Commit 44361e8c authored by Miklos Szeredi's avatar Miklos Szeredi

fuse: lock inode unconditionally in fuse_fallocate()

file_modified() must be called with inode lock held.  fuse_fallocate()
didn't lock the inode in case of just FALLOC_KEEP_SIZE flags value, which
resulted in a kernel Warning in notify_change().

Lock the inode unconditionally, like all other fallocate implementations
do.
Reported-by: default avatarPengfei Xu <pengfei.xu@intel.com>
Reported-and-tested-by: syzbot+462da39f0667b357c4b6@syzkaller.appspotmail.com
Fixes: 4a6f278d ("fuse: add file_modified() to fallocate")
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
parent eb708140
...@@ -2963,11 +2963,9 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset, ...@@ -2963,11 +2963,9 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
.mode = mode .mode = mode
}; };
int err; int err;
bool lock_inode = !(mode & FALLOC_FL_KEEP_SIZE) || bool block_faults = FUSE_IS_DAX(inode) &&
(mode & (FALLOC_FL_PUNCH_HOLE | (!(mode & FALLOC_FL_KEEP_SIZE) ||
FALLOC_FL_ZERO_RANGE)); (mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE)));
bool block_faults = FUSE_IS_DAX(inode) && lock_inode;
if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE | if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE |
FALLOC_FL_ZERO_RANGE)) FALLOC_FL_ZERO_RANGE))
...@@ -2976,22 +2974,20 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset, ...@@ -2976,22 +2974,20 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
if (fm->fc->no_fallocate) if (fm->fc->no_fallocate)
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (lock_inode) { inode_lock(inode);
inode_lock(inode); if (block_faults) {
if (block_faults) { filemap_invalidate_lock(inode->i_mapping);
filemap_invalidate_lock(inode->i_mapping); err = fuse_dax_break_layouts(inode, 0, 0);
err = fuse_dax_break_layouts(inode, 0, 0); if (err)
if (err) goto out;
goto out; }
}
if (mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE)) { if (mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE)) {
loff_t endbyte = offset + length - 1; loff_t endbyte = offset + length - 1;
err = fuse_writeback_range(inode, offset, endbyte); err = fuse_writeback_range(inode, offset, endbyte);
if (err) if (err)
goto out; goto out;
}
} }
if (!(mode & FALLOC_FL_KEEP_SIZE) && if (!(mode & FALLOC_FL_KEEP_SIZE) &&
...@@ -3039,8 +3035,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset, ...@@ -3039,8 +3035,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
if (block_faults) if (block_faults)
filemap_invalidate_unlock(inode->i_mapping); filemap_invalidate_unlock(inode->i_mapping);
if (lock_inode) inode_unlock(inode);
inode_unlock(inode);
fuse_flush_time_update(inode); fuse_flush_time_update(inode);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment