xfs: use iolock on XFS_IOC_ALLOCSP calls

fsstress has a particular effective way of stopping debug XFS
kernels. We keep seeing assert failures due finding delayed
allocation extents where there should be none. This shows up when
extracting extent maps and we are holding all the locks we should be
to prevent races, so this really makes no sense to see these errors.

After checking that fsstress does not use mmap, it occurred to me
that fsstress uses something that no sane application uses - the
XFS_IOC_ALLOCSP ioctl interfaces for preallocation. These interfaces
do allocation of blocks beyond EOF without using preallocation, and
then call setattr to extend and zero the allocated blocks.

THe problem here is this is a buffered write, and hence the
allocation is a delayed allocation. Unlike the buffered IO path, the
allocation and zeroing are not serialised using the IOLOCK. Hence
the ALLOCSP operation can race with operations holding the iolock to
prevent buffered IO operations from occurring.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>

1 files changed, 19 insertions, 3 deletions

diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 6c187450f1c8..9b6c94e7546e 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -2315,17 +2315,33 @@ xfs_change_file_space(
         case XFS_IOC_ALLOCSP64:
         case XFS_IOC_FREESP:
         case XFS_IOC_FREESP64:
+                /*
+                 * These operations actually do IO when extending the file, but
+                 * the allocation is done seperately to the zeroing that is
+                 * done. This set of operations need to be serialised against
+                 * other IO operations, such as truncate and buffered IO. We
+                 * need to take the IOLOCK here to serialise the allocation and
+                 * zeroing IO to prevent other IOLOCK holders (e.g. getbmap,
+                 * truncate, direct IO) from racing against the transient
+                 * allocated but not written state we can have here.
+                 */
+                xfs_ilock(ip, XFS_IOLOCK_EXCL);
                 if (startoffset > fsize) {
                         error = xfs_alloc_file_space(ip, fsize,
-                                        startoffset - fsize, 0, attr_flags);
-                        if (error)
+                                        startoffset - fsize, 0,
+                                        attr_flags | XFS_ATTR_NOLOCK);
+                        if (error) {
+                                xfs_iunlock(ip, XFS_IOLOCK_EXCL);
                                 break;
+                        }
                 }
 
                 iattr.ia_valid = ATTR_SIZE;
                 iattr.ia_size = startoffset;
 
-                error = xfs_setattr_size(ip, &iattr, attr_flags);
+                error = xfs_setattr_size(ip, &iattr,
+                                         attr_flags | XFS_ATTR_NOLOCK);
+                xfs_iunlock(ip, XFS_IOLOCK_EXCL);
 
                 if (error)
                         return error;