]> git.ipfire.org Git - thirdparty/xfsprogs-dev.git/commit
xfs: fix toctou race when locking an inode to access the data map
authorDarrick J. Wong <darrick.wong@oracle.com>
Tue, 4 Apr 2017 20:37:43 +0000 (15:37 -0500)
committerEric Sandeen <sandeen@redhat.com>
Tue, 4 Apr 2017 20:37:43 +0000 (15:37 -0500)
commite59aa2ffc78eafb21657dc9ddb5aa9691e6acf1f
tree921f95eedd866e31089db810273923d644bbccc9
parent71ac8e1f052da2e4e4128b32f925d14442f629c1
xfs: fix toctou race when locking an inode to access the data map

Source kernel commit: 4b5bd5bf3fb182dc504b1b64e0331300f156e756

We use di_format and if_flags to decide whether we're grabbing the ilock
in btree mode (btree extents not loaded) or shared mode (anything else),
but the state of those fields can be changed by other threads that are
also trying to load the btree extents -- IFEXTENTS gets set before the
_bmap_read_extents call and cleared if it fails.

We don't actually need to have IFEXTENTS set until after the bmbt
records are successfully loaded and validated, which will fix the race
between multiple threads trying to read the same directory.  The next
patch strengthens directory bmbt validation by refusing to open the
directory if reading the bmbt to start directory readahead fails.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
libxfs/xfs_inode_fork.c