diff options
author | Jan Kara <jack@suse.com> | 2015-12-07 14:28:03 -0500 |
---|---|---|
committer | Sasha Levin <sasha.levin@oracle.com> | 2016-03-23 10:20:24 -0400 |
commit | 248766f068fd1d3d95479f470bc926d1136141d6 (patch) | |
tree | 50c8e96205dc16b98359ddfa78bb08df259545a0 /fs/ext4/super.c | |
parent | 14b4d1419ee6e71e672926d90a5bd87f698014d3 (diff) |
ext4: fix races between page faults and hole punching
Currently, page faults and hole punching are completely unsynchronized.
This can result in page fault faulting in a page into a range that we
are punching after truncate_pagecache_range() has been called and thus
we can end up with a page mapped to disk blocks that will be shortly
freed. Filesystem corruption will shortly follow. Note that the same
race is avoided for truncate by checking page fault offset against
i_size but there isn't similar mechanism available for punching holes.
Fix the problem by creating new rw semaphore i_mmap_sem in inode and
grab it for writing over truncate, hole punching, and other functions
removing blocks from extent tree and for read over page faults. We
cannot easily use i_data_sem for this since that ranks below transaction
start and we need something ranking above it so that it can be held over
the whole truncate / hole punching operation. Also remove various
workarounds we had in the code to reduce race window when page fault
could have created pages with stale mapping information.
Signed-off-by: Jan Kara <jack@suse.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Mingming Cao <mingming.cao@oracle.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Diffstat (limited to 'fs/ext4/super.c')
-rw-r--r-- | fs/ext4/super.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 8a3b9f14d198..6f5ca3e92246 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -945,6 +945,7 @@ static void init_once(void *foo) INIT_LIST_HEAD(&ei->i_orphan); init_rwsem(&ei->xattr_sem); init_rwsem(&ei->i_data_sem); + init_rwsem(&ei->i_mmap_sem); inode_init_once(&ei->vfs_inode); } |