From owner-freebsd-fs@freebsd.org Tue Apr 13 11:44:18 2021 Return-Path: Delivered-To: freebsd-fs@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 78CB25DC9EA for ; Tue, 13 Apr 2021 11:44:18 +0000 (UTC) (envelope-from alexander.lochmann@tu-dortmund.de) Received: from unimail.uni-dortmund.de (mx1.hrz.uni-dortmund.de [129.217.128.51]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "unimail.tu-dortmund.de", Issuer "DFN-Verein Global Issuing CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FKP015lxmz4c4M for ; Tue, 13 Apr 2021 11:44:17 +0000 (UTC) (envelope-from alexander.lochmann@tu-dortmund.de) Received: from [192.168.111.113] (p4fd97541.dip0.t-ipconnect.de [79.217.117.65]) (authenticated bits=0) by unimail.uni-dortmund.de (8.16.1/8.16.1) with ESMTPSA id 13DBiEnr008607 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT); Tue, 13 Apr 2021 13:44:15 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tu-dortmund.de; s=unimail; t=1618314255; bh=LJujmBnPnIvO5G3vXUmOrbfhzvQoGulTX7x5Zo3KeFk=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=CukGQNDvrMViIIZu9CiFg4HGAdevoMyHFi/eWFu9kdSriEV3ElZBejkdoMqBSI0VP +t35MKIt+6cfcuwsU90H0ebFL/hDR8p9ythCV5N9Lfaha7BhNjeu9/QiNX+MonfP6w WhYdvdvUXX1z6Oxmd/9txtJb/GSSW8heNq+1JeTQ= Subject: Re: [struct buf] Unlocked access to b_vflags? To: Konstantin Belousov Cc: freebsd-fs@freebsd.org References: <792c8a3d-8ea6-073f-3fda-b3eb793ef2b9@tu-dortmund.de> From: Alexander Lochmann Message-ID: Date: Tue, 13 Apr 2021 13:44:14 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="AmhoOYiNmm1rPl3BVA7mX8Pd6hdZG3E9A" X-Rspamd-Queue-Id: 4FKP015lxmz4c4M X-Spamd-Bar: ---- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=tu-dortmund.de header.s=unimail header.b=CukGQNDv; dmarc=none; spf=pass (mx1.freebsd.org: domain of alexander.lochmann@tu-dortmund.de designates 129.217.128.51 as permitted sender) smtp.mailfrom=alexander.lochmann@tu-dortmund.de X-Spamd-Result: default: False [-4.30 / 15.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:129.217.128.0/24]; HAS_ATTACHMENT(0.00)[]; RCVD_DKIM_ARC_DNSWL_MED(-0.50)[]; RWL_MAILSPIKE_GOOD(0.00)[129.217.128.51:from]; DKIM_TRACE(0.00)[tu-dortmund.de:+]; RCPT_COUNT_TWO(0.00)[2]; RCVD_IN_DNSWL_MED(-0.20)[129.217.128.51:from]; SIGNED_PGP(-2.00)[]; FREEMAIL_TO(0.00)[gmail.com]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:+,3:~]; SUBJECT_ENDS_QUESTION(1.00)[]; ASN(0.00)[asn:680, ipnet:129.217.0.0/16, country:DE]; MID_RHS_MATCH_FROM(0.00)[]; RECEIVED_SPAMHAUS_PBL(0.00)[79.217.117.65:received]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; R_DKIM_ALLOW(-0.20)[tu-dortmund.de:s=unimail]; FROM_HAS_DN(0.00)[]; NEURAL_HAM_SHORT(-1.00)[-1.000]; MIME_GOOD(-0.20)[multipart/signed,multipart/mixed,text/plain]; DMARC_NA(0.00)[tu-dortmund.de]; DWL_DNSWL_LOW(-1.00)[tu-dortmund.de:dkim]; TO_MATCH_ENVRCPT_SOME(0.00)[]; NEURAL_SPAM_LONG(1.00)[1.000]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; MAILMAN_DEST(0.00)[freebsd-fs] X-BeenThere: freebsd-fs@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Filesystems List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Apr 2021 11:44:18 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --AmhoOYiNmm1rPl3BVA7mX8Pd6hdZG3E9A Content-Type: multipart/mixed; boundary="4jgzcgYTERslCHmALQ79z7QVANtJcJVrI"; protected-headers="v1" From: Alexander Lochmann To: Konstantin Belousov Cc: freebsd-fs@freebsd.org Message-ID: Subject: Re: [struct buf] Unlocked access to b_vflags? References: <792c8a3d-8ea6-073f-3fda-b3eb793ef2b9@tu-dortmund.de> In-Reply-To: --4jgzcgYTERslCHmALQ79z7QVANtJcJVrI Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: de-DE Content-Transfer-Encoding: quoted-printable Thx! Do you mind adding "Found by LockDoc" to the Commit-Msg? Cheers, Alex On 13.04.21 12:25, Konstantin Belousov wrote: > On Mon, Apr 12, 2021 at 11:19:05PM +0200, Alexander Lochmann wrote: >> Hi folks, >> >> I'm was digging through our data set when I encountered a strange situ= ation: >> According to the code in trunc_dependencies() in sys/ufs/ffs/ffs_softd= ep.c, >> the bo_lock should be held. At least that's how I read the code. >> However, we see several thousands of accesses to b_vflags without the >> bo_lock held. >> At least the own b_lock is acquired. >> The access happens in line 7549: bp->b_vflags |=3D BV_SCANNED; [1] >> Can you please shed some light on this situation? >> Is the b_lock sufficeint, and somehow overrules the bo_lock? >> Am I missing something? > I think you found a valid race. There is one more place where BV_SCANN= ED > was manipulated without owning bufobj lock. Patch below should fix bot= h. >=20 > commit a678470b1307542c5a46b930c119b2358863e0d2 > Author: Konstantin Belousov > Date: Tue Apr 13 13:22:56 2021 +0300 >=20 > b_vflags update requries bufobj lock > =20 > Reported by: Alexander Lochmann (trunc_dependencies()) >=20 > diff --git a/sys/ufs/ffs/ffs_softdep.c b/sys/ufs/ffs/ffs_softdep.c > index 0091b5dcd3b8..23c0cf6e128b 100644 > --- a/sys/ufs/ffs/ffs_softdep.c > +++ b/sys/ufs/ffs/ffs_softdep.c > @@ -7546,7 +7546,9 @@ trunc_dependencies(ip, freeblks, lastlbn, lastoff= , flags) > BO_LOCK(bo); > goto cleanrestart; > } > + BO_LOCK(bo); > bp->b_vflags |=3D BV_SCANNED; > + BO_UNLOCK(bo); > bremfree(bp); > if (blkoff !=3D 0) { > allocbuf(bp, blkoff); > diff --git a/sys/ufs/ffs/ffs_vnops.c b/sys/ufs/ffs/ffs_vnops.c > index dc638595eb7b..05eb19c0ee13 100644 > --- a/sys/ufs/ffs/ffs_vnops.c > +++ b/sys/ufs/ffs/ffs_vnops.c > @@ -321,8 +321,9 @@ ffs_syncvnode(struct vnode *vp, int waitfor, int fl= ags) > if (BUF_LOCK(bp, > LK_EXCLUSIVE | LK_SLEEPFAIL | LK_INTERLOCK, > BO_LOCKPTR(bo)) !=3D 0) { > + BO_LOCK(bo); > bp->b_vflags &=3D ~BV_SCANNED; > - goto next; > + goto next_locked; > } > } else > continue; > @@ -385,6 +386,7 @@ ffs_syncvnode(struct vnode *vp, int waitfor, int fl= ags) > * to start from a known point. > */ > BO_LOCK(bo); > +next_locked: > nbp =3D TAILQ_FIRST(&bo->bo_dirty.bv_hd); > } > if (waitfor !=3D MNT_WAIT) { >=20 --=20 Technische Universit=C3=A4t Dortmund Alexander Lochmann PGP key: 0xBC3EF6FD Otto-Hahn-Str. 16 phone: +49.231.7556141 D-44227 Dortmund fax: +49.231.7556116 http://ess.cs.tu-dortmund.de/Staff/al --4jgzcgYTERslCHmALQ79z7QVANtJcJVrI-- --AmhoOYiNmm1rPl3BVA7mX8Pd6hdZG3E9A Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsF5BAABCAAjFiEElhZsUHzVP0dbkjCRWT7tBbw+9v0FAmB1hA4FAwAAAAAACgkQWT7tBbw+9v1h Zg//RSp7wM6yeF/eLw5Z7nFW+cCiK6wPheiURqJmMzlYbZRsceqrtROJmvH4cqmNsHBO9l40Byqu Iy2PFJc3PpmDScS0JiT6P94+oGP3vPVX+qkOAiiuBfQeHnjc5XUUNycndEI7Q6+jfCY+kmMKvMQa P4WGf47v0EFrQVZFlMy4yZ7oatDzC/QtLznFz7OYBOeTsjd5QlUXiWj3sAhap/09VZ0+GOGmsgPU Je4HQZpq+fu85uzuv8kieX+Ww/uQXO1auFKZQ1NJVBMQwgQKyyXCQcszqPUoAjv1xCrT4OGkHKLQ SZKLzphfvNbFGa9spL6cwXGAa64NrdnNeHzmDc0ohhLEZ2hBHUPgv4YktK/xCPjwtPSw1PrrtQWV L/npNoLYefhWTPLLQEEhCbaiEW38qbupvv2+kMUO7UC8P8s8YGPUgsqtuQRQFCs3smprcjwCYKaR SC92X6Dbp7H8DRju3Tz2wiRpixvMKol6wEfOHgqfG9IPfGP3Cq9YNIDQ2SwQoFXONu9E+/u/J2H6 MZ9x5RtVhJMFBfyZEVO3ENUc0/37LO2zU3R/14zm3TIuK6PJ4DYXDCS3s72kGDiHOneC2CYWxnF/ 2x6kVjyzJBpUOPap4rEtYkOxK5bBsGgeOxw8mdroLu2DTwt/dY/ZCJwbDMKDjhZv1nW0Ym3gkKmE cpc= =wjdN -----END PGP SIGNATURE----- --AmhoOYiNmm1rPl3BVA7mX8Pd6hdZG3E9A--