On Fri 21-05-21 16:36:12, Junxiao Bi wrote: > When fallocate punches holes out of inode size, if original isize is in > the middle of last cluster, then the part from isize to the end of the > cluster will be zeroed with buffer write, at that time isize is not > yet updated to match the new size, if writeback is kicked in, it will > invoke ocfs2_writepage()->block_write_full_page() where the pages out > of inode size will be dropped. That will cause file corruption. Fix > this by zero out eof blocks when extending the inode size. > > Running the following command with qemu-image 4.2.1 can get a corrupted > coverted image file easily. > > qemu-img convert -p -t none -T none -f qcow2 $qcow_image \ > -O qcow2 -o compat=1.1 $qcow_image.conv > > The usage of fallocate in qemu is like this, it first punches holes out of > inode size, then extend the inode size. > > fallocate(11, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 2276196352, 65536) = 0 > fallocate(11, 0, 2276196352, 65536) = 0 > > v1: https://www.spinics.net/lists/linux-fsdevel/msg193999.html > > Cc: <stable@xxxxxxxxxxxxxxx> > Cc: Jan Kara <jack@xxxxxxx> > Signed-off-by: Junxiao Bi <junxiao.bi@xxxxxxxxxx> > --- > > Changes in v2: > - suggested by Jan Kara, using sb_issue_zeroout to zero eof blocks in disk directly. > > fs/ocfs2/file.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++-- > 1 file changed, 47 insertions(+), 2 deletions(-) > > diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c > index f17c3d33fb18..17469fc7b20e 100644 > --- a/fs/ocfs2/file.c > +++ b/fs/ocfs2/file.c > @@ -1855,6 +1855,45 @@ int ocfs2_remove_inode_range(struct inode *inode, > return ret; > } > > +/* > + * zero out partial blocks of one cluster. > + * > + * start: file offset where zero starts, will be made upper block aligned. > + * len: it will be trimmed to the end of current cluster if "start + len" > + * is bigger than it. You write this here but ... > + */ > +static int ocfs2_zeroout_partial_cluster(struct inode *inode, > + u64 start, u64 len) > +{ > + int ret; > + u64 start_block, end_block, nr_blocks; > + u64 p_block, offset; > + u32 cluster, p_cluster, nr_clusters; > + struct super_block *sb = inode->i_sb; > + u64 end = ocfs2_align_bytes_to_clusters(sb, start); > + > + if (start + len < end) > + end = start + len; ... here you check actually something else and I don't see where else would the trimming happen. Honza > + > + start_block = ocfs2_blocks_for_bytes(sb, start); > + end_block = ocfs2_blocks_for_bytes(sb, end); > + nr_blocks = end_block - start_block; > + if (!nr_blocks) > + return 0; > + > + cluster = ocfs2_bytes_to_clusters(sb, start); > + ret = ocfs2_get_clusters(inode, cluster, &p_cluster, > + &nr_clusters, NULL); > + if (ret) > + return ret; > + if (!p_cluster) > + return 0; > + > + offset = start_block - ocfs2_clusters_to_blocks(sb, cluster); > + p_block = ocfs2_clusters_to_blocks(sb, p_cluster) + offset; > + return sb_issue_zeroout(sb, p_block, nr_blocks, GFP_NOFS); > +} > + > /* > * Parts of this function taken from xfs_change_file_space() > */ > @@ -1865,7 +1904,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, > { > int ret; > s64 llen; > - loff_t size; > + loff_t size, orig_isize; > struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); > struct buffer_head *di_bh = NULL; > handle_t *handle; > @@ -1896,6 +1935,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, > goto out_inode_unlock; > } > > + orig_isize = i_size_read(inode); > switch (sr->l_whence) { > case 0: /*SEEK_SET*/ > break; > @@ -1903,7 +1943,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, > sr->l_start += f_pos; > break; > case 2: /*SEEK_END*/ > - sr->l_start += i_size_read(inode); > + sr->l_start += orig_isize; > break; > default: > ret = -EINVAL; > @@ -1957,6 +1997,11 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, > default: > ret = -EINVAL; > } > + > + /* zeroout eof blocks in the cluster. */ > + if (!ret && change_size && orig_isize < size) > + ret = ocfs2_zeroout_partial_cluster(inode, orig_isize, > + size - orig_isize); > up_write(&OCFS2_I(inode)->ip_alloc_sem); > if (ret) { > mlog_errno(ret); > -- > 2.24.3 (Apple Git-128) > -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR
