• Maxim Patlasov's avatar
    fuse: postpone end_page_writeback() in fuse_writepage_locked() · 4a4ac4eb
    Maxim Patlasov authored
    The patch fixes a race between ftruncate(2), mmap-ed write and write(2):
    1) An user makes a page dirty via mmap-ed write.
    2) The user performs shrinking truncate(2) intended to purge the page.
    3) Before fuse_do_setattr calls truncate_pagecache, the page goes to
       writeback. fuse_writepage_locked fills FUSE_WRITE request and releases
       the original page by end_page_writeback.
    4) fuse_do_setattr() completes and successfully returns. Since now, i_mutex
       is free.
    5) Ordinary write(2) extends i_size back to cover the page. Note that
       fuse_send_write_pages do wait for fuse writeback, but for another
    6) fuse_writepage_locked proceeds by queueing FUSE_WRITE request.
       fuse_send_writepage is supposed to crop inarg->size of the request,
       but it doesn't because i_size has already been extended back.
    Moving end_page_writeback to the end of fuse_writepage_locked fixes the
    race because now the fact that truncate_pagecache is successfully returned
    infers that fuse_writepage_locked has already called end_page_writeback.
    And this, in turn, infers that fuse_flush_writepages has already called
    fuse_send_writepage, and the latter used valid (shrunk) i_size. write(2)
    could not extend it because of i_mutex held by ftruncate(2).
    Signed-off-by: default avatarMaxim Patlasov <mpatlasov@parallels.com>
    Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
    Cc: stable@vger.kernel.org
file.c 62.2 KB