Commit 95207d55 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'iomap-5.5-merge-14' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull iomap fixes from Darrick Wong:
 "Fix a race condition and a use-after-free error:

   - Fix a UAF when reporting writeback errors

   - Fix a race condition when handling page uptodate on fragmented file
     with blocksize < pagesize"

* tag 'iomap-5.5-merge-14' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  iomap: stop using ioend after it's been freed in iomap_finish_ioend()
  iomap: fix sub-page uptodate handling
parents 50caca9d c275779f
...@@ -28,6 +28,7 @@ ...@@ -28,6 +28,7 @@
struct iomap_page { struct iomap_page {
atomic_t read_count; atomic_t read_count;
atomic_t write_count; atomic_t write_count;
spinlock_t uptodate_lock;
DECLARE_BITMAP(uptodate, PAGE_SIZE / 512); DECLARE_BITMAP(uptodate, PAGE_SIZE / 512);
}; };
...@@ -51,6 +52,7 @@ iomap_page_create(struct inode *inode, struct page *page) ...@@ -51,6 +52,7 @@ iomap_page_create(struct inode *inode, struct page *page)
iop = kmalloc(sizeof(*iop), GFP_NOFS | __GFP_NOFAIL); iop = kmalloc(sizeof(*iop), GFP_NOFS | __GFP_NOFAIL);
atomic_set(&iop->read_count, 0); atomic_set(&iop->read_count, 0);
atomic_set(&iop->write_count, 0); atomic_set(&iop->write_count, 0);
spin_lock_init(&iop->uptodate_lock);
bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE); bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE);
/* /*
...@@ -139,25 +141,38 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, ...@@ -139,25 +141,38 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
} }
static void static void
iomap_set_range_uptodate(struct page *page, unsigned off, unsigned len) iomap_iop_set_range_uptodate(struct page *page, unsigned off, unsigned len)
{ {
struct iomap_page *iop = to_iomap_page(page); struct iomap_page *iop = to_iomap_page(page);
struct inode *inode = page->mapping->host; struct inode *inode = page->mapping->host;
unsigned first = off >> inode->i_blkbits; unsigned first = off >> inode->i_blkbits;
unsigned last = (off + len - 1) >> inode->i_blkbits; unsigned last = (off + len - 1) >> inode->i_blkbits;
unsigned int i;
bool uptodate = true; bool uptodate = true;
unsigned long flags;
unsigned int i;
if (iop) { spin_lock_irqsave(&iop->uptodate_lock, flags);
for (i = 0; i < PAGE_SIZE / i_blocksize(inode); i++) { for (i = 0; i < PAGE_SIZE / i_blocksize(inode); i++) {
if (i >= first && i <= last) if (i >= first && i <= last)
set_bit(i, iop->uptodate); set_bit(i, iop->uptodate);
else if (!test_bit(i, iop->uptodate)) else if (!test_bit(i, iop->uptodate))
uptodate = false; uptodate = false;
} }
}
if (uptodate && !PageError(page)) if (uptodate)
SetPageUptodate(page);
spin_unlock_irqrestore(&iop->uptodate_lock, flags);
}
static void
iomap_set_range_uptodate(struct page *page, unsigned off, unsigned len)
{
if (PageError(page))
return;
if (page_has_private(page))
iomap_iop_set_range_uptodate(page, off, len);
else
SetPageUptodate(page); SetPageUptodate(page);
} }
...@@ -1128,6 +1143,7 @@ iomap_finish_ioend(struct iomap_ioend *ioend, int error) ...@@ -1128,6 +1143,7 @@ iomap_finish_ioend(struct iomap_ioend *ioend, int error)
struct bio *bio = &ioend->io_inline_bio; struct bio *bio = &ioend->io_inline_bio;
struct bio *last = ioend->io_bio, *next; struct bio *last = ioend->io_bio, *next;
u64 start = bio->bi_iter.bi_sector; u64 start = bio->bi_iter.bi_sector;
loff_t offset = ioend->io_offset;
bool quiet = bio_flagged(bio, BIO_QUIET); bool quiet = bio_flagged(bio, BIO_QUIET);
for (bio = &ioend->io_inline_bio; bio; bio = next) { for (bio = &ioend->io_inline_bio; bio; bio = next) {
...@@ -1148,12 +1164,12 @@ iomap_finish_ioend(struct iomap_ioend *ioend, int error) ...@@ -1148,12 +1164,12 @@ iomap_finish_ioend(struct iomap_ioend *ioend, int error)
iomap_finish_page_writeback(inode, bv->bv_page, error); iomap_finish_page_writeback(inode, bv->bv_page, error);
bio_put(bio); bio_put(bio);
} }
/* The ioend has been freed by bio_put() */
if (unlikely(error && !quiet)) { if (unlikely(error && !quiet)) {
printk_ratelimited(KERN_ERR printk_ratelimited(KERN_ERR
"%s: writeback error on inode %lu, offset %lld, sector %llu", "%s: writeback error on inode %lu, offset %lld, sector %llu",
inode->i_sb->s_id, inode->i_ino, ioend->io_offset, inode->i_sb->s_id, inode->i_ino, offset, start);
start);
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment