From nobody Sat Sep 26 11:01:55 2026 Received: from canpmsgout04.his.huawei.com (canpmsgout04.his.huawei.com [113.46.200.219]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFE03363C43; Wed, 2 Sep 2026 07:47:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.219 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335245; cv=none; b=RBlkqi6ieXbRpCObBphVYNEYanjAOg6ly9JG9rXbKm4hYgZLIb7s20ecO1NUrbftG00v7D9og0Jragr9KdruYKBzVS9VtbYYKhoqclfiFMUrCLc8ghM0i0vSV0j6n9exzCUK3WDbnfA4xwrhVDpg6cCyUCDmsLUVLcTGP9squNs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335245; c=relaxed/simple; bh=2ExYMYQOFQQPwIyWmmjRnsN6d7J+Qq6kfNRhJ1FSOCA=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=QnLwb0n3NH4tNHW/Zi0frlDq7QzlGNYhfQaB4X22bZ9v98Bg3ydZI6sh6vgQP5ckZvkVxE8tSXS57nF6yO7WFOkg8cZDlk4QHMjW/tRcoDFDGLXqL+yAf7OBiuKlPgC0wTzrO9v3zcavMgCKJhSjbUGhpz/qwgAq0NwysassCCc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=QudGLxf2; arc=none smtp.client-ip=113.46.200.219 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="QudGLxf2" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=qoAjlya8M+d7R8ZbBFu376QlGU7wsKKm9VDsrz6PzLY=; b=QudGLxf2IG1POpNF4FFFGKzpzwPRL7qNIYEKL0+9CPKFxIxW33aq8Jn68fLZYj7bL/Md8ZiDc W5Xl4K1EEhYjoYTS9KPDYrZlYJWVFH6FO5HA2eWCMlIm6pD9G0keSgwEjFnxcb9Kjz6enEvDbDq 8hEA3ehvZox4Ef8AKLOz1pc= Received: from mail.maildlp.com (unknown [172.19.162.197]) by canpmsgout04.his.huawei.com (SkyGuard) with ESMTPS id 4hZZKh12Bqz1prLc; Wed, 2 Sep 2026 15:36:24 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id D23904057D; Wed, 2 Sep 2026 15:47:15 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 2 Sep 2026 15:47:14 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , CC: Subject: [PATCH v3 1/8] user_namespace: Use acquire/release for nr_extents synchronization Date: Wed, 2 Sep 2026 15:47:58 +0800 Message-ID: <20260902074805.398540-2-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260902074805.398540-1-ruanjinjie@huawei.com> References: <20260902074805.398540-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace smp_wmb()/smp_rmb() with smp_store_release()/smp_load_acquire() when publishing and consuming `nr_extents`. This expresses the publish/subscribe pattern more clearly and allows architectures with native acquire/release instructions (e.g. arm64's STLR/LDAR) to avoid the cost of full one-way barriers (DMB ISHST/ISHLD). No functional change intended. Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Cc: Seth Forshee Cc: Kees Cook Cc: Aleksa Sarai Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan Reviewed-by: Bradley Morgan --- v2: - Add missing load replace in copy_mnt_idmap() --- fs/mnt_idmapping.c | 5 ++--- kernel/user_namespace.c | 24 +++++++++++++----------- 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/fs/mnt_idmapping.c b/fs/mnt_idmapping.c index cb61fbdb52e9..612b266ab3da 100644 --- a/fs/mnt_idmapping.c +++ b/fs/mnt_idmapping.c @@ -219,10 +219,9 @@ EXPORT_SYMBOL_GPL(vfsgid_in_group_p); static int copy_mnt_idmap(struct uid_gid_map *map_from, struct uid_gid_map *map_to) { + /* Pairs with smp_store_release() in map_write(). */ + u32 nr_extents =3D smp_load_acquire(&map_from->nr_extents); struct uid_gid_extent *forward, *reverse; - u32 nr_extents =3D READ_ONCE(map_from->nr_extents); - /* Pairs with smp_wmb() when writing the idmapping. */ - smp_rmb(); =20 /* * Don't blindly copy @map_to into @map_from if nr_extents is diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 0bed462e9b2a..576b667a8813 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -317,9 +317,9 @@ map_id_range_down_base(unsigned extents, struct uid_gid= _map *map, u32 id, u32 co =20 static u32 map_id_range_down(struct uid_gid_map *map, u32 id, u32 count) { + /* Pairs with smp_store_release() in map_write(). */ + unsigned int extents =3D smp_load_acquire(&map->nr_extents); struct uid_gid_extent *extent; - unsigned extents =3D map->nr_extents; - smp_rmb(); =20 if (extents <=3D UID_GID_MAP_MAX_BASE_EXTENTS) extent =3D map_id_range_down_base(extents, map, id, count); @@ -383,9 +383,9 @@ map_id_range_up_max(unsigned extents, struct uid_gid_ma= p *map, u32 id, u32 count =20 u32 map_id_range_up(struct uid_gid_map *map, u32 id, u32 count) { + /* Pairs with smp_store_release() in map_write(). */ + unsigned int extents =3D smp_load_acquire(&map->nr_extents); struct uid_gid_extent *extent; - unsigned extents =3D map->nr_extents; - smp_rmb(); =20 if (extents <=3D UID_GID_MAP_MAX_BASE_EXTENTS) extent =3D map_id_range_up_base(extents, map, id, count); @@ -676,9 +676,9 @@ static int projid_m_show(struct seq_file *seq, void *v) static void *m_start(struct seq_file *seq, loff_t *ppos, struct uid_gid_map *map) { + /* Pairs with smp_store_release() in map_write(). */ + unsigned int extents =3D smp_load_acquire(&map->nr_extents); loff_t pos =3D *ppos; - unsigned extents =3D map->nr_extents; - smp_rmb(); =20 if (pos >=3D extents) return NULL; @@ -967,9 +967,11 @@ static ssize_t map_write(struct file *file, const char= __user *buf, * desired behavior is to see the values of the extents that * were written before the count of the extents. * - * To achieve this smp_wmb() is used on guarantee the write - * order and smp_rmb() is guaranteed that we don't have crazy - * architectures returning stale data. + * The nr_extents field is the publish point for the extent + * data. Writers use smp_store_release() to ensure all extent + * data is visible before nr_extents is updated. Readers use + * smp_load_acquire() to ensure they see a consistent view of + * the extent data when reading nr_extents. */ mutex_lock(&userns_state_mutex); =20 @@ -1098,8 +1100,8 @@ static ssize_t map_write(struct file *file, const cha= r __user *buf, map->forward =3D new_map.forward; map->reverse =3D new_map.reverse; } - smp_wmb(); - map->nr_extents =3D new_map.nr_extents; + /* Pairs with smp_load_acquire() in map_id_range_{up,down}() and m_start(= ). */ + smp_store_release(&map->nr_extents, new_map.nr_extents); =20 *ppos =3D count; ret =3D count; --=20 2.34.1 From nobody Sat Sep 26 11:01:55 2026 Received: from canpmsgout03.his.huawei.com (canpmsgout03.his.huawei.com [113.46.200.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7F1553E1201; Wed, 2 Sep 2026 07:47:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.218 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335247; cv=none; b=HPOxFoX6+mOUSUHBtCZxRCphCDGL+hmDbRQj8xECEKUS3xVied8mUxFlSoHxOV53aS9LMQja/T88bTS7srPOF9Z4cbRTI29s9mWzG5ssmTF6Stm7K8IJBPpPc2gzbXSr4Ij8Jbsq69u+y9Z+S0mJ65alo96hGb6H4jPJsGkaBHo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335247; c=relaxed/simple; bh=K7Gq5AUxlQXe5No7zoeHSsKZ3ssti34uiTOjY1Ps/no=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=jX2SF/GBaZ4bt1Tia1KNZrFfZcPNrqy+ecMWAV+HCbTLCH7DBgyQFoOa6LLTOxmhY0PrdF1NYdjGJ0momQjGgBXupfumKSUiO1hUMAsQ0raZLz6NKzy3uZ42nW9Ysa1jmoWNpKXjq+4p5ezY7JvBYzJ1XJh/lzX2QmavDq14Kms= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=SFCgOczG; arc=none smtp.client-ip=113.46.200.218 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="SFCgOczG" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=4SvDeO5hIzQzXgGr/cxbQ0Jb8d2NsgcdDWNHmf6UJlg=; b=SFCgOczGkgW7ko/Y6AyBOmgW04Do1Yczgae9MVa2hBLlI//yx0q8SiRjeMI/zITTc1wQzJfyz Vr5GUCNXmb9RGJMAhn5/pBaxOBcUTwNFSsW7mBjeakFp9WQLLKIevVOcv4C56V+IqI5wZ3JjmZN 6QoPmCaiCKQ0LvFErUobgGM= Received: from mail.maildlp.com (unknown [172.19.163.104]) by canpmsgout03.his.huawei.com (SkyGuard) with ESMTPS id 4hZZK834f5zpSvQ; Wed, 2 Sep 2026 15:35:56 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 1B88C4056E; Wed, 2 Sep 2026 15:47:17 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 2 Sep 2026 15:47:15 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , CC: Subject: [PATCH v3 2/8] lib/vsprintf: Use acquire/release for ptr_key publication Date: Wed, 2 Sep 2026 15:47:59 +0800 Message-ID: <20260902074805.398540-3-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260902074805.398540-1-ruanjinjie@huawei.com> References: <20260902074805.398540-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace the smp_wmb() + WRITE_ONCE() and READ_ONCE() + smp_rmb() barrier pair with smp_store_release()/smp_load_acquire() on filled_random_ptr_key. This expresses the publish/subscribe pattern more clearly and allows architectures with native acquire/release instructions (e.g. arm64's STLR/LDAR) to avoid the cost of full one-way barriers (DMB ISHST/ISHLD). No functional change intended. Cc: Petr Mladek Cc: Steven Rostedt Cc: Andy Shevchenko Cc: Rasmus Villemoes Cc: Sergey Senozhatsky Cc: Andrew Morton Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan Reviewed-by: Petr Mladek --- lib/vsprintf.