]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ceph: fix potential race condition in ceph_ioctl_lazyio()
authorViacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Fri, 13 Jun 2025 18:31:08 +0000 (11:31 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 13 Nov 2025 20:37:39 +0000 (15:37 -0500)
commit035df850cdaa97bb22a5c0f3cd0996ec25d5a78b
tree2bcc14fbd471fd1aae1ecd64b212dcdc60a33fc9
parent496961aa4b75e9a835e4f3854194c58f45c29f87
ceph: fix potential race condition in ceph_ioctl_lazyio()

[ Upstream commit 5824ccba9a39a3ad914fc9b2972a2c1119abaac9 ]

The Coverity Scan service has detected potential
race condition in ceph_ioctl_lazyio() [1].

The CID 1591046 contains explanation: "Check of thread-shared
field evades lock acquisition (LOCK_EVASION). Thread1 sets
fmode to a new value. Now the two threads have an inconsistent
view of fmode and updates to fields correlated with fmode
may be lost. The data guarded by this critical section may
be read while in an inconsistent state or modified by multiple
racing threads. In ceph_ioctl_lazyio: Checking the value of
a thread-shared field outside of a locked region to determine
if a locked operation involving that thread shared field
has completed. (CWE-543)".

The patch places fi->fmode field access under ci->i_ceph_lock
protection. Also, it introduces the is_file_already_lazy
variable that is set under the lock and it is checked later
out of scope of critical section.

[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1591046

Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/ceph/ioctl.c