The following patch has already been cherry picked into 3.2 and 3.16 stable trees by Ben Hutchings, but for some reason isn't in the 3.18, 4.1, 4.4, and 4.9 stable kernels. a056bdaae7a1: ext4: fix data corruption for mmap writes This commit is needed to fix xfstests test: generic/438 The upstream commit cherry-picks cleanly into the 4.9 stable kernel tree. For the 4.4, 4.1, and 3.18 trees, I had to adjust the patch slightly after doing the cherry-pick. The attached patch will work for the other stable trees. Many thanks!! - Ted >From 9e0379a7e181a0eaff09db9b924f7bafeafe03ef Mon Sep 17 00:00:00 2001 From: Jan Kara <jack@xxxxxxx> Date: Fri, 26 May 2017 17:45:45 -0400 Subject: [PATCH] ext4: fix data corruption for mmap writes mpage_submit_page() can race with another process growing i_size and writing data via mmap to the written-back page. As mpage_submit_page() samples i_size too early, it may happen that ext4_bio_write_page() zeroes out too large tail of the page and thus corrupts user data. Fix the problem by sampling i_size only after the page has been write-protected in page tables by clear_page_dirty_for_io() call. Reported-by: Michael Zimmer <michael@xxxxxxxxxxx> CC: stable@xxxxxxxxxxxxxxx Fixes: cb20d5188366f04d96d2e07b1240cc92170ade40 Signed-off-by: Jan Kara <jack@xxxxxxx> Signed-off-by: Theodore Ts'o <tytso@xxxxxxx> (cherry picked from commit a056bdaae7a181f7dcc876cfab2f94538e508709) --- fs/ext4/inode.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 1796d1bd9a1d..194a6baa4283 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -1946,15 +1946,29 @@ static int ext4_writepage(struct page *page, static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page) { int len; - loff_t size = i_size_read(mpd->inode); + loff_t size; int err; BUG_ON(page->index != mpd->first_page); - if (page->index == size >> PAGE_CACHE_SHIFT) - len = size & ~PAGE_CACHE_MASK; - else - len = PAGE_CACHE_SIZE; clear_page_dirty_for_io(page); + /* + * We have to be very careful here! Nothing protects writeback path + * against i_size changes and the page can be writeably mapped into + * page tables. So an application can be growing i_size and writing + * data through mmap while writeback runs. clear_page_dirty_for_io() + * write-protects our page in page tables and the page cannot get + * written to again until we release page lock. So only after + * clear_page_dirty_for_io() we are safe to sample i_size for + * ext4_bio_write_page() to zero-out tail of the written page. We rely + * on the barrier provided by TestClearPageDirty in + * clear_page_dirty_for_io() to make sure i_size is really sampled only + * after page tables are updated. + */ + size = i_size_read(mpd->inode); + if (page->index == size >> PAGE_SHIFT) + len = size & ~PAGE_MASK; + else + len = PAGE_SIZE; err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc, false); if (!err) mpd->wbc->nr_to_write--; -- 2.11.0.rc0.7.gbe5a750