* Re: [PATCH v4 10/25] iomap: teach iomap to handle fsverity holes and verify data holes
From: Christoph Hellwig @ 2026-03-10 9:14 UTC (permalink / raw)
To: Andrey Albershteyn
Cc: linux-xfs, fsverity, linux-fsdevel, ebiggers, hch, linux-ext4,
linux-f2fs-devel, linux-btrfs, djwong
In-Reply-To: <20260309192355.176980-11-aalbersh@kernel.org>
On Mon, Mar 09, 2026 at 08:23:25PM +0100, Andrey Albershteyn wrote:
> + /*
> + * Handling of fsverity "holes". We hit this for two case:
> + * 1. No need to go further, the hole after fsverity
> + * descriptor is the end of the fsverity metadata.
> + *
> + * 2. This folio contains merkle tree blocks which need to be
> + * synthesized. If we already have fsverity info (ctx->vi)
> + * synthesize these blocks.
> + */
> + if ((iomap->flags & IOMAP_F_FSVERITY) &&
> + iomap->type == IOMAP_HOLE) {
> + /*
> + * Don't cause lookup if we already have fsverity
> + * context from the previous tree hole
> + */
> + if (!ctx->vi)
> + ctx->vi = fsverity_get_info(iter->inode);
This makes the ctx->vi rules really weird, as it;s only set for
the file data initially, but can later get set here for reading the
fsverity data. I think it might be better to just always set it in
the higher level code if fsveirty is active, and then document how
our rules subtly differ from ext4/f2fs.
^ permalink raw reply
* Re: [PATCH v4 17/25] xfs: use read ioend for fsverity data verification
From: Christoph Hellwig @ 2026-03-10 9:11 UTC (permalink / raw)
To: Andrey Albershteyn
Cc: linux-xfs, fsverity, linux-fsdevel, ebiggers, hch, linux-ext4,
linux-f2fs-devel, linux-btrfs, djwong
In-Reply-To: <20260309192355.176980-18-aalbersh@kernel.org>
On Mon, Mar 09, 2026 at 08:23:32PM +0100, Andrey Albershteyn wrote:
> - if (bio_op(&ioend->io_bio) == REQ_OP_READ)
> + if (bio_op(&ioend->io_bio) == REQ_OP_READ) {
> + if (xfs_fsverity_is_file_data(ip, ioend->io_offset))
> + fsverity_verify_bio(ioend->io_vi,
> + &ioend->io_bio);
> iomap_finish_ioends(ioend,
> blk_status_to_errno(ioend->io_bio.bi_status));
If bi_status is non-zero, there is no point in doing the verification.
> - else
> + } else {
> xfs_end_ioend_write(ioend);
> + }
Also now that the code is non-trivial I'd add a xfs_end_ioend_read
mirroring xfs_end_ioend_write.
> @@ -764,9 +774,12 @@ xfs_bio_submit_read(
> struct iomap_read_folio_ctx *ctx)
> {
> struct bio *bio = ctx->read_ctx;
> + struct iomap_ioend *ioend;
>
> /* defer read completions to the ioend workqueue */
> - iomap_init_ioend(iter->inode, bio, ctx->read_ctx_file_offset, 0);
> + ioend = iomap_init_ioend(iter->inode, bio, ctx->read_ctx_file_offset, 0);
Overly long line.
> if (bdev_has_integrity_csum(xfs_inode_buftarg(ip)->bt_bdev))
> return &xfs_iomap_read_ops;
> + if (xfs_fsverity_is_file_data(ip, position))
> + return &xfs_iomap_read_ops;
use || here instead of two checks?
> +{
> + const struct inode *inode = VFS_IC(ip);
> +
> + return fsverity_active(inode) &&
> + offset < xfs_fsverity_metadata_offset(ip);
Just open code the XFS_IC instead of a single use local variable?
^ permalink raw reply
* Re: [PATCH v4 09/25] iomap: issue readahead for fsverity merkle tree
From: Christoph Hellwig @ 2026-03-10 8:45 UTC (permalink / raw)
To: Andrey Albershteyn
Cc: linux-xfs, fsverity, linux-fsdevel, ebiggers, hch, linux-ext4,
linux-f2fs-devel, linux-btrfs, djwong
In-Reply-To: <20260309192355.176980-10-aalbersh@kernel.org>
On Mon, Mar 09, 2026 at 08:23:24PM +0100, Andrey Albershteyn wrote:
> Issue reading of fsverity merkle tree on the fsverity inodes. This way
> metadata will be available at I/O completion time.
The change itself looks good, but we'll also need this for
iomap_readahead and not just iomap_read_folio.
^ permalink raw reply
* Re: [PATCH v4 08/25] iomap: obtain fsverity info for read path
From: Christoph Hellwig @ 2026-03-10 8:44 UTC (permalink / raw)
To: Andrey Albershteyn
Cc: linux-xfs, fsverity, linux-fsdevel, ebiggers, hch, linux-ext4,
linux-f2fs-devel, linux-btrfs, djwong
In-Reply-To: <20260309192355.176980-9-aalbersh@kernel.org>
Looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply
* Re: [PATCH v4 07/25] iomap: introduce IOMAP_F_FSVERITY and teach writeback to handle fsverity
From: Christoph Hellwig @ 2026-03-10 8:44 UTC (permalink / raw)
To: Andrey Albershteyn
Cc: linux-xfs, fsverity, linux-fsdevel, ebiggers, hch, linux-ext4,
linux-f2fs-devel, linux-btrfs, djwong
In-Reply-To: <20260309192355.176980-8-aalbersh@kernel.org>
> +static bool iomap_writeback_handle_eof(struct folio *folio,
> + struct iomap_writepage_ctx *wpc,
> + u64 *end_pos)
Please keep the old double tab indentation here instead of this very
hard to read and modify version.
Otherwise this looks good.
^ permalink raw reply
* Re: [PATCH 12/32] hugetlbfs: Stop using i_private_data
From: kernel test robot @ 2026-03-10 7:24 UTC (permalink / raw)
To: Jan Kara
Cc: oe-lkp, lkp, linux-mm, ltp, linux-fsdevel, Christian Brauner,
Al Viro, linux-ext4, Ted Tso, Tigran A. Aivazian, David Sterba,
OGAWA Hirofumi, Muchun Song, Oscar Salvador, David Hildenbrand,
linux-aio, Benjamin LaHaise, Jan Kara, oliver.sang
In-Reply-To: <20260303103406.4355-44-jack@suse.cz>
Hello,
kernel test robot noticed "BUG:KASAN:wild-memory-access_in_raw_spin_lock" on:
commit: 75576f3c4ced72ab572ee9275b464cd79763fd85 ("[PATCH 12/32] hugetlbfs: Stop using i_private_data")
url: https://github.com/intel-lab-lkp/linux/commits/Jan-Kara/fat-Sync-and-invalidate-metadata-buffers-from-fat_evict_inode/20260303-183910
base: https://git.kernel.org/cgit/linux/kernel/git/vfs/vfs.git vfs.all
patch link: https://lore.kernel.org/all/20260303103406.4355-44-jack@suse.cz/
patch subject: [PATCH 12/32] hugetlbfs: Stop using i_private_data
in testcase: ltp
version:
with following parameters:
test: hugetlb
config: x86_64-rhel-9.4-ltp
compiler: gcc-14
test machine: 8 threads 1 sockets Intel(R) Core(TM) i7-7700 CPU @ 3.60GHz (Kaby Lake) with 32G memory
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202603101532.fecbeae3-lkp@intel.com
[ 270.445802][ T4529] BUG: KASAN: wild-memory-access in _raw_spin_lock (include/linux/instrumented.h:55 include/linux/atomic/atomic-instrumented.h:1301 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:159 kernel/locking/spinlock.c:154)
[ 270.453010][ T4529] Write of size 4 at addr ccccccccccccccd0 by task hugefallocate01/4529
[ 270.461165][ T4529]
[ 270.463347][ T4529] CPU: 2 UID: 0 PID: 4529 Comm: hugefallocate01 Tainted: G S I 7.0.0-rc1-00214-g75576f3c4ced #1 PREEMPT(lazy)
[ 270.463352][ T4529] Tainted: [S]=CPU_OUT_OF_SPEC, [I]=FIRMWARE_WORKAROUND
[ 270.463353][ T4529] Hardware name: Dell Inc. OptiPlex 7050/062KRH, BIOS 1.2.0 12/22/2016
[ 270.463355][ T4529] Call Trace:
[ 270.463356][ T4529] <TASK>
[ 270.463358][ T4529] dump_stack_lvl (lib/dump_stack.c:122)
[ 270.463362][ T4529] ? _raw_spin_lock (include/linux/instrumented.h:55 include/linux/atomic/atomic-instrumented.h:1301 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:159 kernel/locking/spinlock.c:154)
[ 270.463365][ T4529] kasan_report (mm/kasan/report.c:597)
[ 270.463369][ T4529] ? _raw_spin_lock (include/linux/instrumented.h:55 include/linux/atomic/atomic-instrumented.h:1301 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:159 kernel/locking/spinlock.c:154)
[ 270.463372][ T4529] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1))
[ 270.463374][ T4529] _raw_spin_lock (include/linux/instrumented.h:55 include/linux/atomic/atomic-instrumented.h:1301 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:159 kernel/locking/spinlock.c:154)
[ 270.463377][ T4529] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153)
[ 270.463380][ T4529] ? filemap_get_folios_tag (include/linux/pagevec.h:56 mm/filemap.c:2359)
[ 270.463384][ T4529] region_del (mm/hugetlb.c:864)
[ 270.463387][ T4529] hugetlb_unreserve_pages (mm/hugetlb.c:6757)
[ 270.463390][ T4529] remove_inode_hugepages (fs/hugetlbfs/inode.c:616)
[ 270.463394][ T4529] ? __pfx_remove_inode_hugepages (fs/hugetlbfs/inode.c:579)
[ 270.463398][ T4529] ? stack_trace_save (kernel/stacktrace.c:123)
[ 270.463403][ T4529] ? __pfx_stack_trace_save (kernel/stacktrace.c:114)
[ 270.463407][ T4529] ? stack_depot_save_flags (lib/stackdepot.c:667)
