Received-SPF: pass (google.com: domain of linux-kernel+bounces-67358-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Date: Thu, 15 Feb 2024 12:00:08 -0500
From: "Liam R. Howlett" <Liam.Howlett@Oracle.com>
To: Jan Kara <jack@suse.cz>
Cc: Chuck Lever <cel@kernel.org>, viro@zeniv.linux.org.uk, brauner@kernel.org,
        hughd@google.com, akpm@linux-foundation.org, oliver.sang@intel.com,
        feng.tang@intel.com, linux-kernel@vger.kernel.org,
        linux-fsdevel@vger.kernel.org, maple-tree@lists.infradead.org,
        linux-mm@kvack.org, lkp@intel.com
Subject: Re: [PATCH RFC 7/7] libfs: Re-arrange locking in offset_iterate_dir()
Message-ID: <20240215170008.22eisfyzumn5pw3f@revolver>
Mail-Followup-To: "Liam R. Howlett" <Liam.Howlett@Oracle.com>,
	Jan Kara <jack@suse.cz>, Chuck Lever <cel@kernel.org>,
	viro@zeniv.linux.org.uk, brauner@kernel.org, hughd@google.com,
	akpm@linux-foundation.org, oliver.sang@intel.com,
	feng.tang@intel.com, linux-kernel@vger.kernel.org,
	linux-fsdevel@vger.kernel.org, maple-tree@lists.infradead.org,
	linux-mm@kvack.org, lkp@intel.com
References: <170785993027.11135.8830043889278631735.stgit@91.116.238.104.host.secureserver.net>
 <170786028847.11135.14775608389430603086.stgit@91.116.238.104.host.secureserver.net>
 <20240215131638.cxipaxanhidb3pev@quack3>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240215131638.cxipaxanhidb3pev@quack3>
User-Agent: NeoMutt/20220429
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?us-ascii?Q?xugnSBF1OUL6ZCLtAkKz7JHsfBICRxjF4UJnkwp8mEEARd9bhrnrzjAA1XN0?=
 =?us-ascii?Q?ObqF5Wm2I+EhLg6Fb3sZb+xQQJ1+FA6H/0gj9WnRXcLWYraxrXFAT3HWg/Z1?=
 =?us-ascii?Q?F8ajaU0ixQMdNcz/xrLfINy4tyonDOb0dqXAxtoe1QXDi26QgGtg7yN7weED?=
 =?us-ascii?Q?3BkxJ/++g4DLlA2vdeygnJfsGBueJBOH1EqBmGLrT7loOIVCnAHxC82OY0YP?=
 =?us-ascii?Q?bV8/TsBFhzrbHW2OcSaUftXMsv+5/gT+cze61RslWN9Wo1cUtj1Qs9GSXClj?=
 =?us-ascii?Q?yYdgmBRV79PEJyeDqcOeQL/y+BWWx6mgsR2V9jBP/fS2DSo1ekiTfA9tgJDt?=
 =?us-ascii?Q?20WbulnCp2tzbP/Q5W3rDcjb7D9XnsQ23rSWX4P2kmDy0ZhaMm23djnn3xRU?=
 =?us-ascii?Q?qDbCqsGQF2btsGyDF3PXQeQ/wWJEc8ZMkxiuCYNtHLtwmswdrQXetuPm3ABf?=
 =?us-ascii?Q?2bx/eCT/yrTPmGQ155p196jLcSrc0gf1hv88glMyb1PPY4GyUdmDYuCYeROJ?=
 =?us-ascii?Q?hnSzBN+7cA/m9bT6PK2VdQkIC37ErTqJiLygMABHOsNifbzs3FhgSDyNoXJA?=
 =?us-ascii?Q?zyV5Qd+VJGO7FKahOwQZSO68BVi+YCl6H4QNPO07ksJ1AtQG4jbKoBp+I1Wt?=
 =?us-ascii?Q?dtgGu8Q8wZmu89WeRgOeQPpFWQWmf7GbhlMZ7II06Dn/CkFtCuWHX/zvzSdT?=
 =?us-ascii?Q?7qlELqMWcnoxDew+mEEslg8I5nG2LAvjwJZNeA+8EszUC/EmQNN5L1AbSctt?=
 =?us-ascii?Q?ICMTI8mc5/GcjN/D7O6uR2evBPFOMRGlegkY8VkZaUfOxKX63XuxZQPmMeR9?=
 =?us-ascii?Q?j2biJh7w767ZLxj+I2uDL6uByZHI0WXqJQU44IARDqjGW+vMB0yO8GhIjgWN?=
 =?us-ascii?Q?TEuoW7lF6L4jbFQlRByo7PHKJoi9XJzXp4CY67TOWEwJcw2NAMaYw0N69NkO?=
 =?us-ascii?Q?q8uGBjQtvsZ40rmaiIBqgs8OZpUU56YjvG/B3o4LTMnK7dnqkXSpT8zKYmEZ?=
 =?us-ascii?Q?S4+b8OlvQXvX+KwbMf3e6ABxNYk1ENsXssipZXtP2gZ9wauToDJWFRO9OP7I?=
 =?us-ascii?Q?WhOZSTsA7RsA4Jp3O0MGT544FVjJoC2J1a1j8UuD6KOO59hiF0vOrHhe+qj7?=
 =?us-ascii?Q?NcNGTHA8f1Gtm8yzUF2R2vxpFUaKA7tQ2Pclxa/SwyC9vCul/MQ7GZfpsFHw?=
 =?us-ascii?Q?7D+9VkUAgYT4w3mpDWUTnq25DHGUv8/E7KlgpaSiJ9pusYk+lKgWECw5JYkg?=
 =?us-ascii?Q?QkCZuf5XzOfGqGs4RsM3fzJZJ9YD3buIc6ngLNKV3CkNk2SjGiBBjdmRpCmD?=
 =?us-ascii?Q?J5I/T4OqfFzuK3zIrW9bvkpwNaPCk6X/52QrpBYdKQa8Sq/V/Ck8H6jYjhWW?=
 =?us-ascii?Q?g5R4aKGAn8Li8/qSmYV0xbmR7bG0KHx4ey02ls8JCdG8FRV5cjRpW2PISwGV?=
 =?us-ascii?Q?Dnm4EjpYwwwpKU6eXRvgh9r6h3BDL/nFjuiv0e11b55aG8safipZE1u6Xtyi?=
 =?us-ascii?Q?rTUOsDoiU8JczLPIkcEPvmM3T2vicwaI5lJu8h/5ifOdtNK8BOif/10ftNvT?=
 =?us-ascii?Q?vFR/B/e5FppV60I0k96m6o/8CzLSPSJgdrcE+VoU?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	vuVCnurKvRMGT3SZ5rCuVJaG7VwCqoAbsnhBiiRlQOzwLc4JiIVGfSl4sISXm7ylpE1hwT503SQtBRZSXtLrktkqWZL1eFsAKQFhrsQcbuT1KNOvH5l0laqtOFvQmK3aqCjfVvf7jpHz5rBR8I7bDbPaOUdfVdjU0H7cmMAAwPadVvj8W8CW1AAr2VRMcVqMx2jUngbhL7FICZNLLCcAUxlr8avqKoEkSQ/4zUar0TOTqduWzR9BauY18Qq2RCrCkQPbQlkzupxa/SZR7VCji0oJEeJIx/djWDFMZ2RTPgP+2AMHWM3DoGsgWelNrSz2EQAX5qUca66j5WZ2lDZRgVnZ9uYxMpFRtFltR6t8Ct+nFeWzoqmOjk6jd4FDnoZvgsEPq5oT0bt89Os0glVHDlARGeoNtPDF9hemxvgjnmpfCRJIxV2KAjYz1x0Wbb8Cqk7PX5q17QLO8QYDnOItP+4OY2E9Mv+TIJsHhE55hriolHplxKUBqAF5WeNJ+k6hTWyasj4N/j1zdlPiDNMfs48UjV8SWZurEyLUBxh0rb9pXB7JfN5XSZIA8x9LDLHJzk7EC7Dz6hKxx/Obnri36tOH8rUkXaxtRrXF/jTakEA=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b2a2c004-b24b-4721-9956-08dc2e47918c
X-MS-Exchange-CrossTenant-AuthSource: LV8PR10MB7943.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Feb 2024 17:00:10.0461
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: H5uPryHXC0h+2W9RTtWUDjUDjcprVnbPlLi/lXJdAqLiL3DQlIHf3oW59fRKILnBkY5AYYoMYQeaILh5XvDhLA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLAPR10MB4914
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-02-15_16,2024-02-14_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 bulkscore=0 suspectscore=0
 phishscore=0 adultscore=0 spamscore=0 mlxlogscore=911 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2311290000
 definitions=main-2402150136
X-Proofpoint-ORIG-GUID: rmYxf3c_BARMosyURxMafHEm1VzjznF_
X-Proofpoint-GUID: rmYxf3c_BARMosyURxMafHEm1VzjznF_

