All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ross Zwisler <ross.zwisler@linux.intel.com>
To: Jan Kara <jack@suse.cz>
Cc: Andrew Morton <akpm@linux-foundation.org>,
	linux-nvdimm@lists.01.org, stable@vger.kernel.org,
	linux-fsdevel@vger.kernel.org, linux-ext4@vger.kernel.org
Subject: Re: [PATCH 4/4] dax: Fix data corruption when fault races with write
Date: Mon, 8 May 2017 11:25:27 -0600	[thread overview]
Message-ID: <20170508172527.GA18408@linux.intel.com> (raw)
In-Reply-To: <20170505072500.25692-5-jack@suse.cz>

On Fri, May 05, 2017 at 09:25:00AM +0200, Jan Kara wrote:
> Currently DAX read fault can race with write(2) in the following way:
> 
> CPU1 - write(2)			CPU2 - read fault
> 				dax_iomap_pte_fault()
> 				  ->iomap_begin() - sees hole
> dax_iomap_rw()
>   iomap_apply()
>     ->iomap_begin - allocates blocks
>     dax_iomap_actor()
>       invalidate_inode_pages2_range()
>         - there's nothing to invalidate
> 				  grab_mapping_entry()
> 				  - we add zero page in the radix tree
> 				    and map it to page tables
> 
> The result is that hole page is mapped into page tables (and thus zeros
> are seen in mmap) while file has data written in that place.
> 
> Fix the problem by locking exception entry before mapping blocks for the
> fault. That way we are sure invalidate_inode_pages2_range() call for
> racing write will either block on entry lock waiting for the fault to
> finish (and unmap stale page tables after that) or read fault will see
> already allocated blocks by write(2).
> 
> Fixes: 9f141d6ef6258a3a37a045842d9ba7e68f368956
> CC: stable@vger.kernel.org
> Signed-off-by: Jan Kara <jack@suse.cz>

Yep, this looks correct to me.  Thanks!

Reviewed-by: Ross Zwisler <ross.zwisler@linux.intel.com>
_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm

WARNING: multiple messages have this Message-ID (diff)
From: Ross Zwisler <ross.zwisler@linux.intel.com>
To: Jan Kara <jack@suse.cz>
Cc: Ross Zwisler <ross.zwisler@linux.intel.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Dan Williams <dan.j.williams@intel.com>,
	linux-fsdevel@vger.kernel.org, linux-ext4@vger.kernel.org,
	linux-nvdimm@lists.01.org, stable@vger.kernel.org
Subject: Re: [PATCH 4/4] dax: Fix data corruption when fault races with write
Date: Mon, 8 May 2017 11:25:27 -0600	[thread overview]
Message-ID: <20170508172527.GA18408@linux.intel.com> (raw)
In-Reply-To: <20170505072500.25692-5-jack@suse.cz>

On Fri, May 05, 2017 at 09:25:00AM +0200, Jan Kara wrote:
> Currently DAX read fault can race with write(2) in the following way:
> 
> CPU1 - write(2)			CPU2 - read fault
> 				dax_iomap_pte_fault()
> 				  ->iomap_begin() - sees hole
> dax_iomap_rw()
>   iomap_apply()
>     ->iomap_begin - allocates blocks
>     dax_iomap_actor()
>       invalidate_inode_pages2_range()
>         - there's nothing to invalidate
> 				  grab_mapping_entry()
> 				  - we add zero page in the radix tree
> 				    and map it to page tables
> 
> The result is that hole page is mapped into page tables (and thus zeros
> are seen in mmap) while file has data written in that place.
> 
> Fix the problem by locking exception entry before mapping blocks for the
> fault. That way we are sure invalidate_inode_pages2_range() call for
> racing write will either block on entry lock waiting for the fault to
> finish (and unmap stale page tables after that) or read fault will see
> already allocated blocks by write(2).
> 
> Fixes: 9f141d6ef6258a3a37a045842d9ba7e68f368956
> CC: stable@vger.kernel.org
> Signed-off-by: Jan Kara <jack@suse.cz>

Yep, this looks correct to me.  Thanks!