[ 270.463411][ T4529] ? kasan_save_stack (mm/kasan/common.c:59)
[ 270.463413][ T4529] ? kasan_save_stack (mm/kasan/common.c:58)
[ 270.463415][ T4529] ? kasan_record_aux_stack (mm/kasan/generic.c:556 (discriminator 1))
[ 270.463417][ T4529] ? __call_rcu_common+0xc9/0x970
[ 270.463421][ T4529] ? deactivate_locked_super (fs/super.c:476)
[ 270.463426][ T4529] ? cleanup_mnt (fs/namespace.c:227 fs/namespace.c:1313)
[ 270.463430][ T4529] ? inode_wait_for_writeback (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/atomic/atomic-instrumented.h:33 include/asm-generic/qspinlock.h:57 fs/fs-writeback.c:1598)
[ 270.463433][ T4529] ? __pfx_inode_wait_for_writeback (fs/fs-writeback.c:1594)
[ 270.463455][ T4529] ? __call_rcu_common+0xc9/0x970
[ 270.463458][ T4529] ? task_work_run (kernel/task_work.c:235)
[ 270.463460][ T4529] ? exit_to_user_mode_loop (include/linux/memcontrol.h:915 (discriminator 2) include/linux/resume_user_mode.h:59 (discriminator 2) kernel/entry/common.c:67 (discriminator 2) kernel/entry/common.c:98 (discriminator 2))
[ 270.463463][ T4529] ? do_syscall_64 (include/linux/irq-entry-common.h:226 include/linux/irq-entry-common.h:256 include/linux/entry-common.h:325 arch/x86/entry/syscall_64.c:100)
[ 270.463465][ T4529] ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 270.463468][ T4529] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 (discriminator 4) include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) include/asm-generic/qspinlock.h:111 (discriminator 4) include/linux/spinlock.h:187 (discriminator 4) include/linux/spinlock_api_smp.h:159 (discriminator 4) kernel/locking/spinlock.c:154 (discriminator 4))
[ 270.463483][ T4529] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153)
[ 270.463486][ T4529] hugetlbfs_evict_inode (fs/hugetlbfs/inode.c:625 (discriminator 1))
[ 270.463489][ T4529] evict (fs/inode.c:849)
[ 270.463507][ T4529] ? __pfx_evict (fs/inode.c:822)
[ 270.463511][ T4529] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153)
[ 270.463514][ T4529] ? _raw_spin_trylock (arch/x86/include/asm/atomic.h:107 (discriminator 4) include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) include/asm-generic/qspinlock.h:97 (discriminator 4) include/linux/spinlock.h:193 (discriminator 4) include/linux/spinlock_api_smp.h:90 (discriminator 4) kernel/locking/spinlock.c:138 (discriminator 4))
[ 270.463517][ T4529] ? iput (fs/inode.c:1963 fs/inode.c:2012 fs/inode.c:1975)
[ 270.463519][ T4529] __dentry_kill (fs/dcache.c:673 (discriminator 51))
[ 270.463522][ T4529] finish_dput (fs/dcache.c:879)
[ 270.463525][ T4529] shrink_dcache_for_umount (fs/dcache.c:920 fs/dcache.c:1657 fs/dcache.c:1671)
[ 270.463528][ T4529] ? __pfx___call_rcu_common+0x10/0x10
[ 270.463531][ T4529] generic_shutdown_super (fs/super.c:625)
[ 270.463534][ T4529] kill_anon_super (fs/super.c:437 fs/super.c:1293)
[ 270.463536][ T4529] deactivate_locked_super (fs/super.c:437 fs/super.c:478)
[ 270.463538][ T4529] cleanup_mnt (fs/namespace.c:227 fs/namespace.c:1313)
[ 270.463540][ T4529] task_work_run (kernel/task_work.c:235)
[ 270.463543][ T4529] ? __pfx_task_work_run (kernel/task_work.c:201)
[ 270.463545][ T4529] ? __x64_sys_umount (fs/namespace.c:2065 fs/namespace.c:2070 fs/namespace.c:2068 fs/namespace.c:2068)
[ 270.463547][ T4529] exit_to_user_mode_loop (include/linux/memcontrol.h:915 (discriminator 2) include/linux/resume_user_mode.h:59 (discriminator 2) kernel/entry/common.c:67 (discriminator 2) kernel/entry/common.c:98 (discriminator 2))
[ 270.463550][ T4529] do_syscall_64 (include/linux/irq-entry-common.h:226 include/linux/irq-entry-common.h:256 include/linux/entry-common.h:325 arch/x86/entry/syscall_64.c:100)
[ 270.463552][ T4529] ? __pfx_vfs_write (fs/read_write.c:669)
[ 270.463555][ T4529] ? fdget_pos (include/linux/atomic/atomic-arch-fallback.h:479 (discriminator 2) include/linux/atomic/atomic-instrumented.h:50 (discriminator 2) fs/file.c:1196 (discriminator 2) fs/file.c:1210 (discriminator 2) fs/file.c:1256 (discriminator 2))
[ 270.463558][ T4529] ? fdget_pos (include/linux/atomic/atomic-arch-fallback.h:479 (discriminator 2) include/linux/atomic/atomic-instrumented.h:50 (discriminator 2) fs/file.c:1196 (discriminator 2) fs/file.c:1210 (discriminator 2) fs/file.c:1256 (discriminator 2))
[ 270.463560][ T4529] ? ksys_write (fs/read_write.c:740)
[ 270.463563][ T4529] ? ksys_write (fs/read_write.c:740)
[ 270.463566][ T4529] ? __pfx_ksys_write (fs/read_write.c:730)
[ 270.463571][ T4529] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:296 include/linux/entry-common.h:327 arch/x86/entry/syscall_64.c:100)
[ 270.463574][ T4529] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:296 include/linux/entry-common.h:327 arch/x86/entry/syscall_64.c:100)
[ 270.463578][ T4529] ? irqentry_exit (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:296 include/linux/irq-entry-common.h:341 kernel/entry/common.c:219)
[ 270.463581][ T4529] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 270.463583][ T4529] RIP: 0033:0x7fc1ffd84217
[ 270.463586][ T4529] Code: 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 c9 4b 0d 00 f7 d8 64 89 02 b8
All code
========
0: 0d 00 f7 d8 64 or $0x64d8f700,%eax
5: 89 02 mov %eax,(%rdx)
7: b8 ff ff ff ff mov $0xffffffff,%eax
c: c3 ret
d: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
13: 31 f6 xor %esi,%esi
15: e9 09 00 00 00 jmp 0x23
1a: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1)
21: 00 00
23: b8 a6 00 00 00 mov $0xa6,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 01 ja 0x33
32: c3 ret
33: 48 8b 15 c9 4b 0d 00 mov 0xd4bc9(%rip),%rdx # 0xd4c03
3a: f7 d8 neg %eax
3c: 64 89 02 mov %eax,%fs:(%rdx)
3f: b8 .byte 0xb8
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 01 ja 0x9
8: c3 ret
9: 48 8b 15 c9 4b 0d 00 mov 0xd4bc9(%rip),%rdx # 0xd4bd9
10: f7 d8 neg %eax
12: 64 89 02 mov %eax,%fs:(%rdx)
15: b8 .byte 0xb8
[ 270.463588][ T4529] RSP: 002b:00007ffc300541e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 270.463592][ T4529] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fc1ffd84217
[ 270.463593][ T4529] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000056024b59b06a
[ 270.463595][ T4529] RBP: 00007ffc30054470 R08: 0000000000000000 R09: 0000000000000000
[ 270.463596][ T4529] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
[ 270.463598][ T4529] R13: 000056024b59b06a R14: 000056024b59b7d0 R15: 000056024b59f8b0
[ 270.463600][ T4529] </TASK>
[ 270.463601][ T4529] ==================================================================
[ 270.864814][ T4529] Disabling lock debugging due to kernel taint
[ 270.870833][ T4529] Oops: general protection fault, probably for non-canonical address 0xccccccccccccccd0: 0000 [#1] SMP KASAN PTI
[ 270.882549][ T4529] CPU: 2 UID: 0 PID: 4529 Comm: hugefallocate01 Tainted: G S B I 7.0.0-rc1-00214-g75576f3c4ced #1 PREEMPT(lazy)
[ 270.895404][ T4529] Tainted: [S]=CPU_OUT_OF_SPEC, [B]=BAD_PAGE, [I]=FIRMWARE_WORKAROUND
[ 270.903398][ T4529] Hardware name: Dell Inc. OptiPlex 7050/062KRH, BIOS 1.2.0 12/22/2016
[ 270.911474][ T4529] RIP: 0010:_raw_spin_lock (arch/x86/include/asm/atomic.h:107 (discriminator 4) include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) include/asm-generic/qspinlock.h:111 (discriminator 4) include/linux/spinlock.h:187 (discriminator 4) include/linux/spinlock_api_smp.h:159 (discriminator 4) kernel/locking/spinlock.c:154 (discriminator 4))
[ 270.916599][ T4529] Code: be 04 00 00 00 c7 44 24 20 00 00 00 00 e8 8f 19 e5 fd be 04 00 00 00 48 8d 7c 24 20 e8 80 19 e5 fd ba 01 00 00 00 8b 44 24 20 <f0> 0f b1 13 75 2d 48 b8 00 00 00 00 00 fc ff df 48 c7 44 05 00 00
All code
========
0: be 04 00 00 00 mov $0x4,%esi
5: c7 44 24 20 00 00 00 movl $0x0,0x20(%rsp)
c: 00
d: e8 8f 19 e5 fd call 0xfffffffffde519a1
12: be 04 00 00 00 mov $0x4,%esi
17: 48 8d 7c 24 20 lea 0x20(%rsp),%rdi
1c: e8 80 19 e5 fd call 0xfffffffffde519a1
21: ba 01 00 00 00 mov $0x1,%edx
26: 8b 44 24 20 mov 0x20(%rsp),%eax
2a:* f0 0f b1 13 lock cmpxchg %edx,(%rbx) <-- trapping instruction
2e: 75 2d jne 0x5d
30: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
37: fc ff df
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 44 rex.R
3d: 05 .byte 0x5
...
