• Jan Kara's avatar
    ext4: fix races between page faults and hole punching · 0b680de4
    Jan Kara authored
    commit ea3d7209 upstream.
    
    Currently, page faults and hole punching are completely unsynchronized.
    This can result in page fault faulting in a page into a range that we
    are punching after truncate_pagecache_range() has been called and thus
    we can end up with a page mapped to disk blocks that will be shortly
    freed. Filesystem corruption will shortly follow. Note that the same
    race is avoided for truncate by checking page fault offset against
    i_size but there isn't similar mechanism available for punching holes.
    
    Fix the problem by creating new rw semaphore i_mmap_sem in inode and
    grab it for writing over truncate, hole punching, and other functions
    removing blocks from extent tree and for read over page faults. We
    cannot easily use i_data_sem for this since that ranks below transaction
    start and we need something ranking above it so that it can be held over
    the whole truncate / hole punching operation. Also remove various
    workarounds we had in the code to reduce race window when page fault
    could have created pages with stale mapping information.
    Signed-off-by: default avatarJan Kara <jack@suse.com>
    Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    0b680de4
inode.c 156 KB