ext4: protect i_disksize update by i_data_sem in direct write path (73fdad00) · Commits · 戴 / test

i_disksize update should be protected by i_data_sem, by either taking the lock explicitly or by using ext4_update_i_disksize() helper. But the i_disksize updates in ext4_direct_IO_write() are not protected at all, which may be racing with i_disksize updates in writeback path in delalloc buffer write path. This is found by code inspection, and I didn't hit any i_disksize corruption due to this bug. Thanks to Jan Kara for catching this bug and suggesting the fix! Reported-by:

Jan Kara <jack@suse.cz> Suggested-by:

Jan Kara <jack@suse.cz> Signed-off-by:

Eryu Guan <guaneryu@gmail.com> Signed-off-by:

Theodore Ts'o <tytso@mit.edu> Cc: stable@vger.kernel.org

fs/ext4/inode.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -3658,7 +3658,6 @@ static ssize_t ext4_direct_IO_write(struct kiocb iocb, struct iov_iter iter)
		{
		struct file *file = iocb->ki_filp;
		struct inode *inode = file->f_mapping->host;
		struct ext4_inode_info *ei = EXT4_I(inode);
		ssize_t ret;
		loff_t offset = iocb->ki_pos;
		size_t count = iov_iter_count(iter);
		@@ -3682,7 +3681,7 @@ static ssize_t ext4_direct_IO_write(struct kiocb iocb, struct iov_iter iter)
		goto out;
		}
		orphan = 1;
		ei->i_disksize = inode->i_size;
		ext4_update_i_disksize(inode, inode->i_size);
		ext4_journal_stop(handle);
		}

		@@ -3790,7 +3789,7 @@ static ssize_t ext4_direct_IO_write(struct kiocb iocb, struct iov_iter iter)
		if (ret > 0) {
		loff_t end = offset + ret;
		if (end > inode->i_size) {
		ei->i_disksize = end;
		ext4_update_i_disksize(inode, end);
		i_size_write(inode, end);
		/*
		* We're going to return a positive `ret'

Admin message