Message-ID: <6160a9a2-16b9-e37c-eabc-57f71a1932af@kernel.org>
Date:   Tue, 14 Feb 2023 09:46:50 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.7.2
Subject: Re: [f2fs-dev] [PATCH] f2fs: synchronize atomic write aborts
Content-Language: en-US
To:     Daeho Jeong <daeho43@gmail.com>
Cc:     linux-kernel@vger.kernel.org,
        linux-f2fs-devel@lists.sourceforge.net, kernel-team@android.com,
        Daeho Jeong <daehojeong@google.com>,
        syzbot+823000d23b3400619f7c@syzkaller.appspotmail.com
References: <20230209181819.2333522-1-daeho43@gmail.com>
 <18916dd5-67cc-fe21-f78b-8a6dfbcb1c97@kernel.org>
 <CACOAw_w5Mc3aqS_RD_W7MdLGFQV3O_Jq1WSAVKAxJkEk5uUgeQ@mail.gmail.com>
From:   Chao Yu <chao@kernel.org>
In-Reply-To: <CACOAw_w5Mc3aqS_RD_W7MdLGFQV3O_Jq1WSAVKAxJkEk5uUgeQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2023/2/14 4:14, Daeho Jeong wrote:
>>> diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
>>> index 28c9c72dda2a..7bf660d4cad9 100644
>>> --- a/fs/f2fs/inode.c
>>> +++ b/fs/f2fs/inode.c
>>> @@ -777,11 +777,18 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc)
>>>    void f2fs_evict_inode(struct inode *inode)
>>>    {
>>>        struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
>>> -     nid_t xnid = F2FS_I(inode)->i_xattr_nid;
>>> +     struct f2fs_inode_info *fi = F2FS_I(inode);
>>> +     nid_t xnid = fi->i_xattr_nid;
>>>        int err = 0;
>>>
>>>        f2fs_abort_atomic_write(inode, true);
>>>
>>> +     if (fi->cow_inode) {
>>> +             clear_inode_flag(fi->cow_inode, FI_COW_FILE);
>>> +             iput(fi->cow_inode);
>>> +             fi->cow_inode = NULL;
>>> +     }
>>
>> It looks "fi->cow_inode = NULL" here may race w/ cow_inode allocation in
>> f2fs_ioc_start_atomic_write due to f2fs_write_inode() has not been covered
>> by inode_lock()? IIUC.
> 
> Sorry, I couldn't understand it, since I couldn't find any relation
> between f2fs_ioc_start_atomic_write and f2fs_write_inode. Could you
> elaborate more on this? I thought the code might be safe, since it
> happens in the inode eviction phase.

int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc)
void f2fs_evict_inode(struct inode *inode)

Oops, it looks I was misled by f2fs_write_inode() above f2fs_evict_inode(),
please ignore my comments, sorry. :(

Thanks,