Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1617712

[PATCH 4.10 06/81] xfs: fix toctou race when locking an inode to access the data map

Show all headers | View raw

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Darrick J. Wong <darrick.wong@oracle.com>

commit 4b5bd5bf3fb182dc504b1b64e0331300f156e756 upstream.

We use di_format and if_flags to decide whether we're grabbing the ilock
in btree mode (btree extents not loaded) or shared mode (anything else),
but the state of those fields can be changed by other threads that are
also trying to load the btree extents -- IFEXTENTS gets set before the
_bmap_read_extents call and cleared if it fails.

We don't actually need to have IFEXTENTS set until after the bmbt
records are successfully loaded and validated, which will fix the race
between multiple threads trying to read the same directory.  The next
patch strengthens directory bmbt validation by refusing to open the
directory if reading the bmbt to start directory readahead fails.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/libxfs/xfs_inode_fork.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/fs/xfs/libxfs/xfs_inode_fork.c
+++ b/fs/xfs/libxfs/xfs_inode_fork.c
@@ -497,15 +497,14 @@ xfs_iread_extents(
 	 * We know that the size is valid (it's checked in iformat_btree)
 	 */
 	ifp->if_bytes = ifp->if_real_bytes = 0;
-	ifp->if_flags |= XFS_IFEXTENTS;
 	xfs_iext_add(ifp, 0, nextents);
 	error = xfs_bmap_read_extents(tp, ip, whichfork);
 	if (error) {
 		xfs_iext_destroy(ifp);
-		ifp->if_flags &= ~XFS_IFEXTENTS;
 		return error;
 	}
 	xfs_validate_extents(ifp, nextents, XFS_EXTFMT_INODE(ip));
+	ifp->if_flags |= XFS_IFEXTENTS;
 	return 0;
 }
 /*

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.10 00/81] 4.10.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:10 +0200
  [PATCH 4.10 06/81] xfs: fix toctou race when locking an inode to access the data map Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:10 +0200
  [PATCH 4.10 02/81] KVM: nVMX: fix nested EPT detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:10 +0200
  [PATCH 4.10 42/81] mmc: sdhci-of-at91: fix MMC_DDR_52 timing selection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:10 +0200
  [PATCH 4.10 11/81] xfs: allow unwritten extents in the CoW fork Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:20 +0200
  [PATCH 4.10 18/81] xfs: handle indlen shortage on delalloc extent merge Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:20 +0200
  [PATCH 4.10 16/81] xfs: correct null checks and error processing in xfs_initialize_perag Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:20 +0200
  [PATCH 4.10 10/81] xfs: verify free block header fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:20 +0200
  [PATCH 4.10 13/81] xfs: reset b_first_retry_time when clear the retry status of xfs_buf_t Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:20 +0200
  [PATCH 4.10 15/81] xfs: update ctime and mtime on clone destinatation inodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 11:20 +0200
  Re: [PATCH 4.10 00/81] 4.10.9-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-06 20:00 +0200
    Re: [PATCH 4.10 00/81] 4.10.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-06 20:10 +0200
  Re: [PATCH 4.10 00/81] 4.10.9-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-07 00:00 +0200
    Re: [PATCH 4.10 00/81] 4.10.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-07 10:20 +0200

csiph-web