• Yangtao Li's avatar
    f2fs: reduce the scope of setting fsck tag when de->name_len is zero · d4bf15a7
    Yangtao Li authored
    I recently found a case where de->name_len is 0 in f2fs_fill_dentries()
    easily reproduced, and finally set the fsck flag.
    
    Thread A			Thread B
    - f2fs_readdir
     - f2fs_read_inline_dir
      - ctx->pos = d.max
    				- f2fs_add_dentry
    				 - f2fs_add_inline_entry
    				  - do_convert_inline_dir
    				 - f2fs_add_regular_entry
    - f2fs_readdir
     - f2fs_fill_dentries
      - set_sbi_flag(sbi, SBI_NEED_FSCK)
    
    Process A opens the folder, and has been reading without closing it.
    During this period, Process B created a file under the folder (occupying
    multiple f2fs_dir_entry, exceeding the d.max of the inline dir). After
    creation, process A uses the d.max of inline dir to read it again, and
    it will read that de->name_len is 0.
    
    And Chao pointed out that w/o inline conversion, the race condition still
    can happen as below:
    
    dir_entry1: A
    dir_entry2: B
    dir_entry3: C
    free slot: _
    ctx->pos: ^
    
    Thread A is traversing directory,
    ctx-pos moves to below position after readdir() by thread A:
    AAAABBBB___
            ^
    
    Then thread B delete dir_entry2, and create dir_entry3.
    
    Thread A calls readdir() to lookup dirents starting from middle
    of new dirent slots as below:
    AAAACCCCCC_
            ^
    In these scenarios, the file system is not damaged, and it's hard to
    avoid it. But we can bypass tagging FSCK flag if:
    a) bit_pos (:= ctx->pos % d->max) is non-zero and
    b) before bit_pos moves to first valid dir_entry.
    
    Fixes: ddf06b75 ("f2fs: fix to trigger fsck if dirent.name_len is zero")
    Signed-off-by: default avatarYangtao Li <frank.li@vivo.com>
    [Chao: clean up description]
    Reviewed-by: default avatarChao Yu <chao@kernel.org>
    Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
    d4bf15a7
dir.c 28.4 KB