History

Merge tag 'xfs-4.20-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Darrick Wong: "Dave and I have continued our work fixing corruption problems that can be found when running long-term burn-in exercisers on xfs. Here are some patches fixing most of the problems, but there will likely be more. :/ - Numerous corruption fixes for copy on write - Numerous corruption fixes for blocksize < pagesize writes - Don't miscalculate AG reservations for small final AGs - Fix page cache truncation to work properly for reflink and extent shifting - Fix use-after-free when retrying failed inode/dquot buffer logging - Fix corruptions seen when using copy_file_range in directio mode" * tag 'xfs-4.20-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: readpages doesn't zero page tail beyond EOF vfs: vfs_dedupe_file_range() doesn't return EOPNOTSUPP iomap: dio data corruption and spurious errors when pipes fill iomap: sub-block dio needs to zeroout beyond EOF iomap: FUA is wrong for DIO O_DSYNC writes into unwritten extents xfs: delalloc -> unwritten COW fork allocation can go wrong xfs: flush removing page cache in xfs_reflink_remap_prep xfs: extent shifting doesn't fully invalidate page cache xfs: finobt AG reserves don't consider last AG can be a runt xfs: fix transient reference count error in xfs_buf_resubmit_failed_buffers xfs: uncached buffer tracing needs to print bno xfs: make xfs_file_remap_range() static xfs: fix shared extent data corruption due to missing cow reservation

Linus Torvalds committed 7 years ago

Commit abe72ff2 parents 7c98a42 8c110d410 files · +104 −46Browse files

Unified · Split

10 files
  1. fs/iomap.c +41 −12
  2. fs/read_write.c +7 −8
  3. fs/xfs/libxfs/xfs_bmap.c +4 −1
  4. fs/xfs/libxfs/xfs_ialloc_btree.c +7 −4
  5. fs/xfs/xfs_bmap_util.c +2 −8
  6. fs/xfs/xfs_bmap_util.h +3 −0
  7. fs/xfs/xfs_buf_item.c +21 −7
  8. fs/xfs/xfs_file.c +1 −1
  9. fs/xfs/xfs_reflink.c +14 −4
  10. fs/xfs/xfs_trace.h +4 −1
fs/iomap.c+41−12
@@ -142,13 +142,14 @@ static void · 141 unmodified lines
142142 iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
143143 loff_t *pos, loff_t length, unsigned *offp, unsigned *lenp)
144144 {
145+ loff_t orig_pos = *pos;
146+ loff_t isize = i_size_read(inode);
145147 unsigned block_bits = inode->i_blkbits;
146148 unsigned block_size = (1 << block_bits);
147149 unsigned poff = offset_in_page(*pos);
148150 unsigned plen = min_t(loff_t, PAGE_SIZE - poff, length);
149151 unsigned first = poff >> block_bits;
150152 unsigned last = (poff + plen - 1) >> block_bits;
151− unsigned end = offset_in_page(i_size_read(inode)) >> block_bits;
152153
153154 /*
154155 * If the block size is smaller than the page size we need to check the
@@ -183,8 +184,12 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, · 28 unmodified lines
183184 * handle both halves separately so that we properly zero data in the
184185 * page cache for blocks that are entirely outside of i_size.
185186 */
186− if (first <= end && last > end)
187− plen -= (last - end) * block_size;
187+ if (orig_pos <= isize && orig_pos + length > isize) {
188+ unsigned end = offset_in_page(isize - 1) >> block_bits;
189+
190+ if (first <= end && last > end)
191+ plen -= (last - end) * block_size;
192+ }
188193
189194 *offp = poff;
190195 *lenp = plen;
@@ -1580,7 +1585,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, · 1389 unmodified lines
15801585 struct bio *bio;
15811586 bool need_zeroout = false;
15821587 bool use_fua = false;
1583− int nr_pages, ret;
1588+ int nr_pages, ret = 0;
15841589 size_t copied = 0;
15851590
15861591 if ((pos | length | align) & ((1 << blkbits) - 1))
@@ -1596,12 +1601,13 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, · 9 unmodified lines
15961601
15971602 if (iomap->flags & IOMAP_F_NEW) {
15981603 need_zeroout = true;
1599− } else {
1604+ } else if (iomap->type == IOMAP_MAPPED) {
16001605 /*
1601− * Use a FUA write if we need datasync semantics, this
1602− * is a pure data IO that doesn't require any metadata
1603− * updates and the underlying device supports FUA. This
1604− * allows us to avoid cache flushes on IO completion.