Code starting with the faulting instruction
===========================================
0: f0 0f b1 13 lock cmpxchg %edx,(%rbx)
4: 75 2d jne 0x33
6: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
d: fc ff df
10: 48 rex.W
11: c7 .byte 0xc7
12: 44 rex.R
13: 05 .byte 0x5
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260310/202603101532.fecbeae3-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH] jbd2: gracefully abort on checkpointing state corruptions
From: Andreas Dilger @ 2026-03-10 4:58 UTC (permalink / raw)
To: Milos Nikic; +Cc: jack, tytso, linux-ext4, linux-kernel
In-Reply-To: <20260309230838.422074-1-nikic.milos@gmail.com>
On Mar 9, 2026, at 17:08, Milos Nikic <nikic.milos@gmail.com> wrote:
>
> This patch targets two internal state machine invariants in checkpoint.c
> residing inside functions that natively return integer error codes.
>
> - In jbd2_cleanup_journal_tail(): A blocknr of 0 indicates a severely
> corrupted journal superblock. Replaced the J_ASSERT with a WARN_ON_ONCE
> and a graceful journal abort, returning -EUCLEAN.
>
> - In jbd2_log_do_checkpoint(): Replaced the J_ASSERT_BH checking for
> an unexpected buffer_jwrite state. If the warning triggers, we
> explicitly drop the just-taken get_bh() reference and call __flush_batch()
> to safely clean up any previously queued buffers in the j_chkpt_bhs array,
> preventing a memory leak before returning -EUCLEAN.
>
> Signed-off-by: Milos Nikic <nikic.milos@gmail.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca <mailto:adilger@dilger.ca>>
> ---
> fs/jbd2/checkpoint.c | 17 +++++++++++++++--
> 1 file changed, 15 insertions(+), 2 deletions(-)
>
> diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
> index de89c5bef607..cdfbfd27afae 100644
> --- a/fs/jbd2/checkpoint.c
> +++ b/fs/jbd2/checkpoint.c
> @@ -267,7 +267,17 @@ int jbd2_log_do_checkpoint(journal_t *journal)
> */
> BUFFER_TRACE(bh, "queue");
> get_bh(bh);
> - J_ASSERT_BH(bh, !buffer_jwrite(bh));
> + if (WARN_ON_ONCE(buffer_jwrite(bh))) {
> + put_bh(bh); /* drop the ref we just took */
> + spin_unlock(&journal->j_list_lock);
> + jbd2_journal_abort(journal, -EUCLEAN);
> +
> + /* Clean up any previously batched buffers */
> + if (batch_count)
> + __flush_batch(journal, &batch_count);
> +
> + return -EUCLEAN;
> + }
> journal->j_chkpt_bhs[batch_count++] = bh;
> transaction->t_chp_stats.cs_written++;
> transaction->t_checkpoint_list = jh->b_cpnext;
> @@ -325,7 +335,10 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
>
> if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
> return 1;
> - J_ASSERT(blocknr != 0);
> + if (WARN_ON_ONCE(blocknr == 0)) {
> + jbd2_journal_abort(journal, -EUCLEAN);
> + return -EUCLEAN;
> + }
>
> /*
> * We need to make sure that any blocks that were recently written out
> --
> 2.53.0
>
>
^ permalink raw reply
* Re: [PATCH] mm/slab: fix an incorrect check in obj_exts_alloc_size()
From: Zw Tang @ 2026-03-10 3:40 UTC (permalink / raw)
To: Harry Yoo
Cc: adilger.kernel, akpm, cgroups, hannes, hao.li, linux-ext4,
linux-fsdevel, linux-kernel, linux-mm, vbabka, cl, rientjes,
roman.gushchin, viro, surenb, stable
In-Reply-To: <20260309072219.22653-1-harry.yoo@oracle.com>
Hi Harry,
Thanks for the patch.
I tested it on my environment with the original syzkaller reproducer,
and the warning no longer reproduces after applying the patch.
Kernel version tested: v7.0-rc2
Tested-by: Zw Tang shicenci@gmail.com
Best regards,
Zw Tang
Harry Yoo <harry.yoo@oracle.com> 于2026年3月9日周一 15:22写道：
>
> obj_exts_alloc_size() prevents recursive allocation of slabobj_ext
> array from the same cache, to avoid creating slabs that are never freed.
>
> There is one mistake that returns the original size when memory
> allocation profiling is disabled. The assumption was that
> memcg-triggered slabobj_ext allocation is always served from
> KMALLOC_CGROUP type. But this is wrong [1]: when the caller specifies
> both __GFP_RECLAIMABLE and __GFP_ACCOUNT with SLUB_TINY enabled, the
> allocation is served from normal kmalloc. This is because kmalloc_type()
> prioritizes __GFP_RECLAIMABLE over __GFP_ACCOUNT, and SLUB_TINY aliases
> KMALLOC_RECLAIM with KMALLOC_NORMAL.
>
> As a result, the recursion guard is bypassed and the problematic slabs
> can be created. Fix this by removing the mem_alloc_profiling_enabled()
> check entirely. The remaining is_kmalloc_normal() check is still
> sufficient to detect whether the cache is of KMALLOC_NORMAL type and
> avoid bumping the size if it's not.
>
> Without SLUB_TINY, no functional change intended.
> With SLUB_TINY, allocations with __GFP_ACCOUNT|__GFP_RECLAIMABLE
> now allocate a larger array if the sizes equal.
>
> Reported-by: Zw Tang <shicenci@gmail.com>
> Fixes: 280ea9c3154b ("mm/slab: avoid allocating slabobj_ext array from its own slab")
> Closes: https://lore.kernel.org/linux-mm/CAPHJ_VKuMKSke8b11AZQw1PTSFN4n2C0gFxC6xGOG0ZLHgPmnA@mail.gmail.com [1]
> Cc: stable@vger.kernel.org
> Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
> ---
>
> Zw Tang, could you please confirm that the warning disappears
> on your test environment, with this patch applied?
>
> mm/slub.c | 7 -------
> 1 file changed, 7 deletions(-)
>
> diff --git a/mm/slub.c b/mm/slub.c
> index 20cb4f3b636d..6371838d2352 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -2119,13 +2119,6 @@ static inline size_t obj_exts_alloc_size(struct kmem_cache *s,
> size_t sz = sizeof(struct slabobj_ext) * slab->objects;
> struct kmem_cache *obj_exts_cache;
>
> - /*
> - * slabobj_ext array for KMALLOC_CGROUP allocations
> - * are served from KMALLOC_NORMAL caches.
> - */
> - if (!mem_alloc_profiling_enabled())
> - return sz;
> -
> if (sz > KMALLOC_MAX_CACHE_SIZE)
> return sz;
>
>
> base-commit: 6432f15c818cb30eec7c4ca378ecdebd9796f741
> --
> 2.43.0
>
^ permalink raw reply
* Re: [PATCH] mm/slab: fix an incorrect check in obj_exts_alloc_size()
From: Harry Yoo @ 2026-03-10 3:29 UTC (permalink / raw)
To: adilger.kernel, akpm, cgroups, hannes, hao.li, linux-ext4,
linux-fsdevel, linux-kernel, linux-mm, shicenci, vbabka, cl,
rientjes, roman.gushchin, viro, surenb, stable
In-Reply-To: <20260309072219.22653-1-harry.yoo@oracle.com>
On Mon, Mar 09, 2026 at 04:22:19PM +0900, Harry Yoo wrote:
> obj_exts_alloc_size() prevents recursive allocation of slabobj_ext
> array from the same cache, to avoid creating slabs that are never freed.
>
> There is one mistake that returns the original size when memory
> allocation profiling is disabled. The assumption was that
> memcg-triggered slabobj_ext allocation is always served from
> KMALLOC_CGROUP type. But this is wrong [1]: when the caller specifies
> both __GFP_RECLAIMABLE and __GFP_ACCOUNT with SLUB_TINY enabled, the
> allocation is served from normal kmalloc. This is because kmalloc_type()
> prioritizes __GFP_RECLAIMABLE over __GFP_ACCOUNT, and SLUB_TINY aliases
> KMALLOC_RECLAIM with KMALLOC_NORMAL.
>
> As a result, the recursion guard is bypassed and the problematic slabs
> can be created. Fix this by removing the mem_alloc_profiling_enabled()
> check entirely. The remaining is_kmalloc_normal() check is still
> sufficient to detect whether the cache is of KMALLOC_NORMAL type and
> avoid bumping the size if it's not.
>
> Without SLUB_TINY, no functional change intended.
> With SLUB_TINY, allocations with __GFP_ACCOUNT|__GFP_RECLAIMABLE
> now allocate a larger array if the sizes equal.