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/lib/vsprintf.c b/lib/vsprintf.c index 1d95ab9314bf..90d0a724eadd 100644 --- a/lib/vsprintf.c +++ b/lib/vsprintf.c @@ -762,9 +762,8 @@ static int fill_ptr_key(struct notifier_block *nb, unsi= gned long action, void *d { get_random_bytes(&ptr_key, sizeof(ptr_key)); =20 - /* Pairs with smp_rmb() before reading ptr_key. */ - smp_wmb(); - WRITE_ONCE(filled_random_ptr_key, true); + /* Pairs with smp_load_acquire() before reading ptr_key. */ + smp_store_release(&filled_random_ptr_key, true); return NOTIFY_DONE; } =20 @@ -781,12 +780,10 @@ static inline int __ptr_to_hashval(const void *ptr, u= nsigned long *hashval_out) { unsigned long hashval; =20 - if (!READ_ONCE(filled_random_ptr_key)) + /* Pairs with smp_store_release() after writing ptr_key. */ + if (!smp_load_acquire(&filled_random_ptr_key)) return -EBUSY; =20 - /* Pairs with smp_wmb() after writing ptr_key. */ - smp_rmb(); - #ifdef CONFIG_64BIT hashval =3D (unsigned long)siphash_1u64((u64)ptr, &ptr_key); /* --=20 2.34.1 From nobody Sat Sep 26 11:01:55 2026 Received: from canpmsgout11.his.huawei.com (canpmsgout11.his.huawei.com [113.46.200.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF6B039DBC0; Wed, 2 Sep 2026 07:47:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.226 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335246; cv=none; b=Ug+JZHFHstFvKXyp3dQxVuLys19z0EI5Q/B1Xgup10qYL00Nr2Fkl76mBYYzW5+8gj5RIEp83buNqwNy2WWyGsE866QTFA1+8V+0/qHaOcf504JZbih1PnITg1jZ3CbjDE578HbUgNBaXcGubJ4nucYsbqIGLtTuUdRxTKbfMy8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335246; c=relaxed/simple; bh=5ktFPYfcS354H0E7w1/ipjmsCACpMiKd8AYObWDY1jA=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=IP0JeluwnGXInDddOjYLToQlECIQ6uUbdZWBGozlgROb9KsekTS1qa8HML0pOfx2AcbJTKhx92nC0ugh8EhZ3xkVpVoK60HuvQT1nSpW6PEuQj662xS8qbx1sBZoiEkQiTxumWRyJemXRQHCr9aecx1Td6NgG5yWB3P9vtf0CoA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=rd6Hz3E3; arc=none smtp.client-ip=113.46.200.226 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="rd6Hz3E3" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=ao1UDWuDYQRsk9bPKBFmaIKKn4znhhepOdHzIjS7dcs=; b=rd6Hz3E3kFFODcc4/kGIU6WQ3O/MF2UNzG8fGv3DfTk1xxbkr5JYxWMHti/CESfAv3QlowOiF KpxM7VUaBOOrPoiBFse4b4RNYjhXKbaL61GTXDs/kAXRoMmBSTF1OOw+4B8ofiUSWzJ9cBthC5e jq57PsmyzIUaJsuBshV91U0= Received: from mail.maildlp.com (unknown [172.19.163.214]) by canpmsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4hZZKh5zbvzKmB5; Wed, 2 Sep 2026 15:36:24 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 789C64056C; Wed, 2 Sep 2026 15:47:18 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 2 Sep 2026 15:47:17 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , CC: Subject: [PATCH v3 3/8] fs: aio: Use acquire/release for ring->tail publication Date: Wed, 2 Sep 2026 15:48:00 +0800 Message-ID: <20260902074805.398540-4-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260902074805.398540-1-ruanjinjie@huawei.com> References: <20260902074805.398540-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace the smp_wmb() + WRITE_ONCE(ring->tail) and READ_ONCE(ring->tail) + smp_rmb() barrier pair with smp_store_release()/smp_load_acquire() on `ring->tail`. This expresses the publish/subscribe pattern more clearly and allows architectures with native acquire/release instructions (e.g. arm64's STLR/LDAR) to avoid the cost of full one-way barriers (DMB ISHST/ISHLD). The release ensures event data written before updating ring->tail is visible to readers that observe the new tail value via acquire, which is exactly the ordering the barrier pair provided. No functional change intended. Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Cc: Benjamin LaHaise Reviewed-by: Jan Kara Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- fs/aio.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index d78acc69f487..a0279e059e97 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1206,13 +1206,12 @@ static void aio_complete(struct aio_kiocb *iocb) /* after flagging the request as done, we * must never even look at it again */ - smp_wmb(); /* make event visible before updating tail */ - ctx->tail =3D tail; =20 ring =3D folio_address(ctx->ring_folios[0]); head =3D ring->head; - ring->tail =3D tail; + /* Make event visible before updating tail */ + smp_store_release(&ring->tail, tail); flush_dcache_folio(ctx->ring_folios[0]); =20 ctx->completed_events++; @@ -1288,13 +1287,12 @@ static long aio_read_events_ring(struct kioctx *ctx, /* Access to ->ring_folios here is protected by ctx->ring_lock. */ ring =3D folio_address(ctx->ring_folios[0]); head =3D ring->head; - tail =3D ring->tail; - /* * Ensure that once we've read the current tail pointer, that * we also see the events that were stored up to the tail. + * Pairs with smp_store_release() in aio_complete(). */ - smp_rmb(); + tail =3D smp_load_acquire(&ring->tail); =20 pr_debug("h%u t%u m%u\n", head, tail, ctx->nr_events); =20 --=20 2.34.1 From nobody Sat Sep 26 11:01:55 2026 Received: from canpmsgout10.his.huawei.com (canpmsgout10.his.huawei.com [113.46.200.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E6F9320CBE; Wed, 2 Sep 2026 07:47:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.225 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335245; cv=none; b=O2vqImAzy+rVMkJlECt/I48x3eih3hRPE8bbAkW0OlPeiHM3yKyb5dVKR/KkoVbZG/tU1sGo+3du+7OwfZupUwsLt3c0xWhA+U0ap38b84Qk68i2tPcE1tNnKgZLFX1VpVxOsfKiCRTI46KOFbve/9ELRIOw6FzYJD5Q08XxhnM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335245; c=relaxed/simple; bh=o8FmgoYdsYjyVB+XJ0H6LCxj3FMwFt8UkvGX+Rj1CnA=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=dWJldVfjNNrvBJnvMeAaqJyyhreU94mSD3hBybmTRitddkyl4W4MDdFMl+53NSSLag9GfXEBWc4gocOy7fe/TxhLRAtMCRh6cayyDsgz0cfSrGdc88Zq748Mgcu6ov5SPE/cSigfx4EI7WD9VbrdsDpvwWKPb8PmQcuk8nas/ws= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=QPVIb2HG; arc=none smtp.client-ip=113.46.200.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="QPVIb2HG" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=wH2CfQ8NlJ9qjdgD8gOoz1HdGX4QF01Gpzjou8ScRYs=; b=QPVIb2HGkXjoGFUlheFPTaFl6nReY9Qp8svTUtzhUBF2/KR5IEjfDKNlMkgpqQw528JiX5MNH NseSbq5LHmz/b2fwSENyTgHpUwzro0zhrd/yXzJ37lLWPO6yAK43w8QDF0QRFnjTUarutjn9hxh z7R00Tr3pWkTXseMFYuRpEY= Received: from mail.maildlp.com (unknown [172.19.163.163]) by canpmsgout10.his.huawei.com (SkyGuard) with ESMTPS id 4hZZKn47vRz1K96b; Wed, 2 Sep 2026 15:36:29 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id AE8CF4057A; Wed, 2 Sep 2026 15:47:19 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 2 Sep 2026 15:47:18 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , CC: Subject: [PATCH v3 4/8] fs: Use acquire/release for fdtable resize synchronization Date: Wed, 2 Sep 2026 15:48:01 +0800 Message-ID: <20260902074805.398540-5-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260902074805.398540-1-ruanjinjie@huawei.com> References: <20260902074805.398540-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace the smp_wmb()/smp_rmb() barrier pair with smp_store_release()/smp_load_acquire() on `files->resize_in_progress`. The flag is the publish point for fdtable expansion: writers clear it via release after rcu_assign_pointer(), readers check it via acquire before rcu_dereference_sched(). Observing it clear guarantees the new fdt pointer is visible. This expresses the pattern more clearly and allows cheaper one-way barriers on weakly-ordered architectures (e.g. arm64 STLR/LDAR vs DMB ISHST/ISHLD). Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Reviewed-by: Jan Kara Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- fs/file.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/fs/file.c b/fs/file.c index 628ca07dc4b1..86c035d459f2 100644 --- a/fs/file.c +++ b/fs/file.c @@ -273,8 +273,6 @@ static int expand_fdtable(struct files_struct *files, u= nsigned int nr) rcu_assign_pointer(files->fdt, new_fdt); if (cur_fdt !=3D &files->fdtab) call_rcu(&cur_fdt->rcu, free_fdtable_rcu); - /* coupled with smp_rmb() in fd_install() */ - smp_wmb(); return 0; } =20 @@ -313,7 +311,8 @@ static int expand_files(struct files_struct *files, uns= igned int nr) /* All good, so we try */ files->resize_in_progress =3D true; error =3D expand_fdtable(files, nr); - files->resize_in_progress =3D false; + /* coupled with smp_load_acquire() in fd_install() */ + smp_store_release(&files->resize_in_progress, false); =20 wake_up_all(&files->resize_wait); return error; @@ -685,13 +684,12 @@ void fd_install(unsigned int fd, struct file *file) return; =20 rcu_read_lock_sched(); - if (unlikely(files->resize_in_progress)) { + /* coupled with smp_store_release() in expand_files() */ + if (unlikely(smp_load_acquire(&files->resize_in_progress))) { rcu_read_unlock_sched(); fd_install_slowpath(fd, file); return; } - /* coupled with smp_wmb() in expand_fdtable() */ - smp_rmb(); fdt =3D rcu_dereference_sched(files->fdt); VFS_BUG_ON(rcu_access_pointer(fdt->fd[fd]) !