diff mbox series

aoe: consolidate flags update to prevent race condition

Message ID ME3P282MB3617DAD141ACDD21170355E0C0C72@ME3P282MB3617.AUSP282.PROD.OUTLOOK.COM (mailing list archive)
State New, archived
Headers show
Series aoe: consolidate flags update to prevent race condition | expand

Commit Message

Gui-Dong Han June 11, 2024, 3:52 a.m. UTC
In aoecmd_sleepwork, there is a race condition caused by two consecutive
writes to the 'flags' variable within a critical section. If a read 
operation occurs between these writes, an intermediate state may be 
read, potentially causing bugs.

To address this issue, the 'flags' variable should be updated in a 
single operation to ensure atomicity and prevent any intermediate state
from being read.

Fixes: 3ae1c24e395b ("[PATCH] aoe [2/8]: support dynamic resizing of AoE devices")
Signed-off-by: Gui-Dong Han <hanguidong02@outlook.com>
---
 drivers/block/aoe/aoecmd.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Jens Axboe June 12, 2024, 4:54 p.m. UTC | #1
On 6/10/24 9:52 PM, Gui-Dong Han wrote:
> In aoecmd_sleepwork, there is a race condition caused by two consecutive
> writes to the 'flags' variable within a critical section. If a read 
> operation occurs between these writes, an intermediate state may be 
> read, potentially causing bugs.
> 
> To address this issue, the 'flags' variable should be updated in a 
> single operation to ensure atomicity and prevent any intermediate state
> from being read.
> 
> Fixes: 3ae1c24e395b ("[PATCH] aoe [2/8]: support dynamic resizing of AoE devices")
> Signed-off-by: Gui-Dong Han <hanguidong02@outlook.com>
> ---
>  drivers/block/aoe/aoecmd.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
> index cc9077b588d7..37d556f019c0 100644
> --- a/drivers/block/aoe/aoecmd.c
> +++ b/drivers/block/aoe/aoecmd.c
> @@ -897,8 +897,7 @@ aoecmd_sleepwork(struct work_struct *work)
>  		set_capacity_and_notify(d->gd, d->ssize);
>  
>  		spin_lock_irq(&d->lock);
> -		d->flags |= DEVFL_UP;
> -		d->flags &= ~DEVFL_NEWSIZE;
> +		d->flags = (d->flags | DEVFL_UP) & ~DEVFL_NEWSIZE;
>  		spin_unlock_irq(&d->lock);
>  	}

It's modified under the lock, and any reader should do so as well. If
not, there's a race regardless of your change or not.
diff mbox series

Patch

diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index cc9077b588d7..37d556f019c0 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -897,8 +897,7 @@  aoecmd_sleepwork(struct work_struct *work)
 		set_capacity_and_notify(d->gd, d->ssize);
 
 		spin_lock_irq(&d->lock);
-		d->flags |= DEVFL_UP;
-		d->flags &= ~DEVFL_NEWSIZE;
+		d->flags = (d->flags | DEVFL_UP) & ~DEVFL_NEWSIZE;
 		spin_unlock_irq(&d->lock);
 	}
 }