Patch "ext4: fix i_disksize exceeding i_size problem in paritally written case" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ext4: fix i_disksize exceeding i_size problem in paritally written case

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ext4-fix-i_disksize-exceeding-i_size-problem-in-pari.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1233b0a6e5f0ff3727ec60199f2a7a477f7bc66a
Author: Zhihao Cheng <chengzhihao1@xxxxxxxxxx>
Date:   Tue Mar 21 09:37:21 2023 +0800

    ext4: fix i_disksize exceeding i_size problem in paritally written case
    
    [ Upstream commit 1dedde690303c05ef732b7c5c8356fdf60a4ade3 ]
    
    It is possible for i_disksize can exceed i_size, triggering a warning.
    
    generic_perform_write
     copied = iov_iter_copy_from_user_atomic(len) // copied < len
     ext4_da_write_end
     | ext4_update_i_disksize
     |  new_i_size = pos + copied;
     |  WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize
     | generic_write_end
     |  copied = block_write_end(copied, len) // copied = 0
     |   if (unlikely(copied < len))
     |    if (!PageUptodate(page))
     |     copied = 0;
     |  if (pos + copied > inode->i_size) // return false
     if (unlikely(copied == 0))
      goto again;
     if (unlikely(iov_iter_fault_in_readable(i, bytes))) {
      status = -EFAULT;
      break;
     }
    
    We get i_disksize greater than i_size here, which could trigger WARNING
    check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio:
    
    ext4_dio_write_iter
     iomap_dio_rw
      __iomap_dio_rw // return err, length is not aligned to 512
     ext4_handle_inode_extension
      WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops
    
     WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319
     CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2
     RIP: 0010:ext4_file_write_iter+0xbc7
     Call Trace:
      vfs_write+0x3b1
      ksys_write+0x77
      do_syscall_64+0x39
    
    Fix it by updating 'copied' value before updating i_disksize just like
    ext4_write_inline_data_end() does.
    
    A reproducer can be found in the buganizer link below.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=217209
    Fixes: 64769240bd07 ("ext4: Add delayed allocation support in data=writeback mode")
    Signed-off-by: Zhihao Cheng <chengzhihao1@xxxxxxxxxx>
    Reviewed-by: Jan Kara <jack@xxxxxxx>
    Link: https://lore.kernel.org/r/20230321013721.89818-1-chengzhihao1@xxxxxxxxxx
    Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 0426f88ba907c..20b446a23e239 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3065,6 +3065,9 @@ static int ext4_da_write_end(struct file *file,
 	    ext4_has_inline_data(inode))
 		return ext4_write_inline_data_end(inode, pos, len, copied, page);
 
+	if (unlikely(copied < len) && !PageUptodate(page))
+		copied = 0;
+
 	start = pos & (PAGE_SIZE - 1);
 	end = start + copied - 1;