From: cel@kernel.org
To: Hugh Dickins <hughd@google.com>,
Andrew Morten <akpm@linux-foundation.org>,
Christian Brauner <brauner@kernel.org>,
Al Viro <viro@zeniv.linux.org.uk>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>
Cc: <linux-fsdevel@vger.kernel.org>, <stable@vger.kernel.org>,
<linux-mm@kvack.org>,
yukuai3@huawei.com, yangerkun@huawei.com,
Chuck Lever <chuck.lever@oracle.com>,
"Liam R. Howlett" <Liam.Howlett@Oracle.com>,
Jan Kara <jack@suse.cz>
Subject: [RFC PATCH v6.6 01/10] libfs: Re-arrange locking in offset_iterate_dir()
Date: Fri, 24 Jan 2025 14:19:36 -0500 [thread overview]
Message-ID: <20250124191946.22308-2-cel@kernel.org> (raw)
In-Reply-To: <20250124191946.22308-1-cel@kernel.org>
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 3f6d810665dfde0d33785420618ceb03fba0619d ]
Liam and Matthew say that once the RCU read lock is released,
xa_state is not safe to re-use for the next xas_find() call. But the
RCU read lock must be released on each loop iteration so that
dput(), which might_sleep(), can be called safely.
Thus we are forced to walk the offset tree with fresh state for each
directory entry. xa_find() can do this for us, though it might be a
little less efficient than maintaining xa_state locally.
We believe that in the current code base, inode->i_rwsem provides
protection for the xa_state maintained in
offset_iterate_dir(). However, there is no guarantee that will
continue to be the case in the future.
Since offset_iterate_dir() doesn't build xa_state locally any more,
there's no longer a strong need for offset_find_next(). Clean up by
rolling these two helpers together.
Suggested-by: Liam R. Howlett <Liam.Howlett@Oracle.com>
Message-ID: <170785993027.11135.8830043889278631735.stgit@91.116.238.104.host.secureserver.net>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Link: https://lore.kernel.org/r/170820142021.6328.15047865406275957018.stgit@91.116.238.104.host.secureserver.net
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
fs/libfs.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/fs/libfs.c b/fs/libfs.c
index dc0f7519045f..430f7c95336c 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -401,12 +401,13 @@ static loff_t offset_dir_llseek(struct file *file, loff_t offset, int whence)
return vfs_setpos(file, offset, U32_MAX);
}
-static struct dentry *offset_find_next(struct xa_state *xas)
+static struct dentry *offset_find_next(struct offset_ctx *octx, loff_t offset)
{
struct dentry *child, *found = NULL;
+ XA_STATE(xas, &octx->xa, offset);
rcu_read_lock();
- child = xas_next_entry(xas, U32_MAX);
+ child = xas_next_entry(&xas, U32_MAX);
if (!child)
goto out;
spin_lock(&child->d_lock);
@@ -429,12 +430,11 @@ static bool offset_dir_emit(struct dir_context *ctx, struct dentry *dentry)
static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx)
{
- struct offset_ctx *so_ctx = inode->i_op->get_offset_ctx(inode);
- XA_STATE(xas, &so_ctx->xa, ctx->pos);
+ struct offset_ctx *octx = inode->i_op->get_offset_ctx(inode);
struct dentry *dentry;
while (true) {
- dentry = offset_find_next(&xas);
+ dentry = offset_find_next(octx, ctx->pos);
if (!dentry)
return ERR_PTR(-ENOENT);
@@ -443,8 +443,8 @@ static void *offset_iterate_dir(struct inode *inode, struct dir_context *ctx)
break;
}
+ ctx->pos = dentry2offset(dentry) + 1;
dput(dentry);
- ctx->pos = xas.xa_index + 1;
}
return NULL;
}
--
2.47.0
next prev parent reply other threads:[~2025-01-24 19:19 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-01-24 19:19 [RFC PATCH v6.6 00/10] Address CVE-2024-46701 cel
2025-01-24 19:19 ` cel [this message]
2025-01-24 19:19 ` [RFC PATCH v6.6 02/10] libfs: Define a minimum directory offset cel
2025-01-30 8:59 ` Patch "libfs: Define a minimum directory offset" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 03/10] libfs: Add simple_offset_empty() cel
2025-01-30 8:59 ` Patch "libfs: Add simple_offset_empty()" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 04/10] libfs: Fix simple_offset_rename_exchange() cel
2025-01-30 8:59 ` Patch "libfs: Fix simple_offset_rename_exchange()" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 05/10] libfs: Add simple_offset_rename() API cel
2025-01-30 8:59 ` Patch "libfs: Add simple_offset_rename() API" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 06/10] shmem: Fix shmem_rename2() cel
2025-01-30 8:59 ` Patch "shmem: Fix shmem_rename2()" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 07/10] libfs: Return ENOSPC when the directory offset range is exhausted cel
2025-01-30 8:59 ` Patch "libfs: Return ENOSPC when the directory offset range is exhausted" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 08/10] Revert "libfs: Add simple_offset_empty()" cel
2025-01-30 8:59 ` Patch "Revert "libfs: Add simple_offset_empty()"" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 09/10] libfs: Replace simple_offset end-of-directory detection cel
2025-01-30 8:59 ` Patch "libfs: Replace simple_offset end-of-directory detection" has been added to the 6.6-stable tree gregkh
2025-01-24 19:19 ` [RFC PATCH v6.6 10/10] libfs: Use d_children list to iterate simple_offset directories cel
2025-01-30 8:59 ` Patch "libfs: Use d_children list to iterate simple_offset directories" has been added to the 6.6-stable tree gregkh
2025-01-29 13:55 ` [RFC PATCH v6.6 00/10] Address CVE-2024-46701 Chuck Lever
2025-01-29 14:50 ` Greg Kroah-Hartman
2025-01-29 15:06 ` Chuck Lever
2025-01-29 15:21 ` Greg Kroah-Hartman
2025-01-29 16:37 ` Chuck Lever
2025-01-30 8:45 ` Greg Kroah-Hartman
2025-01-30 14:02 ` Chuck Lever
2025-01-30 14:24 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250124191946.22308-2-cel@kernel.org \
--to=cel@kernel.org \
--cc=Liam.Howlett@Oracle.com \
--cc=akpm@linux-foundation.org \
--cc=brauner@kernel.org \
--cc=chuck.lever@oracle.com \
--cc=gregkh@linuxfoundation.org \
--cc=hughd@google.com \
--cc=jack@suse.cz \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
--cc=yangerkun@huawei.com \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox