All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jan Kara <jack@suse.cz>
To: Ross Zwisler <ross.zwisler@linux.intel.com>
Cc: Jan Kara <jack@suse.cz>,
	linux-nvdimm@lists.01.org, stable@vger.kernel.org,
	linux-fsdevel@vger.kernel.org,
	Andrew Morton <akpm@linux-foundation.org>,
	linux-ext4@vger.kernel.org
Subject: Re: [PATCH 4/4] dax: Fix data corruption when fault races with write
Date: Tue, 9 May 2017 14:14:44 +0200	[thread overview]
Message-ID: <20170509121444.GD21467@quack2.suse.cz> (raw)
In-Reply-To: <20170508172527.GA18408@linux.intel.com>

On Mon 08-05-17 11:25:27, Ross Zwisler wrote:
> On Fri, May 05, 2017 at 09:25:00AM +0200, Jan Kara wrote:
> > Currently DAX read fault can race with write(2) in the following way:
> > 
> > CPU1 - write(2)			CPU2 - read fault
> > 				dax_iomap_pte_fault()
> > 				  ->iomap_begin() - sees hole
> > dax_iomap_rw()
> >   iomap_apply()
> >     ->iomap_begin - allocates blocks
> >     dax_iomap_actor()
> >       invalidate_inode_pages2_range()
> >         - there's nothing to invalidate
> > 				  grab_mapping_entry()
> > 				  - we add zero page in the radix tree
> > 				    and map it to page tables
> > 
> > The result is that hole page is mapped into page tables (and thus zeros
> > are seen in mmap) while file has data written in that place.
> > 
> > Fix the problem by locking exception entry before mapping blocks for the
> > fault. That way we are sure invalidate_inode_pages2_range() call for
> > racing write will either block on entry lock waiting for the fault to
> > finish (and unmap stale page tables after that) or read fault will see
> > already allocated blocks by write(2).
> > 
> > Fixes: 9f141d6ef6258a3a37a045842d9ba7e68f368956
> > CC: stable@vger.kernel.org
> > Signed-off-by: Jan Kara <jack@suse.cz>
> 
> Yep, this looks correct to me.  Thanks!
> 
> Reviewed-by: Ross Zwisler <ross.zwisler@linux.intel.com>

Thanks. I'll add your reviewed-by tag and send patches to Andrew for
inclusion.
								Honza

-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR
_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm

WARNING: multiple messages have this Message-ID (diff)
From: Jan Kara <jack@suse.cz>
To: Ross Zwisler <ross.zwisler@linux.intel.com>
Cc: Jan Kara <jack@suse.cz>,
	Andrew Morton <akpm@linux-foundation.org>,
	Dan Williams <dan.j.williams@intel.com>,
	linux-fsdevel@vger.kernel.org, linux-ext4@vger.kernel.org,
	linux-nvdimm@lists.01.org, stable@vger.kernel.org
Subject: Re: [PATCH 4/4] dax: Fix data corruption when fault races with write
Date: Tue, 9 May 2017 14:14:44 +0200	[thread overview]
Message-ID: <20170509121444.GD21467@quack2.suse.cz> (raw)
In-Reply-To: <20170508172527.GA18408@linux.intel.com>

On Mon 08-05-17 11:25:27, Ross Zwisler wrote:
> On Fri, May 05, 2017 at 09:25:00AM +0200, Jan Kara wrote:
> > Currently DAX read fault can race with write(2) in the following way:
> > 
> > CPU1 - write(2)			CPU2 - read fault
> > 				dax_iomap_pte_fault()
> > 				  ->iomap_begin() - sees hole
> > dax_iomap_rw()
> >   iomap_apply()
> >     ->iomap_begin - allocates blocks
> >     dax_iomap_actor()
> >       invalidate_inode_pages2_range()
> >         - there's nothing to invalidate
> > 				  grab_mapping_entry()
> > 				  - we add zero page in the radix tree
> > 				    and map it to page tables
> > 
> > The result is that hole page is mapped into page tables (and thus zeros
> > are seen in mmap) while file has data written in that place.
> > 
> > Fix the problem by locking exception entry before mapping blocks for the
> > fault. That way we are sure invalidate_inode_pages2_range() call for
> > racing write will either block on entry lock waiting for the fault to
> > finish (and unmap stale page tables after that) or read fault will see
> > already allocated blocks by write(2).
> > 
> > Fixes: 9f141d6ef6258a3a37a045842d9ba7e68f368956
> > CC: stable@vger.kernel.org
> > Signed-off-by: Jan Kara <jack@suse.cz>
> 
> Yep, this looks correct to me.  Thanks!
> 
> Reviewed-by: Ross Zwisler <ross.zwisler@linux.intel.com>

Thanks. I'll add your reviewed-by tag and send patches to Andrew for
inclusion.
								Honza