>
> Reported-by: Zw Tang <shicenci@gmail.com>
> Fixes: 280ea9c3154b ("mm/slab: avoid allocating slabobj_ext array from its own slab")
> Closes: https://lore.kernel.org/linux-mm/CAPHJ_VKuMKSke8b11AZQw1PTSFN4n2C0gFxC6xGOG0ZLHgPmnA@mail.gmail.com [1]
> Cc: stable@vger.kernel.org
> Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
> ---
>
> Zw Tang, could you please confirm that the warning disappears
> on your test environment, with this patch applied?
Oops, I think I saw Zw Tang's Tested-by: (thanks!), but appearently
it's not sent to linux-mm. Could you please add your Tested-by:
by replying to all, again?
--
Cheers,
Harry / Hyeonggon
^ permalink raw reply
* Re: [PATCH] mm/slab: fix an incorrect check in obj_exts_alloc_size()
From: Harry Yoo @ 2026-03-10 3:25 UTC (permalink / raw)
To: vbabka
Cc: adilger.kernel, akpm, cgroups, hannes, hao.li, linux-ext4,
linux-fsdevel, linux-kernel, linux-mm, shicenci, cl, rientjes,
roman.gushchin, viro, surenb, stable
In-Reply-To: <0a25d83b-c6ea-4230-a89d-1f496b91764c@kernel.org>
On Mon, Mar 09, 2026 at 03:00:17PM +0100, vbabka@kernel.org wrote:
> On 3/9/26 08:22, Harry Yoo wrote:
> > obj_exts_alloc_size() prevents recursive allocation of slabobj_ext
> > array from the same cache, to avoid creating slabs that are never freed.
> >
> > There is one mistake that returns the original size when memory
> > allocation profiling is disabled. The assumption was that
> > memcg-triggered slabobj_ext allocation is always served from
> > KMALLOC_CGROUP type. But this is wrong [1]: when the caller specifies
> > both __GFP_RECLAIMABLE and __GFP_ACCOUNT with SLUB_TINY enabled, the
> > allocation is served from normal kmalloc. This is because kmalloc_type()
> > prioritizes __GFP_RECLAIMABLE over __GFP_ACCOUNT, and SLUB_TINY aliases
> > KMALLOC_RECLAIM with KMALLOC_NORMAL.
>
> Hm that's suboptimal (leads to sparsely used obj_exts in normal kmalloc
> slabs) and maybe separately from this hotfix we could make sure that with
> SLUB_TINY, __GFP_ACCOUNT is preferred going forward?
To be honest, I don't a have strong opinion on that.
Is grouping by mobility (for anti-fragmentation less) important on
SLUB_TINY systems?
> > As a result, the recursion guard is bypassed and the problematic slabs
> > can be created. Fix this by removing the mem_alloc_profiling_enabled()
> > check entirely. The remaining is_kmalloc_normal() check is still
> > sufficient to detect whether the cache is of KMALLOC_NORMAL type and
> > avoid bumping the size if it's not.
> >
> > Without SLUB_TINY, no functional change intended.
> > With SLUB_TINY, allocations with __GFP_ACCOUNT|__GFP_RECLAIMABLE
> > now allocate a larger array if the sizes equal.
> >
> > Reported-by: Zw Tang <shicenci@gmail.com>
> > Fixes: 280ea9c3154b ("mm/slab: avoid allocating slabobj_ext array from its own slab")
> > Closes: https://lore.kernel.org/linux-mm/CAPHJ_VKuMKSke8b11AZQw1PTSFN4n2C0gFxC6xGOG0ZLHgPmnA@mail.gmail.com
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
>
> Added to slab/for-next-fixes, thanks!
Thanks!
--
Cheers,
Harry / Hyeonggon
^ permalink raw reply
* Re: [PATCH] ext4: convert inline data to extents when truncate exceeds inline size
From: Deepanshu Kartikey @ 2026-03-10 1:50 UTC (permalink / raw)
To: tytso, adilger.kernel
Cc: linux-ext4, linux-kernel, syzbot+7de5fe447862fc37576f
In-Reply-To: <20260207043607.1175976-1-kartikey406@gmail.com>
On Sat, Feb 7, 2026 at 10:06 AM Deepanshu Kartikey
<kartikey406@gmail.com> wrote:
>
> Add a check in ext4_setattr() to convert files from inline data storage
> to extent-based storage when truncate() grows the file size beyond the
> inline capacity. This prevents the filesystem from entering an
> inconsistent state where the inline data flag is set but the file size
> exceeds what can be stored inline.
>
> Without this fix, the following sequence causes a kernel BUG_ON():
>
> 1. Mount filesystem with inode that has inline flag set and small size
> 2. truncate(file, 50MB) - grows size but inline flag remains set
> 3. sendfile() attempts to write data
> 4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)
>
> The crash occurs because ext4_write_inline_data() expects inline storage
> to accommodate the write, but the actual inline capacity (~60 bytes for
> i_block + ~96 bytes for xattrs) is far smaller than the file size and
> write request.
>
> The fix checks if the new size from setattr exceeds the inode's actual
> inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to
> extent-based storage before proceeding with the size change.
>
> This addresses the root cause by ensuring the inline data flag and file
> size remain consistent during truncate operations.
>
> Reported-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=7de5fe447862fc37576f
> Tested-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
> ---
> fs/ext4/inode.c | 12 ++++++++++++
> 1 file changed, 12 insertions(+)
>
> diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
> index 0c466ccbed69..c3dc0422ff95 100644
> --- a/fs/ext4/inode.c
> +++ b/fs/ext4/inode.c
> @@ -5901,6 +5901,18 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
> if (attr->ia_size == inode->i_size)
> inc_ivers = false;
>
> + /*
> + * If file has inline data but new size exceeds inline capacity,
> + * convert to extent-based storage first to prevent inconsistent
> + * state (inline flag set but size exceeds inline capacity).
> + */
> + if (ext4_has_inline_data(inode) &&
> + attr->ia_size > EXT4_I(inode)->i_inline_size) {
> + error = ext4_convert_inline_data(inode);
> + if (error)
> + goto err_out;
> + }
> +
> if (shrink) {
> if (ext4_should_order_data(inode)) {
> error = ext4_begin_ordered_truncate(inode,
> --
> 2.43.0
>
Hi Ted, Andreas, and ext4 maintainers,
I submitted this patch on February 7th to fix a kernel BUG_ON in
ext4_write_inline_data() reported by syzbot:
https://syzkaller.appspot.com/bug?extid=7de5fe447862fc37576f
The patch adds inline->extent conversion in ext4_setattr() when truncate()
grows a file beyond inline capacity, preventing the filesystem from entering
an inconsistent state where the inline flag is set but size exceeds capacity.
I wanted to follow up to see if there are any comments or feedback on the
approach.
Original patch:
https://lore.kernel.org/all/20260207043607.1175976-1-kartikey406@gmail.com/T/
Thanks,
Deepanshu Kartikey
^ permalink raw reply
* Re: [PATCH] ext4: add bounds check in ext4_xattr_ibody_get() to prevent out-of-bounds access
From: Deepanshu Kartikey @ 2026-03-10 1:47 UTC (permalink / raw)
To: tytso, adilger.kernel
Cc: linux-ext4, linux-kernel, syzbot+fb32afec111a7d61b939
In-Reply-To: <20260224231429.31361-1-kartikey406@gmail.com>
On Wed, Feb 25, 2026 at 4:44 AM Deepanshu Kartikey
<kartikey406@gmail.com> wrote:
>
> When mounting a corrupted ext4 filesystem, the inode's i_extra_isize
> can be set to a value that leaves insufficient space in the inode for
> the inline xattr header and entries. While ext4_iget() validates that
> i_extra_isize fits within the inode size, it does not account for the
> additional sizeof(ext4_xattr_ibody_header) needed by IHDR/IFIRST.
>
> This results in IFIRST(header) pointing at or beyond ITAIL(raw_inode),
> leaving no room for even the 4-byte terminator entry. When
> xattr_find_entry() is subsequently called, IS_LAST_ENTRY() reads 4
> bytes from this out-of-bounds pointer, triggering a use-after-free.
>
> For example, with EXT4_INODE_SIZE=256 and i_extra_isize=124:
> - ext4_iget() check: 128 + 124 = 252 <= 256, passes
> - IFIRST = offset 252 + 4 (xattr header) = 256
> - ITAIL = 256
> - IS_LAST_ENTRY() reads 4 bytes at offset 256, past the inode buffer
>
> Fix this by validating in ext4_xattr_ibody_get() that there is enough
> space between IFIRST(header) and ITAIL for at least a 4-byte read
> before calling xattr_find_entry(). Return -EFSCORRUPTED if the inline
> xattr region is too small.
>
> Reported-by: syzbot+fb32afec111a7d61b939@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=fb32afec111a7d61b939
> Tested-by: syzbot+fb32afec111a7d61b939@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
> fs/ext4/xattr.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
> index 7bf9ba19a89d..5080ec44228a 100644
> --- a/fs/ext4/xattr.c
> +++ b/fs/ext4/xattr.c
> @@ -652,6 +652,13 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name,
> header = IHDR(inode, raw_inode);
> end = ITAIL(inode, raw_inode);
> entry = IFIRST(header);
> +
> + if ((void *)entry + sizeof(__u32) > end) {
> + EXT4_ERROR_INODE(inode, "inline xattr region overflow");
> + error = -EFSCORRUPTED;
> + goto cleanup;
> + }
> +
> error = xattr_find_entry(inode, &entry, end, name_index, name, 0);
> if (error)
> goto cleanup;
> --
> 2.34.1
>
Hi,
Gentle ping on this patch. It has been about two weeks since I
submitted it.
This fixes a KASAN use-after-free in xattr_find_entry() reported by
syzbot. The issue occurs when a corrupted ext4 filesystem has an
i_extra_isize value that leaves insufficient space for inline xattr
entries. The syzbot test has confirmed the fix.
syzbot report: https://syzkaller.appspot.com/bug?extid=fb32afec111a7d61b939
Please let me know if there are any concerns or if any changes are
needed.
Thanks,
Deepanshu Kartikey
^ permalink raw reply
* [PATCH 09/10] ext4: move zero partial block range functions out of active handle
From: Zhang Yi @ 2026-03-10 1:41 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
In-Reply-To: <20260310014101.4140698-1-yi.zhang@huaweicloud.com>
From: Zhang Yi <yi.zhang@huawei.com>
Move ext4_block_zero_eof() and ext4_zero_partial_blocks() calls out of
the active handle context, making them independent operations. This is
safe because it still ensures data is updated before metadata for
data=ordered mode and data=journal mode because we still zero data and
ordering data before modifying the metadata.
This change is required for iomap infrastructure conversion because the
iomap buffered I/O path does not use the same journal infrastructure for
partial block zeroing. The lock ordering of folio lock and starting
transactions is "folio lock -> transaction start", which is opposite of
the current path. Therefore, zeroing partial blocks cannot be performed
under the active handle.
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
fs/ext4/extents.c | 29 ++++++++++++-----------------
fs/ext4/inode.c | 36 ++++++++++++++++++------------------
2 files changed, 30 insertions(+), 35 deletions(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 57a686b600d9..81b9d5b4ad71 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4585,6 +4585,10 @@ static int ext4_alloc_file_blocks(struct file *file, loff_t offset, loff_t len,
credits = ext4_chunk_trans_blocks(inode, len_lblk);
depth = ext_depth(inode);
+ /* Zero to the end of the block containing i_size */
+ if (new_size && offset > old_size)
+ ext4_block_zero_eof(inode, old_size, LLONG_MAX);
+
retry:
while (len_lblk) {
/*
@@ -4623,10 +4627,8 @@ static int ext4_alloc_file_blocks(struct file *file, loff_t offset, loff_t len,
if (ext4_update_inode_size(inode, epos) & 0x1)
inode_set_mtime_to_ts(inode,
inode_get_ctime(inode));
- if (epos > old_size) {
+ if (epos > old_size)
pagecache_isize_extended(inode, old_size, epos);
- ext4_block_zero_eof(inode, old_size, epos);
- }
}
ret2 = ext4_mark_inode_dirty(handle, inode);
ext4_update_inode_fsync_trans(handle, inode, 1);
@@ -4668,7 +4670,7 @@ static long ext4_zero_range(struct file *file, loff_t offset,
loff_t align_start, align_end, new_size = 0;
loff_t end = offset + len;
unsigned int blocksize = i_blocksize(inode);
- int ret, flags, credits;
+ int ret, flags;
trace_ext4_zero_range(inode, offset, len, mode);
WARN_ON_ONCE(!inode_is_locked(inode));
@@ -4722,25 +4724,18 @@ static long ext4_zero_range(struct file *file, loff_t offset,
if (IS_ALIGNED(offset | end, blocksize))
return ret;
- /*
- * In worst case we have to writeout two nonadjacent unwritten
- * blocks and update the inode
- */
- credits = (2 * ext4_ext_index_trans_blocks(inode, 2)) + 1;
- if (ext4_should_journal_data(inode))
- credits += 2;
- handle = ext4_journal_start(inode, EXT4_HT_MISC, credits);
+ /* Zero out partial block at the edges of the range */
+ ret = ext4_zero_partial_blocks(inode, offset, len);
+ if (ret)
+ return ret;
+
+ handle = ext4_journal_start(inode, EXT4_HT_MISC, 1);
if (IS_ERR(handle)) {
ret = PTR_ERR(handle);
ext4_std_error(inode->i_sb, ret);
return ret;
}
- /* Zero out partial block at the edges of the range */
- ret = ext4_zero_partial_blocks(inode, offset, len);
- if (ret)
- goto out_handle;
-
if (new_size)
ext4_update_inode_size(inode, new_size);
ret = ext4_mark_inode_dirty(handle, inode);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index d5b783a7c814..5288d36b0f09 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4443,8 +4443,12 @@ int ext4_punch_hole(struct file *file, loff_t offset, loff_t length)
if (ret)
return ret;
+ ret = ext4_zero_partial_blocks(inode, offset, length);
+ if (ret)
+ return ret;
+
if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
- credits = ext4_chunk_trans_extent(inode, 2);
+ credits = ext4_chunk_trans_extent(inode, 0);
else
credits = ext4_blocks_for_truncate(inode);
handle = ext4_journal_start(inode, EXT4_HT_TRUNCATE, credits);
@@ -4454,10 +4458,6 @@ int ext4_punch_hole(struct file *file, loff_t offset, loff_t length)
return ret;
}
- ret = ext4_zero_partial_blocks(inode, offset, length);
- if (ret)
- goto out_handle;
-
/* If there are blocks to remove, do it */
start_lblk = EXT4_B_TO_LBLK(inode, offset);
end_lblk = end >> inode->i_blkbits;
@@ -4589,6 +4589,9 @@ int ext4_truncate(struct inode *inode)
err = ext4_inode_attach_jinode(inode);
if (err)
goto out_trace;
+
+ /* Zero to the end of the block containing i_size */
+ ext4_block_zero_eof(inode, inode->i_size, LLONG_MAX);
}
if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))
@@ -4602,10 +4605,6 @@ int ext4_truncate(struct inode *inode)
goto out_trace;
}
- /* Zero to the end of the block containing i_size */
- if (inode->i_size & (inode->i_sb->s_blocksize - 1))
- ext4_block_zero_eof(inode, inode->i_size, LLONG_MAX);
-
/*
* We add the inode to the orphan list, so that if this
* truncate spans multiple transactions, and we crash, we will
@@ -5945,15 +5944,6 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
goto out_mmap_sem;
}
- handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
- if (IS_ERR(handle)) {
- error = PTR_ERR(handle);
- goto out_mmap_sem;
- }
- if (ext4_handle_valid(handle) && shrink) {
- error = ext4_orphan_add(handle, inode);
- orphan = 1;
- }
/*
* Update c/mtime and tail zero the EOF folio on
* truncate up. ext4_truncate() handles the shrink case
@@ -5967,6 +5957,16 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
LLONG_MAX);
}
+ handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
+ if (IS_ERR(handle)) {
+ error = PTR_ERR(handle);
+ goto out_mmap_sem;
+ }
+ if (ext4_handle_valid(handle) && shrink) {
+ error = ext4_orphan_add(handle, inode);
+ orphan = 1;
+ }
+
if (shrink)
ext4_fc_track_range(handle, inode,
(attr->ia_size > 0 ? attr->ia_size - 1 : 0) >>
--
2.52.0
^ permalink raw reply related
* [PATCH 10/10] ext4: zero post-EOF partial block before appending write
From: Zhang Yi @ 2026-03-10 1:41 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
In-Reply-To: <20260310014101.4140698-1-yi.zhang@huaweicloud.com>
From: Zhang Yi <yi.zhang@huawei.com>
In cases of appending write beyond EOF, ext4_zero_partial_blocks() is
called within ext4_*_write_end() to zero out the partial block beyond
EOF. This prevents exposing stale data that might be written through
mmap.
However, supporting only the regular buffered write path is
insufficient. It is also necessary to support the DAX path as well as
the upcoming iomap buffered write path. Therefore, move this operation
to ext4_write_checks().
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
fs/ext4/file.c | 14 ++++++++++++++
fs/ext4/inode.c | 21 +++++++--------------
2 files changed, 21 insertions(+), 14 deletions(-)
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index f1dc5ce791a7..b2e44601ab6a 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -271,6 +271,8 @@ static ssize_t ext4_generic_write_checks(struct kiocb *iocb,
static ssize_t ext4_write_checks(struct kiocb *iocb, struct iov_iter *from)
{
+ struct inode *inode = file_inode(iocb->ki_filp);
+ loff_t old_size = i_size_read(inode);
ssize_t ret, count;
count = ext4_generic_write_checks(iocb, from);
@@ -280,6 +282,18 @@ static ssize_t ext4_write_checks(struct kiocb *iocb, struct iov_iter *from)
ret = file_modified(iocb->ki_filp);
if (ret)
return ret;
+
+ /*
+ * If the position is beyond the EOF, it is necessary to zero out the
+ * partial block that beyond the existing EOF, as it may contains
+ * stale data written through mmap.
