Commit b067ba1f authored by Jaegeuk Kim's avatar Jaegeuk Kim
Browse files

f2fs: should convert inline_data during the mkwrite 



If mkwrite is called to an inode having inline_data, it can overwrite the data
index space as NEW_ADDR. (e.g., the first 4 bytes are coincidently zero)

Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
parent e1c42045

fs/f2fs/data.c

+1 −1
Original line number Diff line number Diff line
@@ -946,7 +946,7 @@ static int f2fs_write_begin(struct file *file, struct address_space *mapping, 


	f2fs_balance_fs(sbi);

repeat:

	err = f2fs_convert_inline_data(inode, pos + len);

	err = f2fs_convert_inline_data(inode, pos + len, NULL);

	if (err)

		goto fail;

fs/f2fs/f2fs.h

+1 −1
Original line number Diff line number Diff line
@@ -1439,7 +1439,7 @@ extern const struct inode_operations f2fs_special_inode_operations; 
 */

bool f2fs_may_inline(struct inode *);

int f2fs_read_inline_data(struct inode *, struct page *);

int f2fs_convert_inline_data(struct inode *, pgoff_t);

int f2fs_convert_inline_data(struct inode *, pgoff_t, struct page *);

int f2fs_write_inline_data(struct inode *, struct page *, unsigned int);

void truncate_inline_data(struct inode *, u64);

int recover_inline_data(struct inode *, struct page *);

fs/f2fs/file.c

+8 −3
Original line number Diff line number Diff line
@@ -41,6 +41,11 @@ static int f2fs_vm_page_mkwrite(struct vm_area_struct *vma, 


	sb_start_pagefault(inode->i_sb);



	/* force to convert with normal data indices */

	err = f2fs_convert_inline_data(inode, MAX_INLINE_DATA + 1, page);

	if (err)

		goto out;



	/* block allocation */

	f2fs_lock_op(sbi);

	set_new_dnode(&dn, inode, NULL, NULL, 0);
@@ -533,7 +538,7 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr) 


	if ((attr->ia_valid & ATTR_SIZE) &&

			attr->ia_size != i_size_read(inode)) {

		err = f2fs_convert_inline_data(inode, attr->ia_size);

		err = f2fs_convert_inline_data(inode, attr->ia_size, NULL);

		if (err)

			return err;
@@ -622,7 +627,7 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len) 
	loff_t off_start, off_end;

	int ret = 0;



	ret = f2fs_convert_inline_data(inode, MAX_INLINE_DATA + 1);

	ret = f2fs_convert_inline_data(inode, MAX_INLINE_DATA + 1, NULL);

	if (ret)

		return ret;
@@ -678,7 +683,7 @@ static int expand_inode_data(struct inode *inode, loff_t offset, 
	if (ret)

		return ret;



	ret = f2fs_convert_inline_data(inode, offset + len);

	ret = f2fs_convert_inline_data(inode, offset + len, NULL);

	if (ret)

		return ret;

fs/f2fs/inline.c

+12 −8
Original line number Diff line number Diff line
@@ -124,9 +124,10 @@ out: 
	return err;

}



int f2fs_convert_inline_data(struct inode *inode, pgoff_t to_size)

int f2fs_convert_inline_data(struct inode *inode, pgoff_t to_size,

						struct page *page)

{

	struct page *page;

	struct page *new_page = page;

	int err;



	if (!f2fs_has_inline_data(inode))
@@ -134,12 +135,15 @@ int f2fs_convert_inline_data(struct inode *inode, pgoff_t to_size) 
	else if (to_size <= MAX_INLINE_DATA)

		return 0;



	page = grab_cache_page(inode->i_mapping, 0);

	if (!page)

	if (!page || page->index != 0) {

		new_page = grab_cache_page(inode->i_mapping, 0);

		if (!new_page)

			return -ENOMEM;

	}



	err = __f2fs_convert_inline_data(inode, page);

	f2fs_put_page(page, 1);

	err = __f2fs_convert_inline_data(inode, new_page);

	if (!page || page->index != 0)

		f2fs_put_page(new_page, 1);

	return err;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE