[PATCH v8 13/15] xfs: resample the extsize hint after taking the ILOCK

[Chris Mason <mason@kernel.org>]

A write fault on a file with an extent size hint can overrun its block
reservation and shut down the filesystem, if it races with a change of
the hint or of the realtime flag.

xfs_iomap_write_direct() sizes the reservation from the hint and the
flag before xfs_trans_alloc_inode() takes the ILOCK, and the allocator
reads both again under it. But a write fault only holds the MMAPLOCK,
and FS_IOC_FSSETXATTR changes both on a file with no blocks without it:

    write fault                         FS_IOC_FSSETXATTR
    ===========                         =================
    xfs_iomap_write_direct()
      hint is 1 block
      dblocks = 1 + bmbt blocks
                                        xfs_ilock(ILOCK_EXCL)
                                        hint = 4096 blocks
                                        xfs_iunlock(ILOCK_EXCL)
      xfs_trans_alloc_inode()
      xfs_bmapi_write()
        allocates 4096 blocks
        xfs_trans_mod_sb()
          t_blk_res_used > t_blk_res

The fix used here is to compare both with the values that sized the
reservation once the ILOCK is held, and to start over if either has
changed.

Signed-off-by: Chris Mason <mason@kernel.org>
---

Notes:
    v7->v8:
    - New patch.

 fs/xfs/xfs_iomap.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index b414e2cff346..7fb61f56a414 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -295,9 +295,11 @@ xfs_iomap_write_direct(
 	struct xfs_mount	*mp = ip->i_mount;
 	struct xfs_trans	*tp;
 	xfs_filblks_t		resaligned;
+	xfs_extlen_t		extsz;
 	int			nimaps;
 	unsigned int		dblocks, rblocks;
 	bool			force = false;
+	bool			rt;
 	int			error;
 	int			bmapi_flags = XFS_BMAPI_PREALLOC;
 	int			nr_exts = XFS_IEXT_ADD_NOSPLIT_CNT;
@@ -312,9 +314,11 @@ xfs_iomap_write_direct(
 	 */
 	count_fsb = min_t(xfs_filblks_t, count_fsb, XFS_MAX_BMBT_EXTLEN);
 
-	resaligned = xfs_aligned_fsb_count(offset_fsb, count_fsb,
-					   xfs_get_extsz_hint(ip));
-	if (unlikely(XFS_IS_REALTIME_INODE(ip))) {
+retry:
+	extsz = xfs_get_extsz_hint(ip);
+	rt = XFS_IS_REALTIME_INODE(ip);
+	resaligned = xfs_aligned_fsb_count(offset_fsb, count_fsb, extsz);
+	if (unlikely(rt)) {
 		dblocks = XFS_DIOSTRAT_SPACE_RES(mp, 0);
 		rblocks = resaligned;
 	} else {
@@ -358,6 +362,17 @@ xfs_iomap_write_direct(
 		goto out_trans_cancel;
 	}
 
+	/*
+	 * A write fault doesn't hold the IOLOCK, so what sized the reservation
+	 * can change until we hold the ILOCK.
+	 */
+	if (extsz != xfs_get_extsz_hint(ip) ||
+	    rt != XFS_IS_REALTIME_INODE(ip)) {
+		xfs_trans_cancel(tp);
+		xfs_iunlock(ip, XFS_ILOCK_EXCL);
+		goto retry;
+	}
+
 	error = xfs_iext_count_extend(tp, ip, XFS_DATA_FORK, nr_exts);
 	if (error)
 		goto out_trans_cancel;
-- 
2.55.0