=3D NULL); rcu_assign_pointer(fdt->fd[fd], file); --=20 2.34.1 From nobody Sat Sep 26 11:01:55 2026 Received: from canpmsgout07.his.huawei.com (canpmsgout07.his.huawei.com [113.46.200.222]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 883873AFCEC; Wed, 2 Sep 2026 07:47:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.222 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335245; cv=none; b=RMhF02Kb97Z4AgimqxiOxva6FjAVSGa8ItlSAbaBxfhV/muK/jnCfjEwEip4HbFOYbEAZ6hh5Z/HOqektpm9eBA5YoKsMmvXX4v4mN04zB4dmU6t4s0Y2X28Ecc19xH+QsfUNu+17zGYyQU1DBkZPnOctHZp5AWtQptownfUz9g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335245; c=relaxed/simple; bh=6PIg64GDnvklPC0UJj5Fh9eYgMI0rQUBw8ZYe1++kd8=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=qYsvwwplfJM0R7p1IGz+ZM926r5YiIavGVrYRhzPb/y4OLwhwuDfVUgw1rDSsBmE0ZqH1ES2Yo0Vtl0VSMfxlcAs2MYXhzmDwmKL+KOg0bdgiD+HDge2nqho90/il0rsS99905B7DQ8u+b8Bhf26x8FHEl+69doxm7F/sfUTiek= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=c9mLb8sr; arc=none smtp.client-ip=113.46.200.222 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="c9mLb8sr" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=J4yJnyqxeHRcmq2Fv8EZ0jwzeTlaVGzNrqh5hfCP6Nw=; b=c9mLb8srEPPPQLn8yQD0c0BDviwcWNS55C5KXhKc4Lr6mNPUZ/QWJP9W/S2+92FK4d3gHgR/6 obYTqC6R8LtPGNDKBwX3FscPqdzkyNC5H6hczFGuWxwrAZrZMKArEzgEpCM04d+2arVNeGGvtZ7 9YQTydYIvXdK+e7T86kwZ34= Received: from mail.maildlp.com (unknown [172.19.163.127]) by canpmsgout07.his.huawei.com (SkyGuard) with ESMTPS id 4hZZKp7268zLlXF; Wed, 2 Sep 2026 15:36:30 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id EBD04402AB; Wed, 2 Sep 2026 15:47:20 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 2 Sep 2026 15:47:19 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , CC: Subject: [PATCH v3 5/8] pidfs: Use test_bit_acquire() for attr flag tests Date: Wed, 2 Sep 2026 15:48:02 +0800 Message-ID: <20260902074805.398540-6-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260902074805.398540-1-ruanjinjie@huawei.com> References: <20260902074805.398540-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" Replace test_bit() + smp_rmb() with test_bit_acquire() for PIDFS_ATTR_BIT_EXIT and PIDFS_ATTR_BIT_COREDUMP tests in pidfd_info(). The acquire semantics ensure that if the flag is observed set, the associated attr fields written before smp_wmb() + set_bit() are also visible. Writers keep smp_wmb() + set_bit() since no release bitop exists. Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Assisted-by: DeepSeek:DeepSeek-V3 Signed-off-by: Jinjie Ruan --- fs/pidfs.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/pidfs.c b/fs/pidfs.c index a6a643f15d08..2cd0fab73180 100644 --- a/fs/pidfs.c +++ b/fs/pidfs.c @@ -393,8 +393,7 @@ static long pidfd_info(struct file *file, unsigned int = cmd, unsigned long arg) =20 attr =3D READ_ONCE(pid->attr); if (mask & PIDFD_INFO_EXIT) { - if (test_bit(PIDFS_ATTR_BIT_EXIT, &attr->attr_mask)) { - smp_rmb(); + if (test_bit_acquire(PIDFS_ATTR_BIT_EXIT, &attr->attr_mask)) { kinfo.mask |=3D PIDFD_INFO_EXIT; #ifdef CONFIG_CGROUPS kinfo.cgroupid =3D attr->cgroupid; @@ -405,8 +404,7 @@ static long pidfd_info(struct file *file, unsigned int = cmd, unsigned long arg) } =20 if (mask & PIDFD_INFO_COREDUMP) { - if (test_bit(PIDFS_ATTR_BIT_COREDUMP, &attr->attr_mask)) { - smp_rmb(); + if (test_bit_acquire(PIDFS_ATTR_BIT_COREDUMP, &attr->attr_mask)) { kinfo.mask |=3D PIDFD_INFO_COREDUMP | PIDFD_INFO_COREDUMP_SIGNAL | PIDF= D_INFO_COREDUMP_CODE; kinfo.coredump_mask =3D attr->coredump_mask; kinfo.coredump_signal =3D attr->coredump_signal; --=20 2.34.1 From nobody Sat Sep 26 11:01:55 2026 Received: from canpmsgout03.his.huawei.com (canpmsgout03.his.huawei.com [113.46.200.218]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 88C563E1D05; Wed, 2 Sep 2026 07:47:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.218 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335247; cv=none; b=agLFPmHOhHlj2V6WwdNQ4BuoTfQ6INpL7HvtCZ+tNip9h6l/6UgU4CTOTcQs6Nn+YIXdsIsw+atW8w1JJRPISIeZtWFhdFh44djASxxMFypd45kffyIYRImO+DyTKzZUlAuCobhDUIwfNuWY5gY0DS+Rdff4YFt8boU3B9wIZ88= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335247; c=relaxed/simple; bh=rM/tXGbf1aCcjq5KxywPtk0vBUXFIx2mFpz196P6YbQ=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=lbCjl4KKCH6adeiFDpmSW2eVDakBxQqd3I+O/BJIFgf2lY/XfTnzNyh6ZhCOVl+MdLKJ3LjBDsb4FaavMO0fpJl+VTC/BLebag7OTLXfkxOIewvBGYjBC7nF53x1kkzhQp/OmUPKT1s4VGt+TRq51hoZqnm5B9AgPgrGIDgAYPU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=NOgSQT1d; arc=none