summaryrefslogtreecommitdiff
path: root/fs/ext4/truncate.h
diff options
context:
space:
mode:
authorJan Kara <jack@suse.com>2015-12-07 22:28:03 +0300
committerTheodore Ts'o <tytso@mit.edu>2015-12-07 22:28:03 +0300
commitea3d7209ca01da209cda6f0dea8be9cc4b7a933b (patch)
tree809b37322befdf8dda2d12b991d1c832241bc8bc /fs/ext4/truncate.h
parentf41683a204ea61568f0fd0804d47c19561f2ee39 (diff)
downloadlinux-ea3d7209ca01da209cda6f0dea8be9cc4b7a933b.tar.xz
ext4: fix races between page faults and hole punching
Currently, page faults and hole punching are completely unsynchronized. This can result in page fault faulting in a page into a range that we are punching after truncate_pagecache_range() has been called and thus we can end up with a page mapped to disk blocks that will be shortly freed. Filesystem corruption will shortly follow. Note that the same race is avoided for truncate by checking page fault offset against i_size but there isn't similar mechanism available for punching holes. Fix the problem by creating new rw semaphore i_mmap_sem in inode and grab it for writing over truncate, hole punching, and other functions removing blocks from extent tree and for read over page faults. We cannot easily use i_data_sem for this since that ranks below transaction start and we need something ranking above it so that it can be held over the whole truncate / hole punching operation. Also remove various workarounds we had in the code to reduce race window when page fault could have created pages with stale mapping information. Signed-off-by: Jan Kara <jack@suse.com> Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Diffstat (limited to 'fs/ext4/truncate.h')
-rw-r--r--fs/ext4/truncate.h2
1 files changed, 2 insertions, 0 deletions
diff --git a/fs/ext4/truncate.h b/fs/ext4/truncate.h
index 011ba6670d99..c70d06a383e2 100644
--- a/fs/ext4/truncate.h
+++ b/fs/ext4/truncate.h
@@ -10,8 +10,10 @@
*/
static inline void ext4_truncate_failed_write(struct inode *inode)
{
+ down_write(&EXT4_I(inode)->i_mmap_sem);
truncate_inode_pages(inode->i_mapping, inode->i_size);
ext4_truncate(inode);
+ up_write(&EXT4_I(inode)->i_mmap_sem);
}
/*