fairly-when-under-reserved.patch queue-4.9/xfs-filter-out-obviously-bad-btree-pointers.patch queue-4.9/xfs-use-xfs_icluster_size_fsb-to-calculate-inode-chunk-alignment.patch queue-4.9/xfs-only-reclaim-unwritten-cow-extents-periodically.patch queue-4.9/xfs-try-any-ag-when-allocating-the-first-btree-block-when-reflinking.patch queue-4.9/xfs-fix-and-streamline-error-handling-in-xfs_end_io.patch queue-4.9/xfs-fix-eofblocks-race-with-file-extending-async-dio-writes.patch queue-4.9/xfs-fix-uninitialized-variable-in-_reflink_convert_cow.patch queue-4.9/xfs-don-t-reserve-blocks-for-right-shift-transactions.patch queue-4.9/xfs-use-xfs_icluster_size_fsb-to-calculate-inode-alignment-mask.patch