[PATCH v9 13/14] xfs: don't enable DAX on zoned inodes

[Chris Mason <mason@kernel.org>]

A store through a shared mapping can dereference a NULL pointer if the
file is zoned and has S_DAX.

The zoned code does not support DAX, but XFS doesn't check for this:
with dax=always or FS_XFLAG_DAX, an inode gets S_DAX if its device does
DAX, and an internal zoned section on pmem does. The write fault then
takes the zoned path:

    xfs_filemap_fault()
      xfs_write_fault()
        xfs_write_fault_zoned()
          page_folio(vmf->page)     /* NULL in a DAX fault */

ftruncate() crashes in a similar way, in xfs_reflink_end_cow().

The fix used here is to never set S_DAX on a zoned inode, and to refuse
to change the realtime flag of an S_DAX inode on a zoned file system.

Zoned files now use the page cache with dax=always or FS_XFLAG_DAX. A
file whose realtime flag is cleared stays without DAX until its inode
is evicted.

Fixes: be458049ffe3 ("xfs: enable the zoned RT device feature")
Signed-off-by: Chris Mason <mason@kernel.org>
---

Notes:
    v8->v9:
    - The commit log and the comments say that the zoned code does not
      support DAX, no longer that it cannot (Christoph Hellwig).
    - The commit log no longer says that ftruncate() only crashes on kernels
      without an earlier patch of the series. That patch has lost the test
      that stopped it.
    - Was 15/15.
    
    v7->v8:
    - New patch.

 fs/xfs/xfs_ioctl.c | 8 +++++---
 fs/xfs/xfs_iops.c  | 4 ++++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index af13ad6784b7..49ba762ea969 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -564,11 +564,13 @@ xfs_ioctl_setattr_xflags(
 
 		/*
 		 * If S_DAX is enabled on this file, we can only switch the
-		 * device if both support fsdax.  We can't update S_DAX because
-		 * there might be other threads walking down the access paths.
+		 * device if both support fsdax, and the zoned code does not.
+		 * We can't update S_DAX because there might be other threads
+		 * walking down the access paths.
 		 */
 		if (IS_DAX(VFS_I(ip)) &&
-		    (mp->m_ddev_targp->bt_daxdev == NULL ||
+		    (xfs_has_zoned(mp) ||
+		     mp->m_ddev_targp->bt_daxdev == NULL ||
 		     (mp->m_rtdev_targp &&
 		      mp->m_rtdev_targp->bt_daxdev == NULL)))
 			return -EINVAL;
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index d307ec97fac8..a84a4c1c3fc2 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -1373,6 +1373,10 @@ xfs_inode_supports_dax(
 	if (mp->m_sb.sb_blocksize != PAGE_SIZE)
 		return false;
 
+	/* The zoned code does not support DAX. */
+	if (xfs_is_zoned_inode(ip))
+		return false;
+
 	/* Device has to support DAX too. */
 	return xfs_inode_buftarg(ip)->bt_daxdev != NULL;
 }
-- 
2.55.0