Race in mm/readahead.c:140 file_ra_state_init / block/ioctl.c:497 blkdev_common_ioctl

[Gabriel Ryan <gabe@xxxxxxxxxxxxxxx>]

Hi,

We found a race in the mm subsystem in kernel version v5.18-rc5 that
appears to be potentially harmful using a race testing tool we are
developing. The race occurs between:

mm/readahead.c:140 file_ra_state_init

    ra->ra_pages = inode_to_bdi(mapping->host)->ra_pages;

block/ioctl.c:497 blkdev_common_ioctl

    bdev->bd_disk->bdi->ra_pages = (arg * 512) / PAGE_SIZE;


which both set the ra->ra_pages value. It appears this race could lead
to undefined behavior, if multiple threads set ra->ra_pages to
different values simultaneously for a single file inode.

Best,
Gabe