Re: [[ EXT ]] [BUG REPORT] cifs/smb data corruption when writing, x86_64, kernel 6.6.71

[David Howells <dhowells@redhat.com>]

Shyam Prasad N <nspmangalore@gmail.com> wrote:

> 4. Page 2 is now written to by the next write, which extends the file
> by another 5k. Page 2 and 3 are now marked dirty.

It sounds like this is the crux of the problem.

The caller, cifs_write_back_from_locked_folio() has a stale copy of ->i_size.

I think we need to do one or more of:

 (1) our copy of i_size should be updated by cifs_extend_writeback() whilst we
     hold the lock on a folio

 (2) we should reject on what appears (given the stale i_size) to be a partial
     folio if inode->i_size changed

 (3) cifs_extend_writeback() should just stop - and maybe abandon the current
     batch - if it sees i_size has changed.

     Note that abandoning the contents of the batch rather than doing the
     flag-flipping loop is fine as they're merely locked to that point and we
     don't have to reverse the PG_dirty -> PG_write transition.

David