smtp.client-ip=113.46.200.218 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="NOgSQT1d" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=Xr9BLFJfOVdKkYTXuHA//41f3O6Yyk2q7ziikLqqqXw=; b=NOgSQT1dlqJaQi9vrvjYnOEf8vsKWa97ntxZrTZMRxiKx0d/nYt5xLqPcABA9lWZ31g/7l5Y1 +AfGvHDdfxbE8Fgiw6r/ppCN3i8sshYU034KTWamrxz3cwwcpKeTXatkjTKwHhVVwkOK/Im0sjX vRXMeKBUnArlIhi7y1g3vL8= Received: from mail.maildlp.com (unknown [172.19.163.0]) by canpmsgout03.his.huawei.com (SkyGuard) with ESMTPS id 4hZZKF42mzzpSvd; Wed, 2 Sep 2026 15:36:01 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 38E5940561; Wed, 2 Sep 2026 15:47:22 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 2 Sep 2026 15:47:20 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , CC: Subject: [PATCH v3 6/8] super: Use acquire for SB_BORN check in super_cache_count() Date: Wed, 2 Sep 2026 15:48:03 +0800 Message-ID: <20260902074805.398540-7-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260902074805.398540-1-ruanjinjie@huawei.com> References: <20260902074805.398540-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" The active SB_BORN check in super_cache_count() pairs with the smp_store_release() in super_wake() when publishing a newly initialized superblock. Replace the historical independent smp_rmb() barrier with an acquire load on sb->s_flags via super_flags(). This expresses the publish-subscribe pattern more clearly and allows weakly-ordered architectures like arm64 to utilize efficient native instructions (e.g., LDAR) instead of a full one-way barrier. Also remove the outdated memory barrier comment in super_cache_count(), as the underlying super_flags() implementation already self-documents the matched smp_store_release() in super_wake(). Cc: Alexander Viro Cc: Christian Brauner Cc: Jan Kara Assisted-by: Gemini:Gemini-3.1 Assisted-by: DeepSeek:DeepSeek-V3 Reviewed-by: Jan Kara Signed-off-by: Jinjie Ruan --- fs/super.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/super.c b/fs/super.c index 05e443173038..caa6189e4057 100644 --- a/fs/super.c +++ b/fs/super.c @@ -267,12 +267,10 @@ static unsigned long super_cache_count(struct shrinke= r *shrink, * However, if we are currently mounting the superblock, the underlying * filesystem might be in a state of partial construction and hence it * is dangerous to access it. super_trylock_shared() uses a SB_BORN check - * to avoid this situation, so do the same here. The memory barrier is - * matched with the one in mount_fs() as we don't hold locks here. + * to avoid this situation, so do the same here. */ - if (!(sb->s_flags & SB_BORN)) + if (!super_flags(sb, SB_BORN)) return 0; - smp_rmb(); =20 if (sb->s_op && sb->s_op->nr_cached_objects && super_fs_objects_eligible(sc)) --=20 2.34.1 From nobody Sat Sep 26 11:01:55 2026 Received: from canpmsgout08.his.huawei.com (canpmsgout08.his.huawei.com [113.46.200.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7BDE13EB802; Wed, 2 Sep 2026 07:47:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.223 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335253; cv=none; b=roAiZs7dOOxeNyw6kYJfmLucVaxpImoxhMdrThJMnN56aQt3c9xoG4iVldarH8LJx+KnXAnB9nl5XYOjZftW90vrAVd2NztPq0nsmNO5SxBlnzHzyJU4pt4GdCnCFS2rYEWM7DXMYLMh4D1KNs9AuX73XvivENwR+QxvsApNhXI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335253; c=relaxed/simple; bh=pr8WYR44iKCxKBl4J9dalj2VKHZhweH74fIWZSRuaTg=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=SNE6wKM8IbMTwxefLba1VYrNtgEv8As5AlBEmaeYbI1HbOjzKnNfrLAW3ZL9KOHoMmbK/7GXNfgieS4jcgX0wGpUmZQshNrfp7hgc9MZxwIjupHwoZWUCla6JPDpw8t/8o6gD6gOYTQWMr4NAXQI3Xu01vJqKOvT0v36EkoF54I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=4W7L8+ru; arc=none smtp.client-ip=113.46.200.223 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="4W7L8+ru" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=Iz5MYVXCtGLbTQgpICYK+HoBlz0f/WG3AORXFegzuUU=; b=4W7L8+ruHXC9nGqv3nMwB57tXKGaky+xpzhxYsNGkZ4cP5xbDWWe35JEBTMqZKiybwsZZHpCf H0HhRoNDRW/6WEPqU4KbeOZ7r/n7rXbuDkaIquGOqPPunkejZkMu/fRTAE7/87lbkC7768wXSGy q/dnTls+drI7e6ztdPwQUQo= Received: from mail.maildlp.com (unknown [172.19.163.127]) by canpmsgout08.his.huawei.com (SkyGuard) with ESMTPS id 4hZZKs2h2kzmVY2; Wed, 2 Sep 2026 15:36:33 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id 7E57140573; Wed, 2 Sep 2026 15:47:23 