lkml.org 
[lkml]   [2021]   [Jul]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [f2fs-dev] [PATCH] f2fs: fix ctx->pos in f2fs_read_inline_dir()
From
Date
On 2021/7/17 11:49, Yangtao Li wrote:
> I recently found a case where de->name_len is 0 in f2fs_fill_dentries() easily reproduced,
> and finally set the fsck flag.
>
> Thread A Thread B
>
> f2fs_readdir
> f2fs_read_inline_dir
> ctx->pos = d.max
> f2fs_add_dentry
> f2fs_add_inline_entry
> do_convert_inline_dir
> f2fs_add_regular_entry
> f2fs_readdir
> f2fs_fill_dentries
> set_sbi_flag(sbi, SBI_NEED_FSCK)
>
> Process A opens the folder, and has been reading without closing it. During this period,
> Process B created a file under the folder (occupying multiple f2fs_dir_entry, exceeding
> the d.max of the inline dir). After creation, process A uses the d.max of inline dir to
> read it again, and it will read that de->name_len is 0.

Nice catch!

>
> And returning early in f2fs_read_inline_dir will cause the process to be unable to see
> the changes before reopening the file.
>
> So don't return early and remove the modification of ctx->pos in f2fs_read_inline_dir().
>
> Signed-off-by: Yangtao Li <frank.li@vivo.com>
> ---
> fs/f2fs/inline.c | 5 -----
> 1 file changed, 5 deletions(-)
>
> diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
> index 56a20d5c15da..fc6551139a3d 100644
> --- a/fs/f2fs/inline.c
> +++ b/fs/f2fs/inline.c
> @@ -729,9 +729,6 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx,
>
> make_dentry_ptr_inline(inode, &d, inline_dentry);
>
> - if (ctx->pos == d.max)
> - return 0;
> -
> ipage = f2fs_get_node_page(F2FS_I_SB(inode), inode->i_ino);
> if (IS_ERR(ipage))
> return PTR_ERR(ipage);
> @@ -747,8 +744,6 @@ int f2fs_read_inline_dir(struct file *file, struct dir_context *ctx,
> make_dentry_ptr_inline(inode, &d, inline_dentry);
>
> err = f2fs_fill_dentries(ctx, &d, 0, fstr);

After this function, ctx->pos will point to start position of first free slot after
last dir_entry, we can't guarantee that the free slot won't be used in above race
condition, right?

Moreover, w/o inline conversion, the race condition still can happen as below, right?

dir_entry1: A
dir_entry2: B
dir_entry3: C
free slot: _

Before:
AAAABBBB___
^
Thread B delete dir_entry2, and create dir_entry3.

After:
AAAACCCCC__
^
Thanks,

> - if (!err)
> - ctx->pos = d.max;
>
> f2fs_put_page(ipage, 0);
> return err < 0 ? err : 0;
>

\
 
 \ /
  Last update: 2021-07-17 10:56    [W:0.055 / U:0.152 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site