All of lore.kernel.org
 help / color / mirror / Atom feed
* [Bug 207717] New: reiserfs: data race on inode->i_size in reiserfs_write_full_page()
@ 2020-05-13  3:28 bugzilla-daemon
  2020-05-13  3:28 ` [Bug 207717] " bugzilla-daemon
  2020-05-13  3:31 ` bugzilla-daemon
  0 siblings, 2 replies; 3+ messages in thread
From: bugzilla-daemon @ 2020-05-13  3:28 UTC (permalink / raw)
  To: reiserfs-devel

https://bugzilla.kernel.org/show_bug.cgi?id=207717

            Bug ID: 207717
           Summary: reiserfs: data race on inode->i_size in
                    reiserfs_write_full_page()
           Product: File System
           Version: 2.5
    Kernel Version: 5.4
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: ReiserFS
          Assignee: reiserfs-devel@vger.kernel.org
          Reporter: baijiaju1990@gmail.com
        Regression: No

The functions reiserfs_write_full_page() and reiserfs_write_end() are
concurrently executed at runtime in the following call contexts:

Thread 1:
reiserfs_writepage()
  reiserfs_write_full_page()

Thread 2:
reiserfs_write_end()

In reiserfs_write_full_page():
  unsigned long end_index = inode->i_size >> PAGE_SHIFT;

In reiserfs_write_end():
  inode->i_size = pos + copied;

Thus, a data race on inode->i_size occurs.

This data race was found and actually reproduced by our concurrency fuzzer.

I am not sure whether this data race is harmful and how to fix this data race
properly, so I want to listen to your opinions, thanks :)

-- 
You are receiving this mail because:
You are the assignee for the bug.

^ permalink raw reply	[flat|nested] 3+ messages in thread

* [Bug 207717] reiserfs: data race on inode->i_size in reiserfs_write_full_page()
  2020-05-13  3:28 [Bug 207717] New: reiserfs: data race on inode->i_size in reiserfs_write_full_page() bugzilla-daemon
@ 2020-05-13  3:28 ` bugzilla-daemon
  2020-05-13  3:31 ` bugzilla-daemon
  1 sibling, 0 replies; 3+ messages in thread
From: bugzilla-daemon @ 2020-05-13  3:28 UTC (permalink / raw)
  To: reiserfs-devel

https://bugzilla.kernel.org/show_bug.cgi?id=207717

Jia-Ju Bai (baijiaju1990@gmail.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |baijiaju1990@gmail.com

-- 
You are receiving this mail because:
You are the assignee for the bug.

^ permalink raw reply	[flat|nested] 3+ messages in thread

* [Bug 207717] reiserfs: data race on inode->i_size in reiserfs_write_full_page()
  2020-05-13  3:28 [Bug 207717] New: reiserfs: data race on inode->i_size in reiserfs_write_full_page() bugzilla-daemon
  2020-05-13  3:28 ` [Bug 207717] " bugzilla-daemon
@ 2020-05-13  3:31 ` bugzilla-daemon
  1 sibling, 0 replies; 3+ messages in thread
From: bugzilla-daemon @ 2020-05-13  3:31 UTC (permalink / raw)
  To: reiserfs-devel

https://bugzilla.kernel.org/show_bug.cgi?id=207717

Jia-Ju Bai (baijiaju1990@gmail.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jeffm@suse.com

-- 
You are receiving this mail because:
You are the assignee for the bug.

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2020-05-13  3:31 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-13  3:28 [Bug 207717] New: reiserfs: data race on inode->i_size in reiserfs_write_full_page() bugzilla-daemon
2020-05-13  3:28 ` [Bug 207717] " bugzilla-daemon
2020-05-13  3:31 ` bugzilla-daemon

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.