ext4: fix races between page faults and hole punching

Currently, page faults and hole punching are completely unsynchronized.
This can result in page fault faulting in a page into a range that we
are punching after truncate_pagecache_range() has been called and thus
we can end up with a page mapped to disk blocks that will be shortly
freed. Filesystem corruption will shortly follow. Note that the same
race is avoided for truncate by checking page fault offset against
i_size but there isn't similar mechanism available for punching holes.

Fix the problem by creating new rw semaphore i_mmap_sem in inode and
grab it for writing over truncate, hole punching, and other functions
removing blocks from extent tree and for read over page faults. We
cannot easily use i_data_sem for this since that ranks below transaction
start and we need something ranking above it so that it can be held over
the whole truncate / hole punching operation. Also remove various
workarounds we had in the code to reduce race window when page fault
could have created pages with stale mapping information.

Signed-off-by: Jan Kara <jack@suse.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

1 files changed, 27 insertions, 9 deletions

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ea433a7f4bca..d1207d03c961 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3623,6 +3623,15 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
 
         }
 
+        /* Wait all existing dio workers, newcomers will block on i_mutex */
+        ext4_inode_block_unlocked_dio(inode);
+        inode_dio_wait(inode);
+
+        /*
+         * Prevent page faults from reinstantiating pages we have released from
+         * page cache.
+         */
+        down_write(&EXT4_I(inode)->i_mmap_sem);
         first_block_offset = round_up(offset, sb->s_blocksize);
         last_block_offset = round_down((offset + length), sb->s_blocksize) - 1;
 
@@ -3631,10 +3640,6 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
                 truncate_pagecache_range(inode, first_block_offset,
                                          last_block_offset);
 
-        /* Wait all existing dio workers, newcomers will block on i_mutex */
-        ext4_inode_block_unlocked_dio(inode);
-        inode_dio_wait(inode);
-
         if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
                 credits = ext4_writepage_trans_blocks(inode);
         else
@@ -3680,16 +3685,12 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length)
         if (IS_SYNC(inode))
                 ext4_handle_sync(handle);
 
-        /* Now release the pages again to reduce race window */
-        if (last_block_offset > first_block_offset)
-                truncate_pagecache_range(inode, first_block_offset,
-                                         last_block_offset);
-
         inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
         ext4_mark_inode_dirty(handle, inode);
 out_stop:
         ext4_journal_stop(handle);
 out_dio:
+        up_write(&EXT4_I(inode)->i_mmap_sem);
         ext4_inode_resume_unlocked_dio(inode);
 out_mutex:
         mutex_unlock(&inode->i_mutex);
@@ -4823,6 +4824,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
                         } else
                                 ext4_wait_for_tail_page_commit(inode);
                 }
+                down_write(&EXT4_I(inode)->i_mmap_sem);
                 /*
                  * Truncate pagecache after we've waited for commit
                  * in data=journal mode to make pages freeable.
@@ -4830,6 +4832,7 @@ int ext4_setattr(struct dentry *dentry, struct iattr *attr)
                 truncate_pagecache(inode, inode->i_size);
                 if (shrink)
                         ext4_truncate(inode);
+                up_write(&EXT4_I(inode)->i_mmap_sem);
         }
 
         if (!rc) {
@@ -5278,6 +5281,8 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
 
         sb_start_pagefault(inode->i_sb);
         file_update_time(vma->vm_file);
+
+        down_read(&EXT4_I(inode)->i_mmap_sem);
         /* Delalloc case is easy... */
         if (test_opt(inode->i_sb, DELALLOC) &&
             !ext4_should_journal_data(inode) &&
@@ -5347,6 +5352,19 @@ retry_alloc:
 out_ret:
         ret = block_page_mkwrite_return(ret);
 out:
+        up_read(&EXT4_I(inode)->i_mmap_sem);
         sb_end_pagefault(inode->i_sb);
         return ret;
 }
+
+int ext4_filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        struct inode *inode = file_inode(vma->vm_file);
+        int err;
+
+        down_read(&EXT4_I(inode)->i_mmap_sem);
+        err = filemap_fault(vma, vmf);
+        up_read(&EXT4_I(inode)->i_mmap_sem);
+
+        return err;
+}