Re: [PATCH 2/2] xarray: Fix race in xas_find_chunk()

From: Matthew Wilcox <willy@infradead.org>
To: Jan Kara <jack@suse.cz>
Cc: Yury Norov <yury.norov@gmail.com>,
	Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
	Rasmus Villemoes <linux@rasmusvillemoes.dk>,
	Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>,
	linux-fsdevel@vger.kernel.org
Subject: Re: [PATCH 2/2] xarray: Fix race in xas_find_chunk()
Date: Wed, 11 Oct 2023 16:38:49 +0100	[thread overview]
Message-ID: <ZSbBiQmx71u2RDdj@casper.infradead.org> (raw)
In-Reply-To: <20231011150252.32737-2-jack@suse.cz>

On Wed, Oct 11, 2023 at 05:02:32PM +0200, Jan Kara wrote:
> xas_find_chunk() can be called only under RCU protection and thus tags
> can be changing while it is working. Hence the code:
> 
> 	unsigned long data = *addr & (~0UL << offset);
> 	if (data)
> 		return __ffs(data);
> 
> is prone to 'data' being refetched from addr by the compiler and thus
> calling __ffs() with 0 argument and undefined results.
> 
> Fix the problem by removing XA_CHUNK_SIZE == BITS_PER_LONG special case
> completely. find_next_bit() gets this right and there's no performance
> difference because it is inline and has the very same special branch for
> const-sized bitmaps anyway.
> 
> Reported-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
> CC: Matthew Wilcox <willy@infradead.org>
> Signed-off-by: Jan Kara <jack@suse.cz>

Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>