On Thu 15-04-21 12:47:24, Dave Chinner wrote:
> On Wed, Apr 14, 2021 at 03:14:53PM +0200, Jan Kara wrote:
> > Eric has noticed that after pagecache read rework, generic/418 is
> > occasionally failing for ext4 when blocksize < pagesize. In fact, the
> > pagecache rework just made hard to hit race in ext4 more likely. The
> > problem is that since ext4 conversion of direct IO writes to iomap
> > framework (commit 378f32bab371), we update inode size after direct IO
> > write only after invalidating page cache. Thus if buffered read sneaks
> > at unfortunate moment like:
> >
> > CPU1 - write at offset 1k CPU2 - read from offset 0
> > iomap_dio_rw(..., IOMAP_DIO_FORCE_WAIT);
> > ext4_readpage();
> > ext4_handle_inode_extension()
> >
> > the read will zero out tail of the page as it still sees smaller inode
> > size and thus page cache becomes inconsistent with on-disk contents with
> > all the consequences.
> >
> > Fix the problem by moving inode size update into end_io handler which
> > gets called before the page cache is invalidated.
> >
> > Reported-by: Eric Whitney <enwlinux@xxxxxxxxx>
> > Fixes: 378f32bab371 ("ext4: introduce direct I/O write using iomap infrastructure")
> > CC: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Jan Kara <jack@xxxxxxx>
> > ---
> > fs/ext4/file.c | 20 ++++++++++++++++----
> > 1 file changed, 16 insertions(+), 4 deletions(-)
> >
> > Eric, can you please try whether this patch fixes the failures you are
> > occasionally seeing?
> >
> > Changes since v1:
> > * Rewritten the fix to avoid the need for separate transaction handle for
> > orphan list update
> >
> > diff --git a/fs/ext4/file.c b/fs/ext4/file.c
> > index 194f5d00fa32..be1e80af61be 100644
> > --- a/fs/ext4/file.c
> > +++ b/fs/ext4/file.c
> > @@ -371,15 +371,27 @@ static ssize_t ext4_handle_inode_extension(struct inode *inode, loff_t offset,
> > static int ext4_dio_write_end_io(struct kiocb *iocb, ssize_t size,
> > int error, unsigned int flags)
> > {
> > - loff_t offset = iocb->ki_pos;
> > + loff_t pos = iocb->ki_pos;
> > struct inode *inode = file_inode(iocb->ki_filp);
> >
> > if (error)
> > return error;
> >
> > - if (size && flags & IOMAP_DIO_UNWRITTEN)
> > - return ext4_convert_unwritten_extents(NULL, inode,
> > - offset, size);
> > + if (size && flags & IOMAP_DIO_UNWRITTEN) {
> > + error = ext4_convert_unwritten_extents(NULL, inode, pos, size);
> > + if (error < 0)
> > + return error;
> > + }
> > + /*
> > + * If we are extending the file, we have to update i_size here before
> > + * page cache gets invalidated in iomap_dio_rw(). Otherwise racing
> > + * buffered reads could zero out too much from page cache pages. Update
> > + * of on-disk size will happen later in ext4_dio_write_iter() where
> > + * we have enough information to also perform orphan list handling etc.
> > + */
> > + pos += size;
> > + if (pos > i_size_read(inode))
> > + i_size_write(inode, pos);
>
> Might be worth explaining why this doesn't require locking to
> prevent racing completions from updating the inode size and
> potentially losing an EOF update. I know why but it might not be so
> obvious to others (DIO extending writes are serialised
> at submission in ext4) but it's probably worth having a comment
> similar to the one in xfs_dio_write_end_io() that explains why XFS
> needs locking.
Good idea. There's also the somewhat subtle reason why this completion for
non-extending write cannot race with truncate and falsely seeing pos >
i_size. I've added comments explaining that.
Honza
--
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR
