From: Jan Kara <jack@xxxxxxx>
commit 619f75dae2cf117b1d07f27b046b9ffb071c4685 upstream.
The syzbot has reported that it can hit the warning in
ext4_dio_write_end_io() because i_size < i_disksize. Indeed the
reproducer creates a race between DIO IO completion and truncate
expanding the file and thus ext4_dio_write_end_io() sees an inconsistent
inode state where i_disksize is already updated but i_size is not
updated yet. Since we are careful when setting up DIO write and consider
it extending (and thus performing the IO synchronously with i_rwsem held
exclusively) whenever it goes past either of i_size or i_disksize, we
can use the same test during IO completion without risking entering
ext4_handle_inode_extension() without i_rwsem held. This way we make it
obvious both i_size and i_disksize are large enough when we report DIO
completion without relying on unreliable WARN_ON.
Reported-by: <syzbot+47479b71cdfc78f56d30@xxxxxxxxxxxxxxxxxxxxxxxxx>
Fixes: 91562895f803 ("ext4: properly sync file size update after O_SYNC direct IO")
Signed-off-by: Jan Kara <jack@xxxxxxx>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@xxxxxxxxx>
Link: https://lore.kernel.org/r/20231130095653.22679-1-jack@xxxxxxx
Signed-off-by: Theodore Ts'o <tytso@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/ext4/file.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -323,9 +323,10 @@ static void ext4_inode_extension_cleanup
return;
}
/*
- * If i_disksize got extended due to writeback of delalloc blocks while
- * the DIO was running we could fail to cleanup the orphan list in
- * ext4_handle_inode_extension(). Do it now.
+ * If i_disksize got extended either due to writeback of delalloc
+ * blocks or extending truncate while the DIO was running we could fail
+ * to cleanup the orphan list in ext4_handle_inode_extension(). Do it
+ * now.
*/
if (!list_empty(&EXT4_I(inode)->i_orphan) && inode->i_nlink) {
handle_t *handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
@@ -360,10 +361,11 @@ static int ext4_dio_write_end_io(struct
* blocks. But the code in ext4_iomap_alloc() is careful to use
* zeroed/unwritten extents if this is possible; thus we won't leave
* uninitialized blocks in a file even if we didn't succeed in writing
- * as much as we intended.
+ * as much as we intended. Also we can race with truncate or write
+ * expanding the file so we have to be a bit careful here.
*/
- WARN_ON_ONCE(i_size_read(inode) < READ_ONCE(EXT4_I(inode)->i_disksize));
- if (pos + size <= READ_ONCE(EXT4_I(inode)->i_disksize))
+ if (pos + size <= READ_ONCE(EXT4_I(inode)->i_disksize) &&
+ pos + size <= i_size_read(inode))
return size;
return ext4_handle_inode_extension(inode, pos, size);
}
Patches currently in stable-queue which might be from jack@xxxxxxx are
queue-5.10/ext4-update-orig_path-in-ext4_find_extent.patch
queue-5.10/ext4-fix-incorrect-tid-assumption-in-__jbd2_log_wait_for_space.patch
queue-5.10/ext4-propagate-errors-from-ext4_find_extent-in-ext4_insert_range.patch
queue-5.10/ext4-avoid-use-after-free-in-ext4_ext_show_leaf.patch
queue-5.10/ext4-fix-double-brelse-the-buffer-of-the-extents-path.patch
queue-5.10/ext4-fix-warning-in-ext4_dio_write_end_io.patch
queue-5.10/ext4-clear-ext4_group_info_was_trimmed_bit-even-moun.patch
queue-5.10/ext4-drop-ppath-from-ext4_ext_replay_update_ex-to-avoid-double-free.patch
queue-5.10/ext4-fix-slab-use-after-free-in-ext4_split_extent_at.patch
queue-5.10/ext4-aovid-use-after-free-in-ext4_ext_insert_extent.patch
queue-5.10/ext4-fix-inode-tree-inconsistency-caused-by-enomem.patch
queue-5.10/ext4-fix-incorrect-tid-assumption-in-ext4_wait_for_tail_page_commit.patch
queue-5.10/ext4-properly-sync-file-size-update-after-o_sync-dir.patch
queue-5.10/vfs-fix-race-between-evice_inodes-and-find_inode-iput.patch
queue-5.10/jbd2-stop-waiting-for-space-when-jbd2_cleanup_journal_tail-returns-error.patch
queue-5.10/jbd2-correctly-compare-tids-with-tid_geq-function-in-jbd2_fc_begin_commit.patch
queue-5.10/ext4-dax-fix-overflowing-extents-beyond-inode-size-w.patch
queue-5.10/fs-explicitly-unregister-per-superblock-bdis.patch
