Please cherry pick: ext4: fix data corruption for mmap writes

[Theodore Ts'o <tytso@mit.edu>]

The following patch has already been cherry picked into 3.2 and 3.16
stable trees by Ben Hutchings, but for some reason isn't in the 3.18,
4.1, 4.4, and 4.9 stable kernels.

a056bdaae7a1: ext4: fix data corruption for mmap writes

This commit is needed to fix xfstests test: generic/438


The upstream commit cherry-picks cleanly into the 4.9 stable kernel
tree.

For the 4.4, 4.1, and 3.18 trees, I had to adjust the patch slightly
after doing the cherry-pick.  The attached patch will work for the
other stable trees.

Many thanks!!

					- Ted

>From 9e0379a7e181a0eaff09db9b924f7bafeafe03ef Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Fri, 26 May 2017 17:45:45 -0400
Subject: [PATCH] ext4: fix data corruption for mmap writes

mpage_submit_page() can race with another process growing i_size and
writing data via mmap to the written-back page. As mpage_submit_page()
samples i_size too early, it may happen that ext4_bio_write_page()
zeroes out too large tail of the page and thus corrupts user data.

Fix the problem by sampling i_size only after the page has been
write-protected in page tables by clear_page_dirty_for_io() call.

Reported-by: Michael Zimmer <michael@swarm64.com>
CC: stable@vger.kernel.org
Fixes: cb20d5188366f04d96d2e07b1240cc92170ade40
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
(cherry picked from commit a056bdaae7a181f7dcc876cfab2f94538e508709)
---
 fs/ext4/inode.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 1796d1bd9a1d..194a6baa4283 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1946,15 +1946,29 @@ static int ext4_writepage(struct page *page,
 static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
 {
 	int len;
-	loff_t size = i_size_read(mpd->inode);
+	loff_t size;
 	int err;
 
 	BUG_ON(page->index != mpd->first_page);
-	if (page->index == size >> PAGE_CACHE_SHIFT)
-		len = size & ~PAGE_CACHE_MASK;
-	else
-		len = PAGE_CACHE_SIZE;
 	clear_page_dirty_for_io(page);
+	/*
+	 * We have to be very careful here!  Nothing protects writeback path
+	 * against i_size changes and the page can be writeably mapped into
+	 * page tables. So an application can be growing i_size and writing
+	 * data through mmap while writeback runs. clear_page_dirty_for_io()
+	 * write-protects our page in page tables and the page cannot get
+	 * written to again until we release page lock. So only after
+	 * clear_page_dirty_for_io() we are safe to sample i_size for
+	 * ext4_bio_write_page() to zero-out tail of the written page. We rely
+	 * on the barrier provided by TestClearPageDirty in
+	 * clear_page_dirty_for_io() to make sure i_size is really sampled only
+	 * after page tables are updated.
+	 */
+	size = i_size_read(mpd->inode);
+	if (page->index == size >> PAGE_SHIFT)
+		len = size & ~PAGE_MASK;
+	else
+		len = PAGE_SIZE;
 	err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc, false);
 	if (!err)
 		mpd->wbc->nr_to_write--;
-- 
2.11.0.rc0.7.gbe5a750