ext4: fix data races when using cached status extents

stable inclusion
from stable-v5.10.180
commit 4aa7f744fa3727818991802ac58331d188389b75
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8FC2O

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4aa7f744fa3727818991802ac58331d188389b75



--------------------------------

commit 492888df upstream.

When using cached extent stored in extent status tree in tree->cache_es
another process holding ei->i_es_lock for reading can be racing with us
setting new value of tree->cache_es. If the compiler would decide to
refetch tree->cache_es at an unfortunate moment, it could result in a
bogus in_range() check. Fix the possible race by using READ_ONCE() when
using tree->cache_es only under ei->i_es_lock for reading.

Cc: stable@kernel.org
Reported-by:  <syzbot+4a03518df1e31b537066@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/all/000000000000d3b33905fa0fd4a6@google.com


Suggested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20230504125524.10802-1-jack@suse.cz


Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: sanglipeng <sanglipeng1@jd.com>