+ */
+ if (iocb->ki_pos > old_size && !ext4_verity_in_progress(inode)) {
+ ret = ext4_block_zero_eof(inode, old_size, iocb->ki_pos);
+ if (ret < 0)
+ return ret;
+ }
+
return count;
}
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5288d36b0f09..67a4d12fcb4d 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1456,10 +1456,9 @@ static int ext4_write_end(const struct kiocb *iocb,
folio_unlock(folio);
folio_put(folio);
- if (old_size < pos && !verity) {
+ if (old_size < pos && !verity)
pagecache_isize_extended(inode, old_size, pos);
- ext4_block_zero_eof(inode, old_size, pos);
- }
+
/*
* Don't mark the inode dirty under folio lock. First, it unnecessarily
* makes the holding time of folio lock longer. Second, it forces lock
@@ -1574,10 +1573,8 @@ static int ext4_journalled_write_end(const struct kiocb *iocb,
folio_unlock(folio);
folio_put(folio);
- if (old_size < pos && !verity) {
+ if (old_size < pos && !verity)
pagecache_isize_extended(inode, old_size, pos);
- ext4_block_zero_eof(inode, old_size, pos);
- }
if (size_changed) {
ret2 = ext4_mark_inode_dirty(handle, inode);
@@ -3196,7 +3193,7 @@ static int ext4_da_do_write_end(struct address_space *mapping,
struct inode *inode = mapping->host;
loff_t old_size = inode->i_size;
bool disksize_changed = false;
- loff_t new_i_size, zero_len = 0;
+ loff_t new_i_size;
handle_t *handle;
if (unlikely(!folio_buffers(folio))) {
@@ -3240,19 +3237,15 @@ static int ext4_da_do_write_end(struct address_space *mapping,
folio_unlock(folio);
folio_put(folio);
- if (pos > old_size) {
+ if (pos > old_size)
pagecache_isize_extended(inode, old_size, pos);
- zero_len = pos - old_size;
- }
- if (!disksize_changed && !zero_len)
+ if (!disksize_changed)
return copied;
- handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
+ handle = ext4_journal_start(inode, EXT4_HT_INODE, 1);
if (IS_ERR(handle))
return PTR_ERR(handle);
- if (zero_len)
- ext4_block_zero_eof(inode, old_size, pos);
ext4_mark_inode_dirty(handle, inode);
ext4_journal_stop(handle);
--
2.52.0
^ permalink raw reply related
* [PATCH 02/10] ext4: ext4_block_truncate_page() returns zeroed length on success
From: Zhang Yi @ 2026-03-10 1:40 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
In-Reply-To: <20260310014101.4140698-1-yi.zhang@huaweicloud.com>
From: Zhang Yi <yi.zhang@huawei.com>
Return the actual zeroed length instead of 0 on success. This prepares
for the upcoming iomap buffered I/O conversion by exposing zeroed length
information to callers.
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
fs/ext4/inode.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 1e037a314dab..a737ce05e768 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4136,6 +4136,7 @@ static int ext4_block_zero_page_range(handle_t *handle,
* up to the end of the block which corresponds to `from'.
* This required during truncate. We need to physically zero the tail end
* of that block so it doesn't yield old data if the file is later grown.
+ * Return the zeroed length on success.
*/
static int ext4_block_truncate_page(handle_t *handle,
struct address_space *mapping, loff_t from)
@@ -4143,6 +4144,8 @@ static int ext4_block_truncate_page(handle_t *handle,
unsigned length;
unsigned blocksize;
struct inode *inode = mapping->host;
+ bool did_zero = false;
+ int err;
/* If we are processing an encrypted inode during orphan list handling */
if (IS_ENCRYPTED(inode) && !fscrypt_has_encryption_key(inode))
@@ -4151,7 +4154,12 @@ static int ext4_block_truncate_page(handle_t *handle,
blocksize = i_blocksize(inode);
length = blocksize - (from & (blocksize - 1));
- return ext4_block_zero_page_range(handle, mapping, from, length, NULL);
+ err = ext4_block_zero_page_range(handle, mapping, from, length,
+ &did_zero);
+ if (err)
+ return err;
+
+ return did_zero ? length : 0;
}
int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
--
2.52.0
^ permalink raw reply related
* [PATCH 08/10] ext4: pass allocate range as loff_t to ext4_alloc_file_blocks()
From: Zhang Yi @ 2026-03-10 1:40 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
In-Reply-To: <20260310014101.4140698-1-yi.zhang@huaweicloud.com>
From: Zhang Yi <yi.zhang@huawei.com>
Change ext4_alloc_file_blocks() to accept offset and len in byte
granularity instead of block granularity. This allows callers to pass
byte offsets and lengths directly, and this prepares for moving the
ext4_zero_partial_blocks() call from the while(len) loop for unaligned
append writes, where it only needs to be invoked once before doing block
allocation.
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
fs/ext4/extents.c | 53 ++++++++++++++++++++---------------------------
1 file changed, 22 insertions(+), 31 deletions(-)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 753a0f3418a4..57a686b600d9 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4542,15 +4542,15 @@ int ext4_ext_truncate(handle_t *handle, struct inode *inode)
return err;
}
-static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
- ext4_lblk_t len, loff_t new_size,
- int flags)
+static int ext4_alloc_file_blocks(struct file *file, loff_t offset, loff_t len,
+ loff_t new_size, int flags)
{
struct inode *inode = file_inode(file);
handle_t *handle;
int ret = 0, ret2 = 0, ret3 = 0;
int retries = 0;
int depth = 0;
+ ext4_lblk_t len_lblk;
struct ext4_map_blocks map;
unsigned int credits;
loff_t epos, old_size = i_size_read(inode);
@@ -4558,14 +4558,14 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
bool alloc_zero = false;
BUG_ON(!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS));
- map.m_lblk = offset;
- map.m_len = len;
+ map.m_lblk = offset >> blkbits;
+ map.m_len = len_lblk = EXT4_MAX_BLOCKS(len, offset, blkbits);
/*
* Don't normalize the request if it can fit in one extent so
* that it doesn't get unnecessarily split into multiple
* extents.
*/
- if (len <= EXT_UNWRITTEN_MAX_LEN)
+ if (len_lblk <= EXT_UNWRITTEN_MAX_LEN)
flags |= EXT4_GET_BLOCKS_NO_NORMALIZE;
/*
@@ -4582,16 +4582,16 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
/*
* credits to insert 1 extent into extent tree
*/
- credits = ext4_chunk_trans_blocks(inode, len);
+ credits = ext4_chunk_trans_blocks(inode, len_lblk);
depth = ext_depth(inode);
retry:
- while (len) {
+ while (len_lblk) {
/*
* Recalculate credits when extent tree depth changes.
*/
if (depth != ext_depth(inode)) {
- credits = ext4_chunk_trans_blocks(inode, len);
+ credits = ext4_chunk_trans_blocks(inode, len_lblk);
depth = ext_depth(inode);
}
@@ -4648,7 +4648,7 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
}
map.m_lblk += ret;
- map.m_len = len = len - ret;
+ map.m_len = len_lblk = len_lblk - ret;
}
if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
goto retry;
@@ -4665,11 +4665,9 @@ static long ext4_zero_range(struct file *file, loff_t offset,
{
struct inode *inode = file_inode(file);
handle_t *handle = NULL;
- loff_t new_size = 0;
+ loff_t align_start, align_end, new_size = 0;
loff_t end = offset + len;
- ext4_lblk_t start_lblk, end_lblk;
unsigned int blocksize = i_blocksize(inode);
- unsigned int blkbits = inode->i_blkbits;
int ret, flags, credits;
trace_ext4_zero_range(inode, offset, len, mode);
@@ -4690,11 +4688,8 @@ static long ext4_zero_range(struct file *file, loff_t offset,
flags = EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT;
/* Preallocate the range including the unaligned edges */
if (!IS_ALIGNED(offset | end, blocksize)) {
- ext4_lblk_t alloc_lblk = offset >> blkbits;
- ext4_lblk_t len_lblk = EXT4_MAX_BLOCKS(len, offset, blkbits);
-
- ret = ext4_alloc_file_blocks(file, alloc_lblk, len_lblk,
- new_size, flags);
+ ret = ext4_alloc_file_blocks(file, offset, len, new_size,
+ flags);
if (ret)
return ret;
}
@@ -4709,18 +4704,17 @@ static long ext4_zero_range(struct file *file, loff_t offset,
return ret;
/* Zero range excluding the unaligned edges */
- start_lblk = EXT4_B_TO_LBLK(inode, offset);
- end_lblk = end >> blkbits;
- if (end_lblk > start_lblk) {
- ext4_lblk_t zero_blks = end_lblk - start_lblk;
-
+ align_start = round_up(offset, blocksize);
+ align_end = round_down(end, blocksize);
+ if (align_end > align_start) {
if (mode & FALLOC_FL_WRITE_ZEROES)
flags = EXT4_GET_BLOCKS_CREATE_ZERO | EXT4_EX_NOCACHE;
else
flags |= (EXT4_GET_BLOCKS_CONVERT_UNWRITTEN |
EXT4_EX_NOCACHE);
- ret = ext4_alloc_file_blocks(file, start_lblk, zero_blks,
- new_size, flags);
+ ret = ext4_alloc_file_blocks(file, align_start,
+ align_end - align_start, new_size,
+ flags);
if (ret)
return ret;
}
@@ -4768,15 +4762,11 @@ static long ext4_do_fallocate(struct file *file, loff_t offset,
struct inode *inode = file_inode(file);
loff_t end = offset + len;
loff_t new_size = 0;
- ext4_lblk_t start_lblk, len_lblk;
int ret;
trace_ext4_fallocate_enter(inode, offset, len, mode);
WARN_ON_ONCE(!inode_is_locked(inode));
- start_lblk = offset >> inode->i_blkbits;
- len_lblk = EXT4_MAX_BLOCKS(len, offset, inode->i_blkbits);
-
/* We only support preallocation for extent-based files only. */
if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
ret = -EOPNOTSUPP;
@@ -4791,7 +4781,7 @@ static long ext4_do_fallocate(struct file *file, loff_t offset,
goto out;
}
- ret = ext4_alloc_file_blocks(file, start_lblk, len_lblk, new_size,
+ ret = ext4_alloc_file_blocks(file, offset, len, new_size,
EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT);
if (ret)
goto out;
@@ -4801,7 +4791,8 @@ static long ext4_do_fallocate(struct file *file, loff_t offset,
EXT4_I(inode)->i_sync_tid);
}
out:
- trace_ext4_fallocate_exit(inode, offset, len_lblk, ret);
+ trace_ext4_fallocate_exit(inode, offset,
+ EXT4_MAX_BLOCKS(len, offset, inode->i_blkbits), ret);
return ret;
}
--
2.52.0
^ permalink raw reply related
* [PATCH 00/10] ext4: refactor partial block zero-out for iomap conversion
From: Zhang Yi @ 2026-03-10 1:40 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
From: Zhang Yi <yi.zhang@huawei.com>
Hello!