1606+ * Use a FUA write if we need datasync semantics, this is a pure
1607+ * data IO that doesn't require any metadata updates (including
1608+ * after IO completion such as unwritten extent conversion) and
1609+ * the underlying device supports FUA. This allows us to avoid
1610+ * cache flushes on IO completion.
16051611 */
16061612 if (!(iomap->flags & (IOMAP_F_SHARED|IOMAP_F_DIRTY)) &&
16071613 (dio->flags & IOMAP_DIO_WRITE_FUA) &&
@@ -1644,8 +1650,14 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, · 36 unmodified lines
16441650
16451651 ret = bio_iov_iter_get_pages(bio, &iter);
16461652 if (unlikely(ret)) {
1653+ /*
1654+ * We have to stop part way through an IO. We must fall
1655+ * through to the sub-block tail zeroing here, otherwise
1656+ * this short IO may expose stale data in the tail of
1657+ * the block we haven't written data to.
1658+ */
16471659 bio_put(bio);
1648− return copied ? copied : ret;
1660+ goto zero_tail;
16491661 }
16501662
16511663 n = bio->bi_iter.bi_size;
@@ -1676,13 +1688,21 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, · 24 unmodified lines
16761688 dio->submit.cookie = submit_bio(bio);
16771689 } while (nr_pages);
16781690
1679− if (need_zeroout) {
1691+ /*
1692+ * We need to zeroout the tail of a sub-block write if the extent type
1693+ * requires zeroing or the write extends beyond EOF. If we don't zero
1694+ * the block tail in the latter case, we can expose stale data via mmap
1695+ * reads of the EOF block.
1696+ */
1697+zero_tail:
1698+ if (need_zeroout ||
1699+ ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) {
16801700 /* zero out from the end of the write to the end of the block */
16811701 pad = pos & (fs_block_size - 1);
16821702 if (pad)
16831703 iomap_dio_zero(dio, iomap, pos, fs_block_size - pad);
16841704 }
1685− return copied;
1705+ return copied ? copied : ret;
16861706 }
16871707
16881708 static loff_t
@@ -1857,6 +1877,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, · 168 unmodified lines
18571877 dio->wait_for_completion = true;
18581878 ret = 0;
18591879 }
1880+
1881+ /*
1882+ * Splicing to pipes can fail on a full pipe. We have to
1883+ * swallow this to make it look like a short IO
1884+ * otherwise the higher splice layers will completely
1885+ * mishandle the error and stop moving data.
1886+ */
1887+ if (ret == -EFAULT)
1888+ ret = 0;
18601889 break;
18611890 }
18621891 pos += ret;
fs/read_write.c+7−8
@@ -2094,17 +2094,18 @@ int vfs_dedupe_file_range(struct file *file, struct file_dedupe_range *same) · 2093 unmodified lines
20942094 off = same->src_offset;
20952095 len = same->src_length;
20962096
2097− ret = -EISDIR;
20982097 if (S_ISDIR(src->i_mode))
2099− goto out;
2098+ return -EISDIR;
21002099
2101− ret = -EINVAL;
21022100 if (!S_ISREG(src->i_mode))
2103− goto out;
2101+ return -EINVAL;
2102+
2103+ if (!file->f_op->remap_file_range)
2104+ return -EOPNOTSUPP;
21042105
21052106 ret = remap_verify_area(file, off, len, false);
21062107 if (ret < 0)
2107− goto out;
2108+ return ret;
21082109 ret = 0;
21092110
21102111 if (off + len > i_size_read(src))
@@ -2147,10 +2148,8 @@ next_fdput: · 36 unmodified lines
21472148 fdput(dst_fd);
21482149 next_loop:
21492150 if (fatal_signal_pending(current))
2150− goto out;
2151+ break;
21512152 }
2152−
2153−out:
21542153 return ret;
21552154 }
21562155 EXPORT_SYMBOL(vfs_dedupe_file_range);
fs/xfs/libxfs/xfs_bmap.c+4−1
@@ -1694,10 +1694,13 @@ xfs_bmap_add_extent_delay_real( · 1693 unmodified lines
16941694 case BMAP_LEFT_FILLING | BMAP_RIGHT_FILLING | BMAP_RIGHT_CONTIG:
16951695 /*
16961696 * Filling in all of a previously delayed allocation extent.
