Commit a46bebd5 authored by Daeho Jeong's avatar Daeho Jeong Committed by Jaegeuk Kim
Browse files

f2fs: synchronize atomic write aborts 



To fix a race condition between atomic write aborts, I use the inode
lock and make COW inode to be re-usable thoroughout the whole
atomic file inode lifetime.

Reported-by: default avatar <syzbot+823000d23b3400619f7c@syzkaller.appspotmail.com>
Fixes: 3db1de0e ("f2fs: change the current atomic write way")
Signed-off-by: default avatarDaeho Jeong <daehojeong@google.com>
Reviewed-by: default avatarChao Yu <chao@kernel.org>
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
parent 7e986855

fs/f2fs/file.c

+29 −15
Original line number Diff line number Diff line
@@ -1863,7 +1863,10 @@ static int f2fs_release_file(struct inode *inode, struct file *filp) 
			atomic_read(&inode->i_writecount) != 1)

		return 0;



	inode_lock(inode);

	f2fs_abort_atomic_write(inode, true);

	inode_unlock(inode);



	return 0;

}
@@ -1878,8 +1881,12 @@ static int f2fs_file_flush(struct file *file, fl_owner_t id) 
	 * before dropping file lock, it needs to do in ->flush.

	 */

	if (F2FS_I(inode)->atomic_write_task == current &&

				(current->flags & PF_EXITING))

				(current->flags & PF_EXITING)) {

		inode_lock(inode);

		f2fs_abort_atomic_write(inode, true);

		inode_unlock(inode);

	}



	return 0;

}
@@ -2085,6 +2092,8 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate) 
		goto out;

	}



	/* Check if the inode already has a COW inode */

	if (fi->cow_inode == NULL) {

		/* Create a COW inode for atomic write */

		pinode = f2fs_iget(inode->i_sb, fi->i_pino);

		if (IS_ERR(pinode)) {
@@ -2100,13 +2109,18 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate) 
			goto out;

		}



		set_inode_flag(fi->cow_inode, FI_COW_FILE);

		clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);

	} else {

		/* Reuse the already created COW inode */

		f2fs_do_truncate_blocks(fi->cow_inode, 0, true);

	}



	f2fs_write_inode(inode, NULL);



	stat_inc_atomic_inode(inode);



	set_inode_flag(inode, FI_ATOMIC_FILE);

	set_inode_flag(fi->cow_inode, FI_COW_FILE);

	clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);



	isize = i_size_read(inode);

	fi->original_i_size = isize;

fs/f2fs/inode.c

+9 −2
Original line number Diff line number Diff line
@@ -767,11 +767,18 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc) 
void f2fs_evict_inode(struct inode *inode)

{

	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);

	nid_t xnid = F2FS_I(inode)->i_xattr_nid;

	struct f2fs_inode_info *fi = F2FS_I(inode);

	nid_t xnid = fi->i_xattr_nid;

	int err = 0;



	f2fs_abort_atomic_write(inode, true);



	if (fi->cow_inode) {

		clear_inode_flag(fi->cow_inode, FI_COW_FILE);

		iput(fi->cow_inode);

		fi->cow_inode = NULL;

	}



	trace_f2fs_evict_inode(inode);

	truncate_inode_pages_final(&inode->i_data);
@@ -856,7 +863,7 @@ void f2fs_evict_inode(struct inode *inode) 
	stat_dec_inline_inode(inode);

	stat_dec_compr_inode(inode);

	stat_sub_compr_blocks(inode,

			atomic_read(&F2FS_I(inode)->i_compr_blocks));

			atomic_read(&fi->i_compr_blocks));



	if (likely(!f2fs_cp_error(sbi) &&

				!is_sbi_flag_set(sbi, SBI_CP_DISABLED)))

fs/f2fs/segment.c

+0 −3
Original line number Diff line number Diff line
@@ -192,9 +192,6 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean) 
	if (!f2fs_is_atomic_file(inode))

		return;



	clear_inode_flag(fi->cow_inode, FI_COW_FILE);

	iput(fi->cow_inode);

	fi->cow_inode = NULL;

	release_atomic_write_cnt(inode);

	clear_inode_flag(inode, FI_ATOMIC_COMMITTED);

	clear_inode_flag(inode, FI_ATOMIC_REPLACE);

fs/f2fs/super.c

+0 −2
Original line number Diff line number Diff line
@@ -1427,8 +1427,6 @@ static int f2fs_drop_inode(struct inode *inode) 
			atomic_inc(&inode->i_count);

			spin_unlock(&inode->i_lock);



			f2fs_abort_atomic_write(inode, true);



			/* should remain fi->extent_tree for writepage */

			f2fs_destroy_extent_node(inode);