From nobody Sun May 24 20:33:24 2026 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1789937DADE for ; Thu, 21 May 2026 16:39:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779381573; cv=none; b=fWM0417hUI4mMmVEyGDhZemdQWU0PnrpeSP9rYY8V2AKgt7LncXiQvTAd+UC4DbD95dQC4npftK6FAsjXI89td4udCDrqrQRxOQ9RUjEU6qoByRIZ1yvxFGF5K4Cd+Fq7nhJ6fPQMDhKGRiLE8zd2LYnYj+nUuFwTAzBKYWVuVo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779381573; c=relaxed/simple; bh=MBtIizEY5hBHrVdP5dcquGtpPCEAARy19S1vIGYeF58=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=oz4Jb1PmS0GiCX3nkp7uC2SACQVHEeIQ+6XoojSCqpOUOx7mT+cmr6xgZcZg1BWU3WM1BpVaFjPRteByL0sqKvxEU34koYbG5mQpi4KlKcT6HsGSpQvBcB7BTNoOv4UE32sb1pr7REg51VIHJkTr+0Xuw4BkSbbRRbzQp002AXw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--ankitkap.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=ADYlbLr3; arc=none smtp.client-ip=209.85.210.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--ankitkap.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ADYlbLr3" Received: by mail-pf1-f202.google.com with SMTP id d2e1a72fcca58-835423c69ffso3336072b3a.1 for ; Thu, 21 May 2026 09:39:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1779381571; x=1779986371; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=nvqpFMFuzA1qxFgCYFe2rXCT+v/H7QYEEF/3u4IhSNY=; b=ADYlbLr3ahCUNS6bsWCvQFvohJlhImtgfVq+dN/uMQU/2ZUBbyMRFlvm8QmIjJvkiw kM9NJVtFJl2LxE1AawRvGRH5Gzcsfb/Q9F8sSr72W+IUXOij1/XFrhKpxXi562c5vew/ biF45kS/AvO/I8NMjWc1RZJY/AMoHWz6Kr9U8NPiaL7Q+HzZSl4m99JGxF+tiJkoCmmB KQjrXmxfVuvidhXzRY6iC/b/C3N1bjrtiRtI0HydTt9315WUWi3Ilq+1NAnLDmDXlKWs mcZuutdFHnWuYqP8UaHvdImSWaqsYWTA4mLeqrvOrb/iVrosOSEVZGSt6bIDCfaWL6ld Uahw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779381571; x=1779986371; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=nvqpFMFuzA1qxFgCYFe2rXCT+v/H7QYEEF/3u4IhSNY=; b=aJepwb1PL7FyLoH5l/awdd//DZ7hbBzLTF5ZCRPfYzvGDr7YDV8bhCzYhZw0NRkMG8 FxzhMTde7ZSsn7enNGxxWSlXNUaznbpDbJb9mGGeiqEuyxY2iuu7U0PlusRL6FmqJFkE WzIDWz4qZdBV+4TIx4/9Jap4QK4svE60qfwbjr7JdDzwol9QoD0YBCUAIehjU2DcuHAI LmuzrhoePJ/n+U8HhqXqRSn4PA/Cjq+bJ322rc0PHwq4/oXxG5qElYxT1pA9tZ731TjZ pp4fO+j1HDHYs3/dmzKDU4mA4iftLLXUOT+Ydo/SG3MShXN0xzQH0YzQeFLHYzdATYn4 cuZg== X-Forwarded-Encrypted: i=1; AFNElJ8l8JSmDRrG8jvnK4dtlumDl9F4rGVXB1dFXDeDndcB22XB6MAr+Hmv3w8NOZ47IIaAaS7q/TOMWqJqbMA=@vger.kernel.org X-Gm-Message-State: AOJu0Yy0ZvyBrr8Rw/V4cC4VYnxdalb6fidbuYY4rFCG9UBibXYuWp9p zHAd4Vjtgs6qgF3t8M5BUjfnNmmVfg9unxWxO39Dbj4i9kakIXdM4XWY+bKCjGRuYttKV3GUBp7 VUZpBTSYAyZjK2A== X-Received: from pfbjw10.prod.google.com ([2002:a05:6a00:928a:b0:82f:86c3:55ba]) (user=ankitkap job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:2d06:b0:82c:225e:63c5 with SMTP id d2e1a72fcca58-8415f349f4fmr37456b3a.18.1779381571246; Thu, 21 May 2026 09:39:31 -0700 (PDT) Date: Thu, 21 May 2026 16:39:25 +0000 In-Reply-To: <20260521163925.178264-1-ankitkap@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260521163925.178264-1-ankitkap@google.com> X-Mailer: git-send-email 2.54.0.669.g59709faab0-goog Message-ID: <20260521163925.178264-2-ankitkap@google.com> Subject: [PATCH 1/1] bcache: fix stale data race between read cache miss and bypass write From: Ankit Kapoor To: Coly Li , Kent Overstreet Cc: linux-bcache@vger.kernel.org, linux-kernel@vger.kernel.org, Ankit Kapoor Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" A race condition exists between a read cache miss and a bypass write due to either congestion or sequential bypass, that causes stale data to be cached when the read cache miss runs concurrently with a bypass write targeting the same sectors. If the read cache miss fetches data from the backing device before the write to the backing device, stale data populates the cache. The root cause is that bcache currently executes btree key invalidation in parallel with (or prior to) writing the actual data payload to the backing device. Under this sequence, a concurrent read path can register a cache miss and insert a placeholder key. If the write's btree key invalidation completes before the read finishes fetching old data from the backing device, the read's subsequent key replacement will not detect a collision, allowing stale data to persist in the cache. Fix this by deferring the btree key invalidation until after the backing device write completes successfully. Enforcing this sequential execution ensures that a stale read is always detected and invalidated. Signed-off-by: Ankit Kapoor --- drivers/md/bcache/request.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c index af345dc6fde1..ef2cf55df3bb 100644 --- a/drivers/md/bcache/request.c +++ b/drivers/md/bcache/request.c @@ -978,6 +978,14 @@ static CLOSURE_CALLBACK(cached_dev_write_complete) cached_dev_bio_complete(&cl->work); } =20 +static CLOSURE_CALLBACK(backing_device_bypass_write_complete) +{ + closure_type(s, struct search, cl); + + closure_call(&s->iop.cl, bch_data_insert, NULL, cl); + continue_at(cl, cached_dev_write_complete, NULL); +} + static void cached_dev_write(struct cached_dev *dc, struct search *s) { struct closure *cl =3D &s->cl; @@ -1058,6 +1066,11 @@ static void cached_dev_write(struct cached_dev *dc, = struct search *s) } =20 insert_data: + if (s->iop.bypass) { + continue_at(cl, backing_device_bypass_write_complete, NULL); + return; + } + closure_call(&s->iop.cl, bch_data_insert, NULL, cl); continue_at(cl, cached_dev_write_complete, NULL); } --=20 2.54.0.669.g59709faab0-goog