1697− * The right neighbor is contiguous, the left is not.
1697+ * The right neighbor is contiguous, the left is not. Take care
1698+ * with delay -> unwritten extent allocation here because the
1699+ * delalloc record we are overwriting is always written.
16981700 */
16991701 PREV.br_startblock = new->br_startblock;
17001702 PREV.br_blockcount += RIGHT.br_blockcount;
1703+ PREV.br_state = new->br_state;
17011704
17021705 xfs_iext_next(ifp, &bma->icur);
17031706 xfs_iext_remove(bma->ip, &bma->icur, state);
fs/xfs/libxfs/xfs_ialloc_btree.c+7−4
@@ -538,15 +538,18 @@ xfs_inobt_rec_check_count( · 537 unmodified lines
538538
539539 static xfs_extlen_t
540540 xfs_inobt_max_size(
541− struct xfs_mount *mp)
541+ struct xfs_mount *mp,
542+ xfs_agnumber_t agno)
542543 {
544+ xfs_agblock_t agblocks = xfs_ag_block_count(mp, agno);
545+
543546 /* Bail out if we're uninitialized, which can happen in mkfs. */
544547 if (mp->m_inobt_mxr[0] == 0)
545548 return 0;
546549
547550 return xfs_btree_calc_size(mp->m_inobt_mnr,
548− (uint64_t)mp->m_sb.sb_agblocks * mp->m_sb.sb_inopblock /
549− XFS_INODES_PER_CHUNK);
551+ (uint64_t)agblocks * mp->m_sb.sb_inopblock /
552+ XFS_INODES_PER_CHUNK);
550553 }
551554
552555 static int
@@ -594,7 +597,7 @@ xfs_finobt_calc_reserves( · 41 unmodified lines
594597 if (error)
595598 return error;
596599
597− *ask += xfs_inobt_max_size(mp);
600+ *ask += xfs_inobt_max_size(mp, agno);
598601 *used += tree_len;
599602 return 0;
600603 }
fs/xfs/xfs_bmap_util.c+2−8
@@ -1042,7 +1042,7 @@ out_trans_cancel: · 1041 unmodified lines
10421042 goto out_unlock;
10431043 }
10441044
1045−static int
1045+int
10461046 xfs_flush_unmap_range(
10471047 struct xfs_inode *ip,
10481048 xfs_off_t offset,
@@ -1195,13 +1195,7 @@ xfs_prepare_shift( · 146 unmodified lines
11951195 * Writeback and invalidate cache for the remainder of the file as we're
11961196 * about to shift down every extent from offset to EOF.
11971197 */
1198− error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping, offset, -1);
1199− if (error)
1200− return error;
1201− error = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
1202− offset >> PAGE_SHIFT, -1);
1203− if (error)
1204− return error;
1198+ error = xfs_flush_unmap_range(ip, offset, XFS_ISIZE(ip));
12051199
12061200 /*
12071201 * Clean out anything hanging around in the cow fork now that
fs/xfs/xfs_bmap_util.h+3−0
@@ -80,4 +80,7 @@ int xfs_bmap_count_blocks(struct xfs_trans *tp, struct xfs_inode *ip, · 79 unmodified lines
8080 int whichfork, xfs_extnum_t *nextents,
8181 xfs_filblks_t *count);
8282
83+int xfs_flush_unmap_range(struct xfs_inode *ip, xfs_off_t offset,
84+ xfs_off_t len);
85+
8386 #endif /* __XFS_BMAP_UTIL_H__ */
fs/xfs/xfs_buf_item.c+21−7
@@ -1233,9 +1233,23 @@ xfs_buf_iodone( · 1232 unmodified lines
12331233 }
12341234
12351235 /*
1236− * Requeue a failed buffer for writeback
1236+ * Requeue a failed buffer for writeback.
