[Bug 207711] New: xfs: data race on ctx->space_used in xlog_cil_insert_items()

[bugzilla-daemon@xxxxxxxxxxxxxxxxxxx]

https://bugzilla.kernel.org/show_bug.cgi?id=207711

            Bug ID: 207711
           Summary: xfs: data race on ctx->space_used in
                    xlog_cil_insert_items()
           Product: File System
           Version: 2.5
    Kernel Version: 5.4
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: XFS
          Assignee: filesystem_xfs@xxxxxxxxxxxxxxxxxxxxxx
          Reporter: baijiaju1990@xxxxxxxxx
        Regression: No

The functions xlog_cil_insert_items() and xlog_cil_push_background() are
concurrently executed at runtime at the following call contexts:

Thread 1:
xfs_file_write_iter()
  xfs_file_buffered_aio_write()
    xfs_file_aio_write_checks()
      xfs_vn_update_time()
        xfs_trans_commit()
          __xfs_trans_commit()
            xfs_log_commit_cil()
              xlog_cil_insert_items()

Thread 2:
xfs_file_write_iter()
  xfs_file_buffered_aio_write()
    xfs_file_aio_write_checks()
      xfs_vn_update_time()
        xfs_trans_commit()
          __xfs_trans_commit()
            xfs_log_commit_cil()
              xlog_cil_push_background()

In xlog_cil_insert_items():
  ctx->space_used += len;

In xlog_cil_push_background():
  if (cil->xc_ctx->space_used < XLOG_CIL_SPACE_LIMIT(log))

The variables ctx->space_used and cil->xc_ctx->space_used access the same
memory, and thus a data race can occur.

This data race was found and actually reproduced by our concurrency fuzzer.

I am not sure whether this data race is harmful and how to fix this data race
properly, so I want to listen to your opinions, thanks :)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.