ext4_ext_truncate() might writing to the i_disksize while
ext4_fill_raw_inode() is reading the i_disksize.
The concurrent access can be reported by sanitizers
such as KCSAN but we can mask it using WRITE/READ_ONCE(). The same
fix is used in commit dce8e237100f60c ("ext4: fix a data race at
inode->i_disksize").
Signed-off-by: Sishuai Gong <sishuai@xxxxxxxxxx>
---
fs/ext4/extents.c | 2 +-
fs/ext4/inode.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 35703dce23a3..367f338f60ee 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4396,7 +4396,7 @@ int ext4_ext_truncate(handle_t *handle, struct inode *inode)
*/
/* we have to know where to truncate from in crash case */
- EXT4_I(inode)->i_disksize = inode->i_size;
+ WRITE_ONCE(EXT4_I(inode)->i_disksize, inode->i_size);
err = ext4_mark_inode_dirty(handle, inode);
if (err)
return err;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 02de439bf1f0..99b48ee26f1c 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4286,7 +4286,7 @@ static int ext4_fill_raw_inode(struct inode *inode, struct ext4_inode *raw_inode
raw_inode->i_file_acl_high =
cpu_to_le16(ei->i_file_acl >> 32);
raw_inode->i_file_acl_lo = cpu_to_le32(ei->i_file_acl);
- ext4_isize_set(raw_inode, ei->i_disksize);
+ ext4_isize_set(raw_inode, READ_ONCE(ei->i_disksize));
raw_inode->i_generation = cpu_to_le32(inode->i_generation);
if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) {
--
2.25.1