This patch series extracted from my iomap conversion v2 series[1]. It
refactors the ext4 zero partial block code path in preparation for
converting buffered I/O to the iomap infrastructure. The main changes
are:
[1] https://lore.kernel.org/linux-ext4/20260203062523.3869120-1-yi.zhang@huawei.com/
1. Introduce ext4_block_zero_eof(): Extend and rename
ext4_block_truncate_page() to handle post-EOF partial block zeroing
for both append writes and truncate operations.
2. Separate ordered data handling: Move data=ordered mode handling from
__ext4_block_zero_page_range to ext4_block_zero_eof(). Only truncate
and post-EOF append write/fallocate paths need ordered data mode,
hole punching and zero range paths don't need ordered data handling.
3. Split journal mode handling: Extract
ext4_block_journalled_zero_range() from
__ext4_block_zero_page_range() for data=journal mode, leaving
ext4_block_do_zero_range() for data=ordered/writeback modes.
4. Refactor ext4_alloc_file_blocks(): Change parameters to loff_t byte
granularity to simplify callers and prepares removing the zero call
from the allocation loop for unaligned append writes.
5. Remove handle parameters: Stop passing handle_t * to zero functions.
Make ext4_block_journalled_zero_range() start its own handle, and
move zero operations outside active handles. This is required because
iomap uses "folio lock -> transaction start" lock ordering, opposite
to the current lock ordering.
6. Centralize zeroing in ext4_write_checks(): Move all post-EOF partial
block zeroing to ext4_write_checks() so it applies to both regular
buffered writes and the upcoming iomap path.
Thanks
Yi.
Zhang Yi (10):
ext4: add did_zero output parameter to ext4_block_zero_page_range()
ext4: ext4_block_truncate_page() returns zeroed length on success
ext4: rename and extend ext4_block_truncate_page()
ext4: factor out journalled block zeroing range
ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range()
ext4: move ordered data handling out of ext4_block_do_zero_range()
ext4: remove handle parameters from zero partial block functions
ext4: pass allocate range as loff_t to ext4_alloc_file_blocks()
ext4: move zero partial block range functions out of active handle
ext4: zero post-EOF partial block before appending write
fs/ext4/ext4.h | 5 +-
fs/ext4/extents.c | 83 ++++++---------
fs/ext4/file.c | 14 +++
fs/ext4/inode.c | 256 ++++++++++++++++++++++++++++------------------
4 files changed, 208 insertions(+), 150 deletions(-)
--
2.52.0
^ permalink raw reply
* [PATCH 05/10] ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range()
From: Zhang Yi @ 2026-03-10 1:40 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
In-Reply-To: <20260310014101.4140698-1-yi.zhang@huaweicloud.com>
From: Zhang Yi <yi.zhang@huawei.com>
Rename ext4_block_zero_page_range() to ext4_block_zero_range() since the
"page" naming is no longer appropriate for current context. Also change
its signature to take an inode pointer instead of an address_space. This
aligns with the caller ext4_block_zero_eof() and
ext4_zero_partial_blocks().
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
fs/ext4/inode.c | 24 ++++++++++--------------
1 file changed, 10 insertions(+), 14 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index d63d455831b9..86f169df226a 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4147,11 +4147,9 @@ static int ext4_block_journalled_zero_range(handle_t *handle,
* the end of the block it will be shortened to end of the block
* that corresponds to 'from'
*/
-static int ext4_block_zero_page_range(handle_t *handle,
- struct address_space *mapping, loff_t from, loff_t length,
- bool *did_zero)
+static int ext4_block_zero_range(handle_t *handle, struct inode *inode,
+ loff_t from, loff_t length, bool *did_zero)
{
- struct inode *inode = mapping->host;
unsigned blocksize = inode->i_sb->s_blocksize;
unsigned int max = blocksize - (from & (blocksize - 1));
@@ -4198,8 +4196,7 @@ int ext4_block_zero_eof(handle_t *handle, struct inode *inode,
if (length > blocksize - offset)
length = blocksize - offset;
- err = ext4_block_zero_page_range(handle, inode->i_mapping, from, length,
- &did_zero);
+ err = ext4_block_zero_range(handle, inode, from, length, &did_zero);
if (err)
return err;
@@ -4210,7 +4207,6 @@ int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
loff_t lstart, loff_t length)
{
struct super_block *sb = inode->i_sb;
- struct address_space *mapping = inode->i_mapping;
unsigned partial_start, partial_end;
ext4_fsblk_t start, end;
loff_t byte_end = (lstart + length - 1);
@@ -4225,22 +4221,22 @@ int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
/* Handle partial zero within the single block */
if (start == end &&
(partial_start || (partial_end != sb->s_blocksize - 1))) {
- err = ext4_block_zero_page_range(handle, mapping,
- lstart, length, NULL);
+ err = ext4_block_zero_range(handle, inode, lstart,
+ length, NULL);
return err;
}
/* Handle partial zero out on the start of the range */
if (partial_start) {
- err = ext4_block_zero_page_range(handle, mapping, lstart,
- sb->s_blocksize, NULL);
+ err = ext4_block_zero_range(handle, inode, lstart,
+ sb->s_blocksize, NULL);
if (err)
return err;
}
/* Handle partial zero out on the end of the range */
if (partial_end != sb->s_blocksize - 1)
- err = ext4_block_zero_page_range(handle, mapping,
- byte_end - partial_end,
- partial_end + 1, NULL);
+ err = ext4_block_zero_range(handle, inode,
+ byte_end - partial_end,
+ partial_end + 1, NULL);
return err;
}
--
2.52.0
^ permalink raw reply related
* [PATCH 07/10] ext4: remove handle parameters from zero partial block functions
From: Zhang Yi @ 2026-03-10 1:40 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
In-Reply-To: <20260310014101.4140698-1-yi.zhang@huaweicloud.com>
From: Zhang Yi <yi.zhang@huawei.com>
Only journal data mode requires an active journal handle when zeroing
partial blocks. Stop passing handle_t *handle to
ext4_zero_partial_blocks() and related functions, and make
ext4_block_journalled_zero_range() start a handle independently.
This change has no practical impact now because all callers invoke these
functions within the context of an active handle. It prepares for moving
ext4_block_zero_eof() out of an active handle in the next patch, which
is a prerequisite for converting block zero range operations to iomap
infrastructure.
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
fs/ext4/ext4.h | 7 +++---
fs/ext4/extents.c | 5 ++--
fs/ext4/inode.c | 62 ++++++++++++++++++++++++++++-------------------
3 files changed, 42 insertions(+), 32 deletions(-)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index c62459ef9796..20545a9523e9 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -3099,10 +3099,9 @@ extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks);
extern int ext4_chunk_trans_extent(struct inode *inode, int nrblocks);
extern int ext4_meta_trans_blocks(struct inode *inode, int lblocks,
int pextents);
-extern int ext4_block_zero_eof(handle_t *handle, struct inode *inode,
- loff_t from, loff_t end);
-extern int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
- loff_t lstart, loff_t lend);
+extern int ext4_block_zero_eof(struct inode *inode, loff_t from, loff_t end);
+extern int ext4_zero_partial_blocks(struct inode *inode, loff_t lstart,
+ loff_t lend);
extern vm_fault_t ext4_page_mkwrite(struct vm_fault *vmf);
extern qsize_t *ext4_get_reserved_space(struct inode *inode);
extern int ext4_get_projid(struct inode *inode, kprojid_t *projid);
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index a265070c1b79..753a0f3418a4 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4625,8 +4625,7 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
inode_get_ctime(inode));
if (epos > old_size) {
pagecache_isize_extended(inode, old_size, epos);
- ext4_block_zero_eof(handle, inode, old_size,
- epos);
+ ext4_block_zero_eof(inode, old_size, epos);
}
}
ret2 = ext4_mark_inode_dirty(handle, inode);
@@ -4744,7 +4743,7 @@ static long ext4_zero_range(struct file *file, loff_t offset,
}
/* Zero out partial block at the edges of the range */
- ret = ext4_zero_partial_blocks(handle, inode, offset, len);
+ ret = ext4_zero_partial_blocks(inode, offset, len);
if (ret)
goto out_handle;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 8fea044b3bff..d5b783a7c814 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1458,7 +1458,7 @@ static int ext4_write_end(const struct kiocb *iocb,
if (old_size < pos && !verity) {
pagecache_isize_extended(inode, old_size, pos);
- ext4_block_zero_eof(handle, inode, old_size, pos);
+ ext4_block_zero_eof(inode, old_size, pos);
}
/*
* Don't mark the inode dirty under folio lock. First, it unnecessarily
@@ -1576,7 +1576,7 @@ static int ext4_journalled_write_end(const struct kiocb *iocb,
if (old_size < pos && !verity) {
pagecache_isize_extended(inode, old_size, pos);
- ext4_block_zero_eof(handle, inode, old_size, pos);
+ ext4_block_zero_eof(inode, old_size, pos);
}
if (size_changed) {
@@ -3252,7 +3252,7 @@ static int ext4_da_do_write_end(struct address_space *mapping,
if (IS_ERR(handle))
return PTR_ERR(handle);
if (zero_len)
- ext4_block_zero_eof(handle, inode, old_size, pos);
+ ext4_block_zero_eof(inode, old_size, pos);
ext4_mark_inode_dirty(handle, inode);
ext4_journal_stop(handle);
@@ -4102,16 +4102,23 @@ static int ext4_block_do_zero_range(struct inode *inode, loff_t from,
return 0;
}
-static int ext4_block_journalled_zero_range(handle_t *handle,
- struct inode *inode, loff_t from, loff_t length, bool *did_zero)
+static int ext4_block_journalled_zero_range(struct inode *inode, loff_t from,
+ loff_t length, bool *did_zero)
{
struct buffer_head *bh;
struct folio *folio;
+ handle_t *handle;
int err;
+ handle = ext4_journal_start(inode, EXT4_HT_MISC, 1);
+ if (IS_ERR(handle))
+ return PTR_ERR(handle);
+
bh = ext4_block_get_zero_range(inode, from, length);
- if (IS_ERR_OR_NULL(bh))
- return PTR_ERR_OR_ZERO(bh);
+ if (IS_ERR_OR_NULL(bh)) {
+ err = PTR_ERR_OR_ZERO(bh);
+ goto out_handle;
+ }
folio = bh->b_folio;
BUFFER_TRACE(bh, "get write access");
@@ -4132,6 +4139,8 @@ static int ext4_block_journalled_zero_range(handle_t *handle,
out:
folio_unlock(folio);
folio_put(folio);
+out_handle:
+ ext4_journal_stop(handle);
return err;
}
@@ -4142,7 +4151,7 @@ static int ext4_block_journalled_zero_range(handle_t *handle,
* the end of the block it will be shortened to end of the block
* that corresponds to 'from'
*/
-static int ext4_block_zero_range(handle_t *handle, struct inode *inode,
+static int ext4_block_zero_range(struct inode *inode,
loff_t from, loff_t length, bool *did_zero,
bool *zero_written)
{
@@ -4160,8 +4169,8 @@ static int ext4_block_zero_range(handle_t *handle, struct inode *inode,
return dax_zero_range(inode, from, length, did_zero,
&ext4_iomap_ops);
} else if (ext4_should_journal_data(inode)) {
- return ext4_block_journalled_zero_range(handle, inode, from,
- length, did_zero);
+ return ext4_block_journalled_zero_range(inode, from, length,
+ did_zero);
}
return ext4_block_do_zero_range(inode, from, length, did_zero,
zero_written);
@@ -4174,8 +4183,7 @@ static int ext4_block_zero_range(handle_t *handle, struct inode *inode,
* to physically zero the tail end of that block so it doesn't yield old
* data if the file is grown. Return the zeroed length on success.
