This is a note to let you know that I've just added the patch titled xfs: remove racy hasattr check from attr ops to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xfs-remove-racy-hasattr-check-from-attr-ops.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From hch@xxxxxx Thu Feb 2 11:15:39 2017 From: Christoph Hellwig <hch@xxxxxx> Date: Thu, 2 Feb 2017 08:56:08 +0100 Subject: xfs: remove racy hasattr check from attr ops To: stable@xxxxxxxxxxxxxxx Cc: linux-xfs@xxxxxxxxxxxxxxx, Brian Foster <bfoster@xxxxxxxxxx>, "Darrick J. Wong" <darrick.wong@xxxxxxxxxx> Message-ID: <1486022171-8076-17-git-send-email-hch@xxxxxx> From: Brian Foster <bfoster@xxxxxxxxxx> commit 5a93790d4e2df73e30c965ec6e49be82fc3ccfce upstream. xfs_attr_[get|remove]() have unlocked attribute fork checks to optimize away a lock cycle in cases where the fork does not exist or is otherwise empty. This check is not safe, however, because an attribute fork short form to extent format conversion includes a transient state that causes the xfs_inode_hasattr() check to fail. Specifically, xfs_attr_shortform_to_leaf() creates an empty extent format attribute fork and then adds the existing shortform attributes to it. This means that lookup of an existing xattr can spuriously return -ENOATTR when racing against a setxattr that causes the associated format conversion. This was originally reproduced by an untar on a particularly configured glusterfs volume, but can also be reproduced on demand with properly crafted xattr requests. The format conversion occurs under the exclusive ilock. xfs_attr_get() and xfs_attr_remove() already have the proper locking and checks further down in the functions to handle this situation correctly. Drop the unlocked checks to avoid the spurious failure and rely on the existing logic. Signed-off-by: Brian Foster <bfoster@xxxxxxxxxx> Reviewed-by: Christoph Hellwig <hch@xxxxxx> Reviewed-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx> Signed-off-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/xfs/libxfs/xfs_attr.c | 6 ------ 1 file changed, 6 deletions(-) --- a/fs/xfs/libxfs/xfs_attr.c +++ b/fs/xfs/libxfs/xfs_attr.c @@ -131,9 +131,6 @@ xfs_attr_get( if (XFS_FORCED_SHUTDOWN(ip->i_mount)) return -EIO; - if (!xfs_inode_hasattr(ip)) - return -ENOATTR; - error = xfs_attr_args_init(&args, ip, name, flags); if (error) return error; @@ -392,9 +389,6 @@ xfs_attr_remove( if (XFS_FORCED_SHUTDOWN(dp->i_mount)) return -EIO; - if (!xfs_inode_hasattr(dp)) - return -ENOATTR; - error = xfs_attr_args_init(&args, dp, name, flags); if (error) return error; Patches currently in stable-queue which might be from hch@xxxxxx are queue-4.9/xfs-don-t-rely-on-total-in-xfs_alloc_space_available.patch queue-4.9/xfs-replace-xfs_mode_to_ftype-table-with-switch-statement.patch queue-4.9/xfs-fix-bogus-minleft-manipulations.patch queue-4.9/xfs-fix-cow-writeback-race.patch queue-4.9/xfs-sanity-check-inode-mode-when-creating-new-dentry.patch queue-4.9/xfs-extsize-hints-are-not-unlikely-in-xfs_bmap_btalloc.patch queue-4.9/xfs-bump-up-reserved-blocks-in-xfs_alloc_set_aside.patch queue-4.9/xfs-add-missing-include-dependencies-to-xfs_dir2.h.patch queue-4.9/xfs-fix-bmv_count-confusion-w-shared-extents.patch queue-4.9/xfs-adjust-allocation-length-in-xfs_alloc_space_available.patch queue-4.9/xfs-verify-dirblocklog-correctly.patch queue-4.9/xfs-fix-xfs_mode_to_ftype-prototype.patch queue-4.9/xfs-clear-_xbf_pages-from-buffers-when-readahead-page.patch queue-4.9/xfs-remove-racy-hasattr-check-from-attr-ops.patch queue-4.9/xfs-make-the-assert-condition-likely.patch queue-4.9/xfs-sanity-check-directory-inode-di_size.patch queue-4.9/xfs-don-t-print-warnings-when-xfs_log_force-fails.patch queue-4.9/xfs-don-t-wrap-id-in-xfs_dq_get_next_id.patch queue-4.9/xfs-sanity-check-inode-di_mode.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html