[PATCH 0/2] fuse: zero the partial EOF page when extending a file

[Jimmy Zuber <jamz@amazon.com>]

Extending a fuse file past a non-page-aligned EOF does not zero the tail of
the old last page.  When that page is cached and has been mmap-dirtied
beyond the old EOF, the now in-bounds tail is served to later reads as stale
data rather than zeros, which violates POSIX file-extension semantics.

This is the same class of bug that commit b1817b18ff20 ("NFS: Protect
against 'eof page pollution'") fixed for the NFS client; fuse has the
equivalent gap on its non-writeback_cache, FOPEN_KEEP_CACHE path.
pagecache_isize_extended() cannot be reused because it is a no-op when
i_blocksize() >= PAGE_SIZE, which always holds for a non-fuseblk mount, so
patch 1 open-codes the zeroing and calls it from all three paths that extend
a file: buffered write, setattr/truncate, and fallocate.  Patch 2 adds a
self-contained raw /dev/fuse selftest covering each path; every case fails
without patch 1 and passes with it.

Tested by booting the patched kernel under User-Mode Linux and running the
new selftest (4/4 pass; 4/4 fail without patch 1), and reproduced against
libfuse's passthrough_ll example daemon (-o cache=always,no_writeback).

Jimmy Zuber (2):
  fuse: zero the partial EOF page when extending a file
  selftests/fuse: test post-EOF page zeroing when a file is extended

 fs/fuse/dir.c                                 |   3 +
 fs/fuse/file.c                                |  56 +++
 fs/fuse/fuse_i.h                              |   1 +
 .../selftests/filesystems/fuse/.gitignore     |   1 +
 .../selftests/filesystems/fuse/Makefile       |   3 +
 .../filesystems/fuse/write_extend_eof_test.c  | 368 ++++++++++++++++++
 6 files changed, 432 insertions(+)
 create mode 100644 tools/testing/selftests/filesystems/fuse/write_extend_eof_test.c


base-commit: 7d87a5a284bb34edb3f4e7e312ef403b3385a7b7
-- 
2.50.1