Commit 3fa39667 authored by Chao Yu's avatar Chao Yu Committed by Zizhi Wo
Browse files

f2fs: fix to invalidate META_MAPPING before DIO write

mainline inclusion
from mainline-v6.0-rc1
commit 67ca0687
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HKE5
CVE: CVE-2024-26869

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=67ca06872eb02944b4c6f92cffa9242e92c63109



--------------------------------

Quoted from commit e3b49ea3 ("f2fs: invalidate META_MAPPING before
IPU/DIO write")

"
Encrypted pages during GC are read and cached in META_MAPPING.
However, due to cached pages in META_MAPPING, there is an issue where
newly written pages are lost by IPU or DIO writes.

Thread A - f2fs_gc()            Thread B
/* phase 3 */
down_write(i_gc_rwsem)
ra_data_block()       ---- (a)
up_write(i_gc_rwsem)
                                f2fs_direct_IO() :
                                 - down_read(i_gc_rwsem)
                                 - __blockdev_direct_io()
                                 - get_data_block_dio_write()
                                 - f2fs_dio_submit_bio()  ---- (b)
                                 - up_read(i_gc_rwsem)
/* phase 4 */
down_write(i_gc_rwsem)
move_data_block()     ---- (c)
up_write(i_gc_rwsem)

(a) In phase 3 of f2fs_gc(), up-to-date page is read from storage and
    cached in META_MAPPING.
(b) In thread B, writing new data by IPU or DIO write on same blkaddr as
    read in (a). cached page in META_MAPPING become out-dated.
(c) In phase 4 of f2fs_gc(), out-dated page in META_MAPPING is copied to
    new blkaddr. In conclusion, the newly written data in (b) is lost.

To address this issue, invalidating pages in META_MAPPING before IPU or
DIO write.
"

In previous commit, we missed to cover extent cache hit case, and passed
wrong value for parameter @end of invalidate_mapping_pages(), fix both
issues.

Fixes: 6aa58d8a ("f2fs: readahead encrypted block during GC")
Fixes: e3b49ea3 ("f2fs: invalidate META_MAPPING before IPU/DIO write")
Cc: Hyeong-Jun Kim <hj514.kim@samsung.com>
Signed-off-by: default avatarChao Yu <chao.yu@oppo.com>
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>

Conflicts:
	fs/f2fs/data.c
Signed-off-by: default avatarZizhi Wo <wozizhi@huawei.com>
parent 1200e551
Loading
Loading
Loading
Loading
+5 −2
Original line number Diff line number Diff line
@@ -1536,9 +1536,12 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
			*map->m_next_extent = pgofs + map->m_len;

		/* for hardware encryption, but to avoid potential issue in future */
		if (flag == F2FS_GET_BLOCK_DIO)
		if (flag == F2FS_GET_BLOCK_DIO) {
			f2fs_wait_on_block_writeback_range(inode,
						map->m_pblk, map->m_len);
			invalidate_mapping_pages(META_MAPPING(sbi),
				map->m_pblk, map->m_pblk + map->m_len - 1);
		}
		goto out;
	}

@@ -1719,7 +1722,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
		f2fs_wait_on_block_writeback_range(inode,
						map->m_pblk, map->m_len);
		invalidate_mapping_pages(META_MAPPING(sbi),
						map->m_pblk, map->m_pblk);
				map->m_pblk, map->m_pblk + map->m_len - 1);
	}

	if (flag == F2FS_GET_BLOCK_PRECACHE) {