diff mbox series

[mm-nonmm-unstable,v2,1/2] squashfs: fix page update race

Message ID 20230526-squashfs-cache-fixup-v2-1-6fb7723c3647@axis.com
State New
Headers
Series squashfs: fixups for caching |

Commit Message

Vincent Whitchurch May 26, 2023, 1:57 p.m. UTC 
  We only put the page into the cache after we've read it, so the
PageUptodate() check should not be necessary.  In fact, it's actively
harmful since the check could fail (since we used find_get_page() and
not find_lock_page()) and we could end up submitting a page for I/O
after it has been read and while it's actively being used, which could
lead to corruption depending on what the block driver does with it.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
---
 fs/squashfs/block.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Phillip Lougher May 26, 2023, 5:59 p.m. UTC | #1 
On 26/05/2023 14:57, Vincent Whitchurch wrote:
> We only put the page into the cache after we've read it, so the
> PageUptodate() check should not be necessary.  In fact, it's actively
> harmful since the check could fail (since we used find_get_page() and
> not find_lock_page()) and we could end up submitting a page for I/O
> after it has been read and while it's actively being used, which could
> lead to corruption depending on what the block driver does with it.
>
> Reviewed-by: Christoph Hellwig <hch@lst.de>
> Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>


Reviewed-by: Phillip Lougher <phillip@squashfs.org.uk>
Vincent Whitchurch June 29, 2023, 10:57 a.m. UTC | #2 
On Fri, 2023-05-26 at 15:57 +0200, Vincent Whitchurch wrote:
> We only put the page into the cache after we've read it, so the
> PageUptodate() check should not be necessary.  In fact, it's actively
> harmful since the check could fail (since we used find_get_page() and
> not find_lock_page()) and we could end up submitting a page for I/O
> after it has been read and while it's actively being used, which could
> lead to corruption depending on what the block driver does with it.

It turns out that removing the PageUptodate() check entirely wasn't
correct.

While it's true that the squashfs code only puts the page into the cache
after it's been read as I wrote above, migration on the other hand
replaces the page in the mapping _before_ copying the contents over, so
a PageUptodate() check is still needed.

The original problem can be fixed by moving the PageUptodate() check to
squashfs_bio_read() and ignoring the cached page entirely if it's not up
to date.

I'll post a fix shortly.
diff mbox series

Patch

diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 6285f5afb6c6..f2412e5fc84b 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -92,7 +92,7 @@  static int squashfs_bio_read_cached(struct bio *fullbio,
 	bio_for_each_segment_all(bv, fullbio, iter_all) {
 		struct page *page = bv->bv_page;
 
-		if (page->mapping == cache_mapping && PageUptodate(page)) {
+		if (page->mapping == cache_mapping) {
 			idx++;
 			continue;
 		}