12371237 *
1238− * Return true if the buffer has been re-queued properly, false otherwise
1238+ * We clear the log item failed state here as well, but we have to be careful
1239+ * about reference counts because the only active reference counts on the buffer
1240+ * may be the failed log items. Hence if we clear the log item failed state
1241+ * before queuing the buffer for IO we can release all active references to
1242+ * the buffer and free it, leading to use after free problems in
1243+ * xfs_buf_delwri_queue. It makes no difference to the buffer or log items which
1244+ * order we process them in - the buffer is locked, and we own the buffer list
1245+ * so nothing on them is going to change while we are performing this action.
1246+ *
1247+ * Hence we can safely queue the buffer for IO before we clear the failed log
1248+ * item state, therefore always having an active reference to the buffer and
1249+ * avoiding the transient zero-reference state that leads to use-after-free.
1250+ *
1251+ * Return true if the buffer was added to the buffer list, false if it was
1252+ * already on the buffer list.
12391253 */
12401254 bool
12411255 xfs_buf_resubmit_failed_buffers(
@@ -1243,16 +1257,16 @@ xfs_buf_resubmit_failed_buffers( · 1 unmodified line
12431257 struct list_head *buffer_list)
12441258 {
12451259 struct xfs_log_item *lip;
1260+ bool ret;
1261+
1262+ ret = xfs_buf_delwri_queue(bp, buffer_list);
12461263
12471264 /*
1248− * Clear XFS_LI_FAILED flag from all items before resubmit
1249− *
1250− * XFS_LI_FAILED set/clear is protected by ail_lock, caller this
1265+ * XFS_LI_FAILED set/clear is protected by ail_lock, caller of this
12511266 * function already have it acquired
12521267 */
12531268 list_for_each_entry(lip, &bp->b_li_list, li_bio_list)
12541269 xfs_clear_li_failed(lip);
12551270
1256− /* Add this buffer back to the delayed write list */
1257− return xfs_buf_delwri_queue(bp, buffer_list);
1271+ return ret;
12581272 }
fs/xfs/xfs_file.c+1−1
@@ -920,7 +920,7 @@ out_unlock: · 919 unmodified lines
920920 }
921921
922922
923−loff_t
923+STATIC loff_t
924924 xfs_file_remap_range(
925925 struct file *file_in,
926926 loff_t pos_in,
fs/xfs/xfs_reflink.c+14−4
@@ -296,6 +296,7 @@ xfs_reflink_reserve_cow( · 295 unmodified lines
296296 if (error)
297297 return error;
298298
299+ xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);
299300 trace_xfs_reflink_cow_alloc(ip, &got);
300301 return 0;
301302 }
@@ -1351,10 +1352,19 @@ xfs_reflink_remap_prep( · 1049 unmodified lines
13511352 if (ret)
13521353 goto out_unlock;
13531354
1354− /* Zap any page cache for the destination file's range. */
1355− truncate_inode_pages_range(&inode_out->i_data,
1356− round_down(pos_out, PAGE_SIZE),
1357− round_up(pos_out + *len, PAGE_SIZE) - 1);
1355+ /*
1356+ * If pos_out > EOF, we may have dirtied blocks between EOF and
1357+ * pos_out. In that case, we need to extend the flush and unmap to cover
1358+ * from EOF to the end of the copy length.
1359+ */
1360+ if (pos_out > XFS_ISIZE(dest)) {
1361+ loff_t flen = *len + (pos_out - XFS_ISIZE(dest));
1362+ ret = xfs_flush_unmap_range(dest, XFS_ISIZE(dest), flen);
1363+ } else {
1364+ ret = xfs_flush_unmap_range(dest, pos_out, *len);
1365+ }
1366+ if (ret)
1367+ goto out_unlock;
13581368
13591369 return 1;
13601370 out_unlock:
fs/xfs/xfs_trace.h+4−1
@@ -280,7 +280,10 @@ DECLARE_EVENT_CLASS(xfs_buf_class, · 279 unmodified lines
280280 ),
281281 TP_fast_assign(
282282 __entry->dev = bp->b_target->bt_dev;
283− __entry->bno = bp->b_bn;
283+ if (bp->b_bn == XFS_BUF_DADDR_NULL)
284+ __entry->bno = bp->b_maps[0].bm_bn;
285+ else
286+ __entry->bno = bp->b_bn;
284287 __entry->nblks = bp->b_length;
285288 __entry->hold = atomic_read(&bp->b_hold);
286289 __entry->pincount = atomic_read(&bp->b_pin_count);

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t