mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 17:59:32 +00:00
fuse: fix fallocate vs. ftruncate race
A former patch introducing FUSE_I_SIZE_UNSTABLE flag provided detailed description of races between ftruncate and anyone who can extend i_size: > 1. As in the previous scenario fuse_dentry_revalidate() discovered that i_size > changed (due to our own fuse_do_setattr()) and is going to call > truncate_pagecache() for some 'new_size' it believes valid right now. But by > the time that particular truncate_pagecache() is called ... > 2. fuse_do_setattr() returns (either having called truncate_pagecache() or > not -- it doesn't matter). > 3. The file is extended either by write(2) or ftruncate(2) or fallocate(2). > 4. mmap-ed write makes a page in the extended region dirty. This patch adds necessary bits to fuse_file_fallocate() to protect from that race. Signed-off-by: Maxim Patlasov <mpatlasov@parallels.com> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> Cc: stable@vger.kernel.org
This commit is contained in:
parent
bde52788bd
commit
0ab08f576b
1 changed files with 7 additions and 0 deletions
|
@ -2467,6 +2467,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
|
|||
{
|
||||
struct fuse_file *ff = file->private_data;
|
||||
struct inode *inode = file->f_inode;
|
||||
struct fuse_inode *fi = get_fuse_inode(inode);
|
||||
struct fuse_conn *fc = ff->fc;
|
||||
struct fuse_req *req;
|
||||
struct fuse_fallocate_in inarg = {
|
||||
|
@ -2495,6 +2496,9 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
|
|||
}
|
||||
}
|
||||
|
||||
if (!(mode & FALLOC_FL_KEEP_SIZE))
|
||||
set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
|
||||
|
||||
req = fuse_get_req_nopages(fc);
|
||||
if (IS_ERR(req)) {
|
||||
err = PTR_ERR(req);
|
||||
|
@ -2527,6 +2531,9 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
|
|||
fuse_invalidate_attr(inode);
|
||||
|
||||
out:
|
||||
if (!(mode & FALLOC_FL_KEEP_SIZE))
|
||||
clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
|
||||
|
||||
if (lock_inode)
|
||||
mutex_unlock(&inode->i_mutex);
|
||||
|
||||
|
|
Loading…
Reference in a new issue