-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

WARNING: multiple messages have this Message-ID (diff)
From: Jan Kara <jack-AlSwsSmVLrQ@public.gmane.org>
To: Ross Zwisler <ross.zwisler-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
Cc: Jan Kara <jack-AlSwsSmVLrQ@public.gmane.org>,
	linux-nvdimm-hn68Rpc1hR1g9hUCZPvPmw@public.gmane.org,
	stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	Andrew Morton
	<akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>,
	linux-ext4-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [PATCH 4/4] dax: Fix data corruption when fault races with write
Date: Tue, 9 May 2017 14:14:44 +0200	[thread overview]
Message-ID: <20170509121444.GD21467@quack2.suse.cz> (raw)
In-Reply-To: <20170508172527.GA18408-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>

On Mon 08-05-17 11:25:27, Ross Zwisler wrote:
> On Fri, May 05, 2017 at 09:25:00AM +0200, Jan Kara wrote:
> > Currently DAX read fault can race with write(2) in the following way:
> > 
> > CPU1 - write(2)			CPU2 - read fault
> > 				dax_iomap_pte_fault()
> > 				  ->iomap_begin() - sees hole
> > dax_iomap_rw()
> >   iomap_apply()
> >     ->iomap_begin - allocates blocks
> >     dax_iomap_actor()
> >       invalidate_inode_pages2_range()
> >         - there's nothing to invalidate
> > 				  grab_mapping_entry()
> > 				  - we add zero page in the radix tree
> > 				    and map it to page tables
> > 
> > The result is that hole page is mapped into page tables (and thus zeros
> > are seen in mmap) while file has data written in that place.
> > 
> > Fix the problem by locking exception entry before mapping blocks for the
> > fault. That way we are sure invalidate_inode_pages2_range() call for
> > racing write will either block on entry lock waiting for the fault to
> > finish (and unmap stale page tables after that) or read fault will see
> > already allocated blocks by write(2).
> > 
> > Fixes: 9f141d6ef6258a3a37a045842d9ba7e68f368956
> > CC: stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> > Signed-off-by: Jan Kara <jack-AlSwsSmVLrQ@public.gmane.org>
> 
> Yep, this looks correct to me.  Thanks!
> 
> Reviewed-by: Ross Zwisler <ross.zwisler-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>

Thanks. I'll add your reviewed-by tag and send patches to Andrew for
inclusion.
								Honza

-- 
Jan Kara <jack-IBi9RG/b67k@public.gmane.org>
SUSE Labs, CR

  reply	other threads:[~2017-05-09 12:14 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-05-05  7:24 [PATCH 0/4 v2] mm,dax: Fix data corruption due to mmap inconsistency Jan Kara
2017-05-05  7:24 ` Jan Kara
2017-05-05  7:24 ` [PATCH 1/4] dax: prevent invalidation of mapped DAX entries Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:24 ` [PATCH 2/4] mm: Fix data corruption due to stale mmap reads Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:24 ` [PATCH 3/4] ext4: Return back to starting transaction in ext4_dax_huge_fault() Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:24   ` Jan Kara
2017-05-05  7:25 ` [PATCH 4/4] dax: Fix data corruption when fault races with write Jan Kara
2017-05-05  7:25   ` Jan Kara
2017-05-05  7:25   ` Jan Kara
2017-05-08 17:25   ` Ross Zwisler
2017-05-08 17:25     ` Ross Zwisler
2017-05-08 17:25     ` Ross Zwisler
2017-05-09 12:14     ` Jan Kara [this message]
2017-05-09 12:14       ` Jan Kara
2017-05-09 12:14       ` Jan Kara
2017-05-08 17:27 ` [PATCH 0/4 v2] mm,dax: Fix data corruption due to mmap inconsistency Ross Zwisler
2017-05-08 17:27   ` Ross Zwisler
2017-05-08 17:27   ` Ross Zwisler
2017-05-09 12:18 [PATCH 0/4 v3] " Jan Kara
2017-05-09 12:18 ` [PATCH 4/4] dax: Fix data corruption when fault races with write Jan Kara
2017-05-09 12:18   ` Jan Kara
2017-05-09 12:18   ` Jan Kara
2017-05-09 12:18   ` Jan Kara
2017-05-10  8:54 [PATCH 0/4 v4] mm,dax: Fix data corruption due to mmap inconsistency Jan Kara
2017-05-10  8:54 ` [PATCH 4/4] dax: Fix data corruption when fault races with write Jan Kara
2017-05-10  8:54   ` Jan Kara
2017-05-10  8:54   ` Jan Kara
2017-05-10  8:54   ` Jan Kara

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170509121444.GD21467@quack2.suse.cz \
    --to=jack@suse.cz \
    --cc=akpm@linux-foundation.org \
    --cc=linux-ext4@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-nvdimm@lists.01.org \
    --cc=ross.zwisler@linux.intel.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.