Reviewed-by: Ross Zwisler <ross.zwisler@linux.intel.com>

WARNING: multiple messages have this Message-ID (diff)
From: Ross Zwisler <ross.zwisler-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
To: Jan Kara <jack-AlSwsSmVLrQ@public.gmane.org>
Cc: Andrew Morton
	<akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>,
	linux-nvdimm-hn68Rpc1hR1g9hUCZPvPmw@public.gmane.org,
	stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-ext4-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [PATCH 4/4] dax: Fix data corruption when fault races with write
Date: Mon, 8 May 2017 11:25:27 -0600	[thread overview]
Message-ID: <20170508172527.GA18408@linux.intel.com> (raw)
In-Reply-To: <20170505072500.25692-5-jack-AlSwsSmVLrQ@public.gmane.org>

On Fri, May 05, 2017 at 09:25:00AM +0200, Jan Kara wrote:
> Currently DAX read fault can race with write(2) in the following way:
> 
> CPU1 - write(2)			CPU2 - read fault
> 				dax_iomap_pte_fault()
> 				  ->iomap_begin() - sees hole
> dax_iomap_rw()
>   iomap_apply()
>     ->iomap_begin - allocates blocks
>     dax_iomap_actor()
>       invalidate_inode_pages2_range()
>         - there's nothing to invalidate
> 				  grab_mapping_entry()
> 				  - we add zero page in the radix tree
> 				    and map it to page tables
> 
> The result is that hole page is mapped into page tables (and thus zeros
> are seen in mmap) while file has data written in that place.
> 
> Fix the problem by locking exception entry before mapping blocks for the
> fault. That way we are sure invalidate_inode_pages2_range() call for
> racing write will either block on entry lock waiting for the fault to
> finish (and unmap stale page tables after that) or read fault will see
> already allocated blocks by write(2).
> 
> Fixes: 9f141d6ef6258a3a37a045842d9ba7e68f368956
> CC: stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> Signed-off-by: Jan Kara <jack-AlSwsSmVLrQ@public.gmane.org>

Yep, this looks correct to me.  Thanks!

Reviewed-by: Ross Zwisler <ross.zwisler-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>

  reply	other threads:[~2017-05-08 17:25 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-05-05  7:24 [PATCH 0/4 v2] mm,dax: Fix data corruption due to mmap inconsistency Jan Kara
2017-05-05  7:24 ` Jan Kara
2017-05-05  7:24 ` [PATCH 1/4] dax: prevent invalidation of mapped DAX entries Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:24 ` [PATCH 2/4] mm: Fix data corruption due to stale mmap reads Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:24 ` [PATCH 3/4] ext4: Return back to starting transaction in ext4_dax_huge_fault() Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:25 ` [PATCH 4/4] dax: Fix data corruption when fault races with write Jan Kara
2017-05-05  7:25   ` Jan Kara
2017-05-05  7:25   ` Jan Kara
2017-05-08 17:25   ` Ross Zwisler [this message]
2017-05-08 17:25     ` Ross Zwisler
2017-05-08 17:25     ` Ross Zwisler
2017-05-09 12:14     ` Jan Kara
2017-05-09 12:14       ` Jan Kara
2017-05-09 12:14       ` Jan Kara
2017-05-08 17:27 ` [PATCH 0/4 v2] mm,dax: Fix data corruption due to mmap inconsistency Ross Zwisler
2017-05-08 17:27   ` Ross Zwisler
2017-05-08 17:27   ` Ross Zwisler
2017-05-09 12:18 [PATCH 0/4 v3] " Jan Kara
2017-05-09 12:18 ` [PATCH 4/4] dax: Fix data corruption when fault races with write Jan Kara
2017-05-09 12:18   ` Jan Kara
2017-05-09 12:18   ` Jan Kara
2017-05-09 12:18   ` Jan Kara
2017-05-10  8:54 [PATCH 0/4 v4] mm,dax: Fix data corruption due to mmap inconsistency Jan Kara
2017-05-10  8:54 ` [PATCH 4/4] dax: Fix data corruption when fault races with write Jan Kara
2017-05-10  8:54   ` Jan Kara
2017-05-10  8:54   ` Jan Kara
2017-05-10  8:54   ` Jan Kara

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170508172527.GA18408@linux.intel.com \
    --to=ross.zwisler@linux.intel.com \
    --cc=akpm@linux-foundation.org \
    --cc=jack@suse.cz \
    --cc=linux-ext4@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-nvdimm@lists.01.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.