* Jan Kara <jack@suse.cz> [240215 08:16]:
> On Tue 13-02-24 16:38:08, Chuck Lever wrote:
> > From: Chuck Lever <chuck.lever@oracle.com>
> > 
> > Liam says that, unlike with xarray, once the RCU read lock is
> > released ma_state is not safe to re-use for the next mas_find() call.
> > But the RCU read lock has to be released on each loop iteration so
> > that dput() can be called safely.
> > 
> > Thus we are forced to walk the offset tree with fresh state for each
> > directory entry. mt_find() can do this for us, though it might be a
> > little less efficient than maintaining ma_state locally.
> > 
> > Since offset_iterate_dir() doesn't build ma_state locally any more,
> > there's no longer a strong need for offset_find_next(). Clean up by
> > rolling these two helpers together.
> > 
> > Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
> 
> Well, in general I think even xas_next_entry() is not safe to use how
> offset_find_next() was using it. Once you drop rcu_read_lock(),
> xas->xa_node could go stale. But since you're holding inode->i_rwsem when
> using offset_find_next() you should be protected from concurrent
> modifications of the mapping (whatever the underlying data structure is) -
> that's what makes xas_next_entry() safe AFAIU. Isn't that enough for the
> maple tree? Am I missing something?

If you are stopping, you should be pausing the iteration.  Although this
works today, it's not how it should be used because if we make changes
(ie: compaction requires movement of data), then you may end up with a
UAF issue.  We'd have no way of knowing you are depending on the tree
structure to remain consistent.

IOW the inode->i_rwsem is protecting writes of data but not the
structure holding the data.

This is true for both xarray and maple tree.

Thanks,
Liam