[PATCH v9 11/14] xfs: take the MMAPLOCK in xfs_fileattr_set()

[Chris Mason <mason@kernel.org>]

A store through a shared mapping can corrupt a realtime file system on
disk, or shut a file system down, if FS_IOC_FSSETXATTR changes the
realtime flag or an extent size hint of the file during the write fault.

A write fault reads the flag and the hints more than once: to choose
delayed allocation, to size the block reservation, and again in the
allocator. All of these have to see the same values. System calls that
write do the same, but they hold the IOLOCK, which keeps the ioctl out.
A fault only holds the MMAPLOCK, which the ioctl does not take:

    write fault                         FS_IOC_FSSETXATTR
    ===========                         =================
    takes the MMAPLOCK
    xfs_iomap_write_direct()
      reserves blocks for the old hint
                                        takes the ILOCK
                                        raises the hint
                                        drops the ILOCK
      takes the ILOCK
      xfs_bmapi_write()
        allocates for the new hint
        /* more than was reserved */

The fix used here is to make the ioctl take the MMAPLOCK of a regular
file as well.

Signed-off-by: Chris Mason <mason@kernel.org>
---

Notes:
    v8->v9:
    - New patch.

 fs/xfs/xfs_inode.c |  3 ++-
 fs/xfs/xfs_ioctl.c | 17 +++++++++++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index cb61305e4b80..0584ad11f92b 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -134,7 +134,8 @@ xfs_lock_flags_assert(
  * take both the i_rwsem and the invalidate_lock. These locks should *only* be
  * both taken in places where we need to invalidate the page cache in a race
  * free manner (e.g. truncate, hole punch and other extent manipulation
- * functions).
+ * functions), or where we change inode attributes that both kinds of IO rely
+ * on (xfs_fileattr_set).
  */
 void
 xfs_ilock(
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index f81b6e52ac40..af13ad6784b7 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -757,6 +757,7 @@ xfs_fileattr_set(
 	struct xfs_trans	*tp;
 	struct xfs_dquot	*pdqp = NULL;
 	struct xfs_dquot	*olddquot = NULL;
+	bool			isreg = S_ISREG(VFS_I(ip)->i_mode);
 	int			error;
 
 	trace_xfs_ioctl_setattr(ip);
@@ -804,10 +805,18 @@ xfs_fileattr_set(
 
 	xfs_ioctl_setattr_prepare_dax(ip, fa);
 
+	/*
+	 * A write fault only holds the MMAPLOCK, and it looks at the realtime
+	 * flag and at the extent size hints more than once.  Only regular files
+	 * have write faults.
+	 */
+	if (isreg)
+		xfs_ilock(ip, XFS_MMAPLOCK_EXCL);
+
 	tp = xfs_ioctl_setattr_get_trans(ip, pdqp);
 	if (IS_ERR(tp)) {
 		error = PTR_ERR(tp);
-		goto error_free_dquots;
+		goto error_unlock;
 	}
 
 	error = xfs_ioctl_setattr_check_extsize(ip, fa);
@@ -864,6 +873,8 @@ xfs_fileattr_set(
 
 skip_xattr:
 	error = xfs_trans_commit(tp);
+	if (isreg)
+		xfs_iunlock(ip, XFS_MMAPLOCK_EXCL);
 
 	/*
 	 * Release any dquot(s) the inode had kept before chown.
@@ -875,7 +886,9 @@ xfs_fileattr_set(
 
 error_trans_cancel:
 	xfs_trans_cancel(tp);
-error_free_dquots:
+error_unlock:
+	if (isreg)
+		xfs_iunlock(ip, XFS_MMAPLOCK_EXCL);
 	xfs_qm_dqrele(pdqp);
 	return error;
 }
-- 
2.55.0