f2fs: synchronize atomic write aborts

To fix a race condition between atomic write aborts, I use the inode
lock and make COW inode to be re-usable thoroughout the whole
atomic file inode lifetime.

Reported-by: syzbot+823000d23b3400619f7c@syzkaller.appspotmail.com
Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 300eae8b54154cc78425044082008abd607bf6a4..6436c52e7913c235dde3ec84368e977f28c06dc7 100644 (file)
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1863,7 +1863,10 @@ static int f2fs_release_file(struct inode *inode, struct file *filp)
                        atomic_read(&inode->i_writecount) != 1)
                return 0;
 
+       inode_lock(inode);
        f2fs_abort_atomic_write(inode, true);
+       inode_unlock(inode);
+
        return 0;
 }
 
@@ -1878,8 +1881,12 @@ static int f2fs_file_flush(struct file *file, fl_owner_t id)
         * before dropping file lock, it needs to do in ->flush.
         */
        if (F2FS_I(inode)->atomic_write_task == current &&
-                               (current->flags & PF_EXITING))
+                               (current->flags & PF_EXITING)) {
+               inode_lock(inode);
                f2fs_abort_atomic_write(inode, true);
+               inode_unlock(inode);
+       }
+
        return 0;
 }
 
@@ -2085,19 +2092,28 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
                goto out;
        }
 
-       /* Create a COW inode for atomic write */
-       pinode = f2fs_iget(inode->i_sb, fi->i_pino);
-       if (IS_ERR(pinode)) {
-               f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
-               ret = PTR_ERR(pinode);
-               goto out;
-       }
+       /* Check if the inode already has a COW inode */
+       if (fi->cow_inode == NULL) {
+               /* Create a COW inode for atomic write */
+               pinode = f2fs_iget(inode->i_sb, fi->i_pino);
+               if (IS_ERR(pinode)) {
+                       f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
+                       ret = PTR_ERR(pinode);
+                       goto out;
+               }
 
-       ret = f2fs_get_tmpfile(mnt_userns, pinode, &fi->cow_inode);
-       iput(pinode);
-       if (ret) {
-               f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
-               goto out;
+               ret = f2fs_get_tmpfile(mnt_userns, pinode, &fi->cow_inode);
+               iput(pinode);
+               if (ret) {
+                       f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
+                       goto out;
+               }
+
+               set_inode_flag(fi->cow_inode, FI_COW_FILE);
+               clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);
+       } else {
+               /* Reuse the already created COW inode */
+               f2fs_do_truncate_blocks(fi->cow_inode, 0, true);
        }
 
        f2fs_write_inode(inode, NULL);
@@ -2105,8 +2121,6 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
        stat_inc_atomic_inode(inode);
 
        set_inode_flag(inode, FI_ATOMIC_FILE);
-       set_inode_flag(fi->cow_inode, FI_COW_FILE);
-       clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);
 
        isize = i_size_read(inode);
        fi->original_i_size = isize;

diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index 2c250120d5da15f5c015de5a99b53b6b90ad3382..7d2e2c0dba65cc3e4c26f9473dace273d25b3068 100644 (file)
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -767,11 +767,18 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc)
 void f2fs_evict_inode(struct inode *inode)
 {
        struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
-       nid_t xnid = F2FS_I(inode)->i_xattr_nid;
+       struct f2fs_inode_info *fi = F2FS_I(inode);
+       nid_t xnid = fi->i_xattr_nid;
        int err = 0;
 
        f2fs_abort_atomic_write(inode, true);
 
+       if (fi->cow_inode) {
+               clear_inode_flag(fi->cow_inode, FI_COW_FILE);
+               iput(fi->cow_inode);
+               fi->cow_inode = NULL;
+       }
+
        trace_f2fs_evict_inode(inode);
        truncate_inode_pages_final(&inode->i_data);
 
@@ -856,7 +863,7 @@ no_delete:
        stat_dec_inline_inode(inode);
        stat_dec_compr_inode(inode);
        stat_sub_compr_blocks(inode,
-                       atomic_read(&F2FS_I(inode)->i_compr_blocks));
+                       atomic_read(&fi->i_compr_blocks));
 
        if (likely(!f2fs_cp_error(sbi) &&
                                !is_sbi_flag_set(sbi, SBI_CP_DISABLED)))

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index ead3f35f501d77f3c14e6d16e3f5f4abad1cd5c9..719329c1808c13c5d8c3294256d11bc9e20b4993 100644 (file)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -192,9 +192,6 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)
        if (!f2fs_is_atomic_file(inode))
                return;
 
-       clear_inode_flag(fi->cow_inode, FI_COW_FILE);
-       iput(fi->cow_inode);
-       fi->cow_inode = NULL;
        release_atomic_write_cnt(inode);
        clear_inode_flag(inode, FI_ATOMIC_COMMITTED);
        clear_inode_flag(inode, FI_ATOMIC_REPLACE);

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index c11a161ba5bec73c774dfba4e3d9d144b761caf1..aa55dc12aff2e9e3786c1838612bef5ff10585c3 100644 (file)
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1427,8 +1427,6 @@ static int f2fs_drop_inode(struct inode *inode)
                        atomic_inc(&inode->i_count);
                        spin_unlock(&inode->i_lock);
 
-                       f2fs_abort_atomic_write(inode, true);
-
                        /* should remain fi->extent_tree for writepage */
                        f2fs_destroy_extent_node(inode);