Skip to content

ext4: fix racy may inline data check in dio write

Brian Foster requested to merge bfoster2/centos-stream-9:jira15106-ext4-racy-inline-data-check into main

JIRA: https://issues.redhat.com/browse/RHEL-15106
Upstream Status: linux.git
Tested: via fstests.

commit ce56d21355cd6f6937aca32f1f44ca749d1e4808
Author: Brian Foster bfoster@redhat.com
Date: Mon Oct 2 14:50:20 2023 -0400

ext4: fix racy may inline data check in dio write  

syzbot reports that the following warning from ext4_iomap_begin()  
triggers as of the commit referenced below:  

        if (WARN_ON_ONCE(ext4_has_inline_data(inode)))  
                return -ERANGE;  

This occurs during a dio write, which is never expected to encounter  
an inode with inline data. To enforce this behavior,  
ext4_dio_write_iter() checks the current inline state of the inode  
and clears the MAY_INLINE_DATA state flag to either fall back to  
buffered writes, or enforce that any other writers in progress on  
the inode are not allowed to create inline data.  

The problem is that the check for existing inline data and the state  
flag can span a lock cycle. For example, if the ilock is originally  
locked shared and subsequently upgraded to exclusive, another writer  
may have reacquired the lock and created inline data before the dio  
write task acquires the lock and proceeds.  

The commit referenced below loosens the lock requirements to allow  
some forms of unaligned dio writes to occur under shared lock, but  
AFAICT the inline data check was technically already racy for any  
dio write that would have involved a lock cycle. Regardless, lift  
clearing of the state bit to the same lock critical section that  
checks for preexisting inline data on the inode to close the race.  

Cc: stable@kernel.org  
Reported-by: syzbot+307da6ca5cb0d01d581a@syzkaller.appspotmail.com  
Fixes: 310ee0902b8d ("ext4: allow concurrent unaligned dio overwrites")  
Signed-off-by: Brian Foster <bfoster@redhat.com>  
Link: https://lore.kernel.org/r/20231002185020.531537-1-bfoster@redhat.com  
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

Signed-off-by: Brian Foster bfoster@redhat.com

Merge request reports