Skip to contentSkip to conversation

FAILED: patch "[PATCH] ubifs: Fix races between xattr_{set|get} and listxattr" failed to apply to 4.9-stable tree

PATCH [email protected] 1 participant 1 message Jul 15, 2021

Subsystems (2)
Stable branch UBI file system (UBIFS)
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From f4e3634a3b642225a530c292fdb1e8a4007507f5 Mon Sep 17 00:00:00 2001
From: Zhihao Cheng <[email protected]>
Date: Mon, 31 May 2021 20:52:09 +0800
Subject: [PATCH] ubifs: Fix races between xattr_{set|get} and listxattr
operations

UBIFS may occur some problems with concurrent xattr_{set|get} and listxattr operations, such as assertion failure, memory corruption, stale xattr value[1].

Fix it by importing a new rw-lock in @ubifs_inode to serilize write operations on xattr, concurrent read operations are still effective, just like ext4.

[1] https://lore.kernel.org/linux-mtd/[email protected]

Fixes 1e51764a3c2ac05a23 ("UBIFS: add new flash file system")
Cc [email protected] # v2.6+
Signed-off-by Zhihao Cheng <[email protected]>
Reviewed-by Sascha Hauer <[email protected]>
Signed-off-by Richard Weinberger <[email protected]>
fs/ubifs/super.c +1 -0
index 7b572e1414ba..e279a069a26b 100644
@@ -275,6 +275,7 @@ static struct inode *ubifs_alloc_inode(struct super_block *sb)
 	memset((void *)ui + sizeof(struct inode), 0,
 	       sizeof(struct ubifs_inode) - sizeof(struct inode));
 	mutex_init(&ui->ui_mutex);
+	init_rwsem(&ui->xattr_sem);
 	spin_lock_init(&ui->ui_lock);
 	return &ui->vfs_inode;
 };
fs/ubifs/ubifs.h +2 -0
index b65c599a386a..7e978f421430 100644
@@ -356,6 +356,7 @@ struct ubifs_gced_idx_leb {
  * @ui_mutex: serializes inode write-back with the rest of VFS operations,
  *            serializes "clean <-> dirty" state changes, serializes bulk-read,
  *            protects @dirty, @bulk_read, @ui_size, and @xattr_size
+ * @xattr_sem: serilizes write operations (remove|set|create) on xattr
  * @ui_lock: protects @synced_i_size
  * @synced_i_size: synchronized size of inode, i.e. the value of inode size
  *                 currently stored on the flash; used only for regular file

@@ -409,6 +410,7 @@ struct ubifs_inode {
 	unsigned int bulk_read:1;
 	unsigned int compr_type:2;
 	struct mutex ui_mutex;
+	struct rw_semaphore xattr_sem;
 	spinlock_t ui_lock;
 	loff_t synced_i_size;
 	loff_t ui_size;
fs/ubifs/xattr.c +33 -11

146 lines not on this page · raw message