From: Daeho Jeong <daehojeong@google.com>

Date: Thu, 9 Feb 2023 10:18:19 -0800

Subject: [PATCH] f2fs: synchronize atomic write aborts

References: bsc#1012628

Patch-mainline: 6.2.5

Git-commit: a46bebd502fe1a3bd1d22f64cedd93e7e7702693

[ Upstream commit a46bebd502fe1a3bd1d22f64cedd93e7e7702693 ]

To fix a race condition between atomic write aborts, I use the inode

lock and make COW inode to be re-usable thoroughout the whole

atomic file inode lifetime.

Reported-by: syzbot+823000d23b3400619f7c@syzkaller.appspotmail.com

Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")

Signed-off-by: Daeho Jeong <daehojeong@google.com>

Reviewed-by: Chao Yu <chao@kernel.org>

Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

Signed-off-by: Sasha Levin <sashal@kernel.org>

Signed-off-by: Jiri Slaby <jslaby@suse.cz>

---

 fs/f2fs/file.c    | 44 +++++++++++++++++++++++++++++---------------

 fs/f2fs/inode.c   | 11 +++++++++--

 fs/f2fs/segment.c |  3 ---

 fs/f2fs/super.c   |  2 --

 4 files changed, 38 insertions(+), 22 deletions(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c

index 8583c098..05297427 100644

--- a/fs/f2fs/file.c

+++ b/fs/f2fs/file.c

@@ -1867,7 +1867,10 @@ static int f2fs_release_file(struct inode *inode, struct file *filp)

 			atomic_read(&inode->i_writecount) != 1)

 		return 0;

+	inode_lock(inode);

 	f2fs_abort_atomic_write(inode, true);

+	inode_unlock(inode);

+

 	return 0;

 }

@@ -1882,8 +1885,12 @@ static int f2fs_file_flush(struct file *file, fl_owner_t id)

 	 * before dropping file lock, it needs to do in ->flush.

 	 */

 	if (F2FS_I(inode)->atomic_write_task == current &&

-				(current->flags & PF_EXITING))

+				(current->flags & PF_EXITING)) {

+		inode_lock(inode);

 		f2fs_abort_atomic_write(inode, true);

+		inode_unlock(inode);

+	}

+

 	return 0;

 }

@@ -2089,19 +2096,28 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)

 		goto out;

 	}

-	/* Create a COW inode for atomic write */

-	pinode = f2fs_iget(inode->i_sb, fi->i_pino);

-	if (IS_ERR(pinode)) {

-		f2fs_up_write(&fi->i_gc_rwsem[WRITE]);

-		ret = PTR_ERR(pinode);

-		goto out;

-	}

+	/* Check if the inode already has a COW inode */

+	if (fi->cow_inode == NULL) {

+		/* Create a COW inode for atomic write */

+		pinode = f2fs_iget(inode->i_sb, fi->i_pino);

+		if (IS_ERR(pinode)) {

+			f2fs_up_write(&fi->i_gc_rwsem[WRITE]);

+			ret = PTR_ERR(pinode);

+			goto out;

+		}

-	ret = f2fs_get_tmpfile(mnt_userns, pinode, &fi->cow_inode);

-	iput(pinode);

-	if (ret) {

-		f2fs_up_write(&fi->i_gc_rwsem[WRITE]);

-		goto out;

+		ret = f2fs_get_tmpfile(mnt_userns, pinode, &fi->cow_inode);

+		iput(pinode);

+		if (ret) {

+			f2fs_up_write(&fi->i_gc_rwsem[WRITE]);

+			goto out;

+		}

+

+		set_inode_flag(fi->cow_inode, FI_COW_FILE);

+		clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);

+	} else {

+		/* Reuse the already created COW inode */

+		f2fs_do_truncate_blocks(fi->cow_inode, 0, true);

 	}

 	f2fs_write_inode(inode, NULL);

@@ -2109,8 +2125,6 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)

 	stat_inc_atomic_inode(inode);

 	set_inode_flag(inode, FI_ATOMIC_FILE);

-	set_inode_flag(fi->cow_inode, FI_COW_FILE);

-	clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);

 	isize = i_size_read(inode);

 	fi->original_i_size = isize;

diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c

index 622eb796..f438f39a 100644

--- a/fs/f2fs/inode.c

+++ b/fs/f2fs/inode.c

@@ -767,11 +767,18 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc)

 void f2fs_evict_inode(struct inode *inode)

 {

 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);

-	nid_t xnid = F2FS_I(inode)->i_xattr_nid;

+	struct f2fs_inode_info *fi = F2FS_I(inode);

+	nid_t xnid = fi->i_xattr_nid;

 	int err = 0;

 	f2fs_abort_atomic_write(inode, true);

+	if (fi->cow_inode) {

+		clear_inode_flag(fi->cow_inode, FI_COW_FILE);

+		iput(fi->cow_inode);

+		fi->cow_inode = NULL;

+	}

+

 	trace_f2fs_evict_inode(inode);

 	truncate_inode_pages_final(&inode->i_data);

@@ -858,7 +865,7 @@ void f2fs_evict_inode(struct inode *inode)

 	stat_dec_inline_inode(inode);

 	stat_dec_compr_inode(inode);

 	stat_sub_compr_blocks(inode,

-			atomic_read(&F2FS_I(inode)->i_compr_blocks));

+			atomic_read(&fi->i_compr_blocks));

 	if (likely(!f2fs_cp_error(sbi) &&

 				!is_sbi_flag_set(sbi, SBI_CP_DISABLED)))

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c

index 06cae552..269f89d2 100644

--- a/fs/f2fs/segment.c

+++ b/fs/f2fs/segment.c

@@ -192,9 +192,6 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)

 	if (!f2fs_is_atomic_file(inode))

 		return;

-	clear_inode_flag(fi->cow_inode, FI_COW_FILE);

-	iput(fi->cow_inode);

-	fi->cow_inode = NULL;

 	release_atomic_write_cnt(inode);

 	clear_inode_flag(inode, FI_ATOMIC_COMMITTED);

 	clear_inode_flag(inode, FI_ATOMIC_REPLACE);

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c

index 53878feb..551468da 100644

--- a/fs/f2fs/super.c

+++ b/fs/f2fs/super.c

@@ -1430,8 +1430,6 @@ static int f2fs_drop_inode(struct inode *inode)

 			atomic_inc(&inode->i_count);

 			spin_unlock(&inode->i_lock);

-			f2fs_abort_atomic_write(inode, true);

-

 			/* should remain fi->extent_tree for writepage */

 			f2fs_destroy_extent_node(inode);

-- 

2.35.3