Date: Thu, 12 Jul 2007 17:21:27 +0300 From: Kostik Belousov <kostikbel@gmail.com> To: Bruce Evans <brde@optusnet.com.au> Cc: bugs@freebsd.org, fs@freebsd.org Subject: Re: msdosfs not MPSAFE Message-ID: <20070712142127.GD2200@deviant.kiev.zoral.com.ua> In-Reply-To: <20070712225324.F9515@besplex.bde.org> References: <20070710233455.O2101@besplex.bde.org> <20070712084115.GA2200@deviant.kiev.zoral.com.ua> <20070712225324.F9515@besplex.bde.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--QQBmthHSezQuldOP Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jul 12, 2007 at 11:33:40PM +1000, Bruce Evans wrote: >=20 >=20 > On Thu, 12 Jul 2007, Kostik Belousov wrote: >=20 > >On Wed, Jul 11, 2007 at 12:08:19AM +1000, Bruce Evans wrote: > >>msdsofs has been broken since Giant locking for file systems (or syscal= ls) > >>was removed. It allows multiple threads to race accessing the shared > >>static buffer `nambuf' and related variables. This causes remarkably >=20 > >>[Add Giant locking] >=20 > >>Please fix this better. mbnambuf_init() could return a non-static buff= er > >>that doesn't require locking. Deallocation would be painful. Note that > >>even the details for Giant locking can't be hidden in msdosfs_conv.c li= ke > >>the current interfaces intend, since mbnambuf_init() is used a lot to > >>reinitialize an in-use buffer, and there is no interface to drop usage. >=20 > >It seems that msdosfs_lookup() can sleep, thus Giant protection would be > >lost. >=20 > It can certainly block in bread(). Besides bread(), there is a (re)locking for ".." case, and deget() call, that itself calls malloc(M_WAITOK), vfs_hash_get(), getnewvnode() and readep(). The latter itself calls bread(). This is from the brief look. >=20 > I now think this is not really an SMP bug. The nambuf* data structure > requires a long-term global lock, but it has never had one. The bug > seems to be relatively new. nambuf* is for multi-byte characters, not > for long names, and has only existed since 2003 (msdosfs_vnops.c 1.141, > etc.). I thought that long names were built up in nambuf, but they > are apparently built up in the directory entry. This should work for > multi-byte characters too -- don't translate anything until all the low- > level directory entries have been accumulated. >=20 > How does my adding Giant locking help? I checked that at least in > FreeBSD-~5.2-current, msdosfs_readdir() is already Giant-locked, so my > fix just increments the recursion count. What happens to recursively- > held Giant locks across sleeps? I think they should cause a KASSERT() > failure, but if they are handled by only dropping Giant once then my > fix might sort of work but sleeps would be broken generally. >=20 Look at the kern/kern_sync.c:_sleep(). It does DROP_GIANT(), that (from the sys/mutex.h) calls mtx_unlock() until Giant is owned. --QQBmthHSezQuldOP Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (FreeBSD) iD8DBQFGljjmC3+MBN1Mb4gRAkMNAJwKu64+eN4bOF0xcIFEF4UjNIenuQCfVAP7 CpnkfmWcpcpbNRPidZxWAtk= =WeyX -----END PGP SIGNATURE----- --QQBmthHSezQuldOP--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070712142127.GD2200>