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 2 Sep 2026 15:47:22 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , CC: Subject: [PATCH v3 7/8] ext4: Fix out-of-bounds read in ext4_get_group_info() Date: Wed, 2 Sep 2026 15:48:04 +0800 Message-ID: <20260902074805.398540-8-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260902074805.398540-1-ruanjinjie@huawei.com> References: <20260902074805.398540-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" A plain read of s_groups_count in ext4_get_group_info() allows CPU load-load reordering. On weak memory models, speculative prefetch of s_group_info prior to the boundary check could lead to an out-of-bounds read if a concurrent online resize expands the array and increments s_groups_count. The data race occurs between the ioctl configuration path (holding the resize lock via ext4_resize_begin) and the lockless metadata lookup path: CPU 0 (Writer, Resize Lock) CPU 1 (Reader, Lockless) --------------------------- ------------------------ ext4_ioctl() [EXT4_IOC_GROUP_ADD] ext4_ioctl_group_add() ext4_resize_begin() // Takes lock ext4_group_add() ext4_mb_alloc_groupinfo() // Publishes expanded array via RCU rcu_assign_pointer(s_group_info, ...) ext4_flex_group_add() ext4_update_super() ext4_get_group_info() // Speculative / out-of-ord= er read [Loads old/smaller s_group_= info pointer] [Plain C store / smp_wmb()] sbi->s_groups_count +=3D ...; // Reads new s_groups_count, // boundary check passes if (group >=3D s_groups_cou= nt) // Out-of-bounds array acce= ss! sbi_array_rcu_deref(..., s_= group_info) Fix this by using ext4_get_groups_count() to enforce acquire semantics. Cc: stable@vger.kernel.org Cc: "Theodore Ts'o" Cc: Andreas Dilger Cc: Baokun Li Cc: Jan Kara Cc: Ojaswin Mujoo Cc: "Ritesh Harjani (IBM)" Cc: Zhang Yi Fixes: 5354b2af3406 ("ext4: allow ext4_get_group_info() to fail") Link: https://sashiko.dev/#/patchset/20260825095422.3166067-1-ruanjinjie%40= huawei.com Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Jinjie Ruan --- fs/ext4/balloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c index 52f4c5169f91..778fe8788f06 100644 --- a/fs/ext4/balloc.c +++ b/fs/ext4/balloc.c @@ -329,7 +329,7 @@ struct ext4_group_info *ext4_get_group_info(struct supe= r_block *sb, struct ext4_group_info **grp_info; long indexv, indexh; =20 - if (unlikely(group >=3D EXT4_SB(sb)->s_groups_count)) + if (unlikely(group >=3D ext4_get_groups_count(sb))) return NULL; if (unlikely(!EXT4_SB(sb)->s_group_info)) return NULL; --=20 2.34.1 From nobody Sat Sep 26 11:01:55 2026 Received: from canpmsgout10.his.huawei.com (canpmsgout10.his.huawei.com [113.46.200.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3712D3EC6A9; Wed, 2 Sep 2026 07:47:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.225 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335254; cv=none; b=jqcENuwHbEDj3gC0JoiPi3pglF648nEABSBwwYlGRpfsF4yBUH/1BSXYnecGR00rgBzIgY9rIMCDdQhQMo0X3xOn69C9cInIuT7NkclXymnBJIcATrWkUb+7Aw13ikdrFREPizsLZy8/r232nuMHOJvxFEOZIS2ytLAHVv09iKo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788335254; c=relaxed/simple; bh=pADLIDDDAa+lhGsyTlXoetDrztywb5yDxiTzspAGBzY=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=NQ2RA4NCY5acdIbLIwaxICjwjxYRXuqSg46JJ3OX8NOWaJQ8jTle5b919tDw9s3ivvOM7NFAS84QLtTlfi/XyxfFQkihRDjKPXaZbRPJviP3HBZ7XO5c4/x/U4uoRx1OsQQbWiic5h8uu1klGYFr+VGIVZHnb14+t4MyRoVKKAc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=53B12CPQ; arc=none smtp.client-ip=113.46.200.225 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="53B12CPQ" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=iH00vTqUXFP44+YZhDZSDGKnnR3KFEyl0IM9Pe/tVLE=; b=53B12CPQYRWRKa5gqDtuoUGWsm1oHSiifC4JGWdfAVl4rFPT2lC1C0tVRMzhXLCkAVhJH2+wL 01JI5nBn1I2mufrWDunC94QgP8Zwwx1EfEbULJWhS5IHjrKwyDrZmfXytMBUaRH5oFHElaByvZn DfK1Pf8R89hd2mIFe1ETWuQ= Received: from mail.maildlp.com (unknown [172.19.163.15]) by canpmsgout10.his.huawei.com (SkyGuard) with ESMTPS id 4hZZKt4Trlz1K96b; Wed, 2 Sep 2026 15:36:34 +0800 (CST) Received: from dggpemf500011.china.huawei.com (unknown [7.185.36.131]) by mail.maildlp.com (Postfix) with ESMTPS id BA6F940586; Wed, 2 Sep 2026 15:47:24 +0800 (CST) Received: from huawei.com (10.90.53.73) by dggpemf500011.china.huawei.com (7.185.36.131) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Wed, 2 Sep 2026 15:47:23 +0800 From: Jinjie Ruan To: , , , , , , , , , , , , , , , , , , , , , , CC: Subject: [PATCH v3 8/8] ext4: Convert group-count barrier protocol to acquire/release Date: Wed, 2 Sep 2026 15:48:05 +0800 Message-ID: <20260902074805.398540-9-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260902074805.398540-1-ruanjinjie@huawei.com> References: <20260902074805.398540-1-ruanjinjie@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemf500011.china.huawei.com (7.185.36.131) Content-Type: text/plain; charset="utf-8" During an online resize, reading s_groups_count and s_blockfile_groups requires strict ordering against subsequent initialized block group metadata. Replace the historical smp_wmb()/smp_rmb() pairs with smp_store_release() and smp_load_acquire(). This formalizes the publish-subscribe pattern and allows weakly-ordered architectures (e.g., arm64) to utilize native STLR/LDAR instructions instead of full DMB fences. Update the documentation in resize.c and ext4.h accordingly. Cc: "Theodore Ts'o" Cc: Andreas Dilger Cc: Baokun Li Cc: Jan Kara Cc: Ojaswin Mujoo Cc: "Ritesh Harjani (IBM)" Cc: Zhang Yi Assisted-by: Gemini:Gemini-3.1 Assisted-by: DeepSeek:DeepSeek-V3 Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Signed-off-by: Jinjie Ruan --- fs/ext4/ext4.h | 10 +++------- fs/ext4/mballoc.c | 6 ++---- fs/ext4/resize.c | 19 +++++++++++-------- 3 files changed, 16 insertions(+), 19 deletions(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index 724a27e8be61..d70b9cb09155 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -3542,16 +3542,12 @@ static inline void ext4_isize_set(struct ext4_inode= *raw_inode, loff_t i_size) } =20 /* - * Reading s_groups_count requires using smp_rmb() afterwards. See - * the locking protocol documented in the comments of ext4_group_add() - * in resize.c + * Reading s_groups_count uses acquire semantics. */ static inline ext4_group_t ext4_get_groups_count(struct super_block *sb) { - ext4_group_t ngroups =3D EXT4_SB(sb)->s_groups_count; - - smp_rmb(); - return ngroups; + /* Pairs with smp_store_release() in ext4_update_super() */ + return smp_load_acquire(&EXT4_SB(sb)->s_groups_count); } =20 static inline ext4_group_t ext4_flex_group(struct ext4_sb_info *sbi, diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 06171a11db12..a15285224cdf 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -899,10 +899,8 @@ static ext4_group_t ext4_get_allocation_groups_count( =20 /* non-extent files are limited to low blocks/groups */ if (!(ext4_test_inode_flag(ac->ac_inode, EXT4_INODE_EXTENTS))) - ngroups =3D EXT4_SB(ac->ac_sb)->s_blockfile_groups; - - /* Pairs with smp_wmb() in ext4_update_super() */ - smp_rmb(); + /* Pairs with smp_store_release() in ext4_update_super() */ + ngroups =3D smp_load_acquire(&EXT4_SB(ac->ac_sb)->s_blockfile_groups); =20 return ngroups; } diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 2c5b851c552a..5e3ad8393cf8 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1462,11 +1462,11 @@ static void ext4_update_super(struct super_block *s= b, * * The precise rules we use are: * - * * Writers must perform a smp_wmb() after updating all - * dependent data and before modifying the groups count + * * Writers must use a release store when updating the groups count + * after all dependent data has been updated * - * * Readers must perform an smp_rmb() after reading the groups - * count and before reading any dependent data. + * * Readers must use an acquire load when reading the groups + * count before reading any dependent data. * * NB. These rules can be relaxed when checking the group count * while freeing data, as we can only allocate from a block @@ -1474,12 +1474,15 @@ static void ext4_update_super(struct super_block *s= b, * only then free after serialising in turn against that * allocation. */ - smp_wmb(); =20 /* Update the global fs size fields */ - sbi->s_groups_count +=3D flex_gd->count; - sbi->s_blockfile_groups =3D min(sbi->s_groups_count, - (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); + /* Pairs with smp_load_acquire() in ext4_get_groups_count() */ + smp_store_release(&sbi->s_groups_count, + sbi->s_groups_count + flex_gd->count); + /* Pairs with smp_load_acquire() in ext4_get_allocation_groups_count() */ + smp_store_release(&sbi->s_blockfile_groups, + min(sbi->s_groups_count, + (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)))); =20 /* Update the reserved block counts only once the new group is * active. */ --=20 2.34.1