Commit 25051158 authored by Lachlan McIlroy's avatar Lachlan McIlroy
Browse files

[XFS] Fix race in xfs_write() between direct and buffered I/O with DMAPI 



The iolock is dropped and re-acquired around the call to XFS_SEND_NAMESP().
While the iolock is released the file can become cached.  We then
'goto retry' and - if we are doing direct I/O - mapping->nrpages may now be
non zero but need_i_mutex will be zero and we will hit the WARN_ON().

Since we have dropped the I/O lock then the file size may have also changed
so what we need to do here is 'goto start' like we do for the XFS_SEND_DATA()
DMAPI event.

We also need to update the filesize before releasing the iolock so that
needs to be done before the XFS_SEND_NAMESP event.  If we drop the iolock
before setting the filesize we could race with a truncate.

Reviewed-by: default avatarChristoph Hellwig <hch@infradead.org>
Signed-off-by: default avatarLachlan McIlroy <lachlan@sgi.com>
parent ad1ad968

fs/xfs/linux-2.6/xfs_lrw.c

+12 −15
Original line number Original line Diff line number Diff line
@@ -707,7 +707,6 @@ start: 
		}

		}

	}

	}





retry:

	/* We can write back this queue in page reclaim */

	/* We can write back this queue in page reclaim */

	current->backing_dev_info = mapping->backing_dev_info;

	current->backing_dev_info = mapping->backing_dev_info;
@@ -763,6 +762,17 @@ retry: 
	if (ret == -EIOCBQUEUED && !(ioflags & IO_ISAIO))

	if (ret == -EIOCBQUEUED && !(ioflags & IO_ISAIO))

		ret = wait_on_sync_kiocb(iocb);

		ret = wait_on_sync_kiocb(iocb);





	isize = i_size_read(inode);

	if (unlikely(ret < 0 && ret != -EFAULT && *offset > isize))

		*offset = isize;



	if (*offset > xip->i_size) {

		xfs_ilock(xip, XFS_ILOCK_EXCL);

		if (*offset > xip->i_size)

			xip->i_size = *offset;

		xfs_iunlock(xip, XFS_ILOCK_EXCL);

	}



	if (ret == -ENOSPC &&

	if (ret == -ENOSPC &&

	    DM_EVENT_ENABLED(xip, DM_EVENT_NOSPACE) && !(ioflags & IO_INVIS)) {

	    DM_EVENT_ENABLED(xip, DM_EVENT_NOSPACE) && !(ioflags & IO_INVIS)) {

		xfs_iunlock(xip, iolock);

		xfs_iunlock(xip, iolock);
@@ -776,20 +786,7 @@ retry: 
		xfs_ilock(xip, iolock);

		xfs_ilock(xip, iolock);

		if (error)

		if (error)

			goto out_unlock_internal;

			goto out_unlock_internal;

		pos = xip->i_size;

		goto start;

		ret = 0;

		goto retry;

	}



	isize = i_size_read(inode);

	if (unlikely(ret < 0 && ret != -EFAULT && *offset > isize))

		*offset = isize;



	if (*offset > xip->i_size) {

		xfs_ilock(xip, XFS_ILOCK_EXCL);

		if (*offset > xip->i_size)

			xip->i_size = *offset;

		xfs_iunlock(xip, XFS_ILOCK_EXCL);

	}

	}





	error = -ret;

	error = -ret;

CRA Git | Maintained and supported by SUSTech CRA and CCSE