search

rcore-os / rcore-fs

The file system module for rCore OS.
MIT License
49 stars 24 forks source link

rcore-fs-sfs: possible deadlock bugs #18

Open BurtonQin opened 4 years ago

BurtonQin commented 4 years ago

There are two kinds of possible deadlock bugs in rcore-fs/rcore-fs-sfs/src/lib.rs:

  1. Double-Lock: https://github.com/rcore-os/rcore-fs/blob/1fb7c0ee2eedb37516344e93c271c3e6795f9a89/rcore-fs-sfs/src/lib.rs#L394-L397 The first lock self.disk_inode.write() is on L394. fn _resize is called on L396. The read and write locks of self.disk_inode are heavily used in fn _resize and its callees. fn _write_at is called L397, which calls fn _io_at on L352. The second lock is on L324 in fn _io_at. https://github.com/rcore-os/rcore-fs/blob/1fb7c0ee2eedb37516344e93c271c3e6795f9a89/rcore-fs-sfs/src/lib.rs#L351-L352 https://github.com/rcore-os/rcore-fs/blob/1fb7c0ee2eedb37516344e93c271c3e6795f9a89/rcore-fs-sfs/src/lib.rs#L324 A simple drop(disk_inode) before L396 may fix the bugs. But we need to be careful about possible atomicity violations.

  2. Locks in conflicting orders: self.super_block.write() is called before self.free_map.write() in fn sync. https://github.com/rcore-os/rcore-fs/blob/1fb7c0ee2eedb37516344e93c271c3e6795f9a89/rcore-fs-sfs/src/lib.rs#L944-L951 self.super_block.write() is called after self.free_map.write() in fn alloc_block and fn free_block. https://github.com/rcore-os/rcore-fs/blob/1fb7c0ee2eedb37516344e93c271c3e6795f9a89/rcore-fs-sfs/src/lib.rs#L841-L845 https://github.com/rcore-os/rcore-fs/blob/1fb7c0ee2eedb37516344e93c271c3e6795f9a89/rcore-fs-sfs/src/lib.rs#L859-L863 A possible fix is to move self.free_map.write() before self.super_block.write() in fn sync.

jiegec commented 4 years ago

Yes, we didn't carefully handle locks.