Patch "xfs: flush new eof page on truncate to avoid post-eof corruption" has been added to the 5.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    xfs: flush new eof page on truncate to avoid post-eof corruption

to the 5.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     xfs-flush-new-eof-page-on-truncate-to-avoid-post-eof.patch
and it can be found in the queue-5.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2a8a108c4f863fe03c8766595dd25627ef1c5f4b
Author: Brian Foster <bfoster@xxxxxxxxxx>
Date:   Thu Oct 29 14:30:48 2020 -0700

    xfs: flush new eof page on truncate to avoid post-eof corruption
    
    [ Upstream commit 869ae85dae64b5540e4362d7fe4cd520e10ec05c ]
    
    It is possible to expose non-zeroed post-EOF data in XFS if the new
    EOF page is dirty, backed by an unwritten block and the truncate
    happens to race with writeback. iomap_truncate_page() will not zero
    the post-EOF portion of the page if the underlying block is
    unwritten. The subsequent call to truncate_setsize() will, but
    doesn't dirty the page. Therefore, if writeback happens to complete
    after iomap_truncate_page() (so it still sees the unwritten block)
    but before truncate_setsize(), the cached page becomes inconsistent
    with the on-disk block. A mapped read after the associated page is
    reclaimed or invalidated exposes non-zero post-EOF data.
    
    For example, consider the following sequence when run on a kernel
    modified to explicitly flush the new EOF page within the race
    window:
    
    $ xfs_io -fc "falloc 0 4k" -c fsync /mnt/file
    $ xfs_io -c "pwrite 0 4k" -c "truncate 1k" /mnt/file
      ...
    $ xfs_io -c "mmap 0 4k" -c "mread -v 1k 8" /mnt/file
    00000400:  00 00 00 00 00 00 00 00  ........
    $ umount /mnt/; mount <dev> /mnt/
    $ xfs_io -c "mmap 0 4k" -c "mread -v 1k 8" /mnt/file
    00000400:  cd cd cd cd cd cd cd cd  ........
    
    Update xfs_setattr_size() to explicitly flush the new EOF page prior
    to the page truncate to ensure iomap has the latest state of the
    underlying block.
    
    Fixes: 68a9f5e7007c ("xfs: implement iomap based buffered write path")
    Signed-off-by: Brian Foster <bfoster@xxxxxxxxxx>
    Reviewed-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx>
    Signed-off-by: Darrick J. Wong <darrick.wong@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 80a13c8561d85..bf93a7152181c 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -911,6 +911,16 @@ xfs_setattr_size(
 		error = iomap_zero_range(inode, oldsize, newsize - oldsize,
 				&did_zeroing, &xfs_buffered_write_iomap_ops);
 	} else {
+		/*
+		 * iomap won't detect a dirty page over an unwritten block (or a
+		 * cow block over a hole) and subsequently skips zeroing the
+		 * newly post-EOF portion of the page. Flush the new EOF to
+		 * convert the block before the pagecache truncate.
+		 */
+		error = filemap_write_and_wait_range(inode->i_mapping, newsize,
+						     newsize);
+		if (error)
+			return error;
 		error = iomap_truncate_page(inode, newsize, &did_zeroing,
 				&xfs_buffered_write_iomap_ops);
 	}