*/
-int ext4_block_zero_eof(handle_t *handle, struct inode *inode,
- loff_t from, loff_t end)
+int ext4_block_zero_eof(struct inode *inode, loff_t from, loff_t end)
{
unsigned int blocksize = i_blocksize(inode);
unsigned int offset;
@@ -4194,7 +4202,7 @@ int ext4_block_zero_eof(handle_t *handle, struct inode *inode,
if (length > blocksize - offset)
length = blocksize - offset;
- err = ext4_block_zero_range(handle, inode, from, length,
+ err = ext4_block_zero_range(inode, from, length,
&did_zero, &zero_written);
if (err)
return err;
@@ -4206,7 +4214,14 @@ int ext4_block_zero_eof(handle_t *handle, struct inode *inode,
*/
if (ext4_should_order_data(inode) &&
did_zero && zero_written && !IS_DAX(inode)) {
+ handle_t *handle;
+
+ handle = ext4_journal_start(inode, EXT4_HT_MISC, 1);
+ if (IS_ERR(handle))
+ return PTR_ERR(handle);
+
err = ext4_jbd2_inode_add_write(handle, inode, from, length);
+ ext4_journal_stop(handle);
if (err)
return err;
}
@@ -4214,8 +4229,7 @@ int ext4_block_zero_eof(handle_t *handle, struct inode *inode,
return did_zero ? length : 0;
}
-int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
- loff_t lstart, loff_t length)
+int ext4_zero_partial_blocks(struct inode *inode, loff_t lstart, loff_t length)
{
struct super_block *sb = inode->i_sb;
unsigned partial_start, partial_end;
@@ -4232,21 +4246,19 @@ int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
/* Handle partial zero within the single block */
if (start == end &&
(partial_start || (partial_end != sb->s_blocksize - 1))) {
- err = ext4_block_zero_range(handle, inode, lstart,
- length, NULL, NULL);
+ err = ext4_block_zero_range(inode, lstart, length, NULL, NULL);
return err;
}
/* Handle partial zero out on the start of the range */
if (partial_start) {
- err = ext4_block_zero_range(handle, inode, lstart,
- sb->s_blocksize, NULL, NULL);
+ err = ext4_block_zero_range(inode, lstart, sb->s_blocksize,
+ NULL, NULL);
if (err)
return err;
}
/* Handle partial zero out on the end of the range */
if (partial_end != sb->s_blocksize - 1)
- err = ext4_block_zero_range(handle, inode,
- byte_end - partial_end,
+ err = ext4_block_zero_range(inode, byte_end - partial_end,
partial_end + 1, NULL, NULL);
return err;
}
@@ -4442,7 +4454,7 @@ int ext4_punch_hole(struct file *file, loff_t offset, loff_t length)
return ret;
}
- ret = ext4_zero_partial_blocks(handle, inode, offset, length);
+ ret = ext4_zero_partial_blocks(inode, offset, length);
if (ret)
goto out_handle;
@@ -4592,7 +4604,7 @@ int ext4_truncate(struct inode *inode)
/* Zero to the end of the block containing i_size */
if (inode->i_size & (inode->i_sb->s_blocksize - 1))
- ext4_block_zero_eof(handle, inode, inode->i_size, LLONG_MAX);
+ ext4_block_zero_eof(inode, inode->i_size, LLONG_MAX);
/*
* We add the inode to the orphan list, so that if this
@@ -5951,8 +5963,8 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
inode_set_mtime_to_ts(inode,
inode_set_ctime_current(inode));
if (oldsize & (inode->i_sb->s_blocksize - 1))
- ext4_block_zero_eof(handle, inode,
- oldsize, LLONG_MAX);
+ ext4_block_zero_eof(inode, oldsize,
+ LLONG_MAX);
}
if (shrink)
--
2.52.0
^ permalink raw reply related
* [PATCH 06/10] ext4: move ordered data handling out of ext4_block_do_zero_range()
From: Zhang Yi @ 2026-03-10 1:40 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
In-Reply-To: <20260310014101.4140698-1-yi.zhang@huaweicloud.com>
From: Zhang Yi <yi.zhang@huawei.com>
Remove the handle parameter from ext4_block_do_zero_range() and move the
ordered data handling to ext4_block_zero_eof().
This is necessary for truncate up and append writes across a range
extending beyond EOF. The ordered data must be committed before updating
i_disksize to prevent exposing stale on-disk data from concurrent
post-EOF mmap writes during previous folio writeback or in case of
system crash during append writes.
This is unnecessary for partial block hole punching because the entire
punch operation does not provide atomicity guarantees and can already
expose intermediate results in case of crash.
Since ordered data handling is no longer performed inside
ext4_zero_partial_blocks(), ext4_punch_hole() no longer needs to attach
jinode.
This is prepared for the conversion to the iomap infrastructure, which
does not use ordered data mode while zeroing post-EOF partial blocks.
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
fs/ext4/inode.c | 58 ++++++++++++++++++++++++-------------------------
1 file changed, 29 insertions(+), 29 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 86f169df226a..8fea044b3bff 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4076,12 +4076,12 @@ static struct buffer_head *ext4_block_get_zero_range(struct inode *inode,
return err ? ERR_PTR(err) : NULL;
}
-static int ext4_block_do_zero_range(handle_t *handle, struct inode *inode,
- loff_t from, loff_t length, bool *did_zero)
+static int ext4_block_do_zero_range(struct inode *inode, loff_t from,
+ loff_t length, bool *did_zero,
+ bool *zero_written)
{
struct buffer_head *bh;
struct folio *folio;
- int err = 0;
bh = ext4_block_get_zero_range(inode, from, length);
if (IS_ERR_OR_NULL(bh))
@@ -4092,19 +4092,14 @@ static int ext4_block_do_zero_range(handle_t *handle, struct inode *inode,
BUFFER_TRACE(bh, "zeroed end of block");
mark_buffer_dirty(bh);
- /*
- * Only the written block requires ordered data to prevent exposing
- * stale data.
- */
- if (ext4_should_order_data(inode) &&
- !buffer_unwritten(bh) && !buffer_delay(bh))
- err = ext4_jbd2_inode_add_write(handle, inode, from, length);
- if (!err && did_zero)
+ if (did_zero)
*did_zero = true;
+ if (zero_written && !buffer_unwritten(bh) && !buffer_delay(bh))
+ *zero_written = true;
folio_unlock(folio);
folio_put(folio);
- return err;
+ return 0;
}
static int ext4_block_journalled_zero_range(handle_t *handle,
@@ -4148,7 +4143,8 @@ static int ext4_block_journalled_zero_range(handle_t *handle,
* that corresponds to 'from'
*/
static int ext4_block_zero_range(handle_t *handle, struct inode *inode,
- loff_t from, loff_t length, bool *did_zero)
+ loff_t from, loff_t length, bool *did_zero,
+ bool *zero_written)
{
unsigned blocksize = inode->i_sb->s_blocksize;
unsigned int max = blocksize - (from & (blocksize - 1));
@@ -4167,7 +4163,8 @@ static int ext4_block_zero_range(handle_t *handle, struct inode *inode,
return ext4_block_journalled_zero_range(handle, inode, from,
length, did_zero);
}
- return ext4_block_do_zero_range(handle, inode, from, length, did_zero);
+ return ext4_block_do_zero_range(inode, from, length, did_zero,
+ zero_written);
}
/*
@@ -4184,6 +4181,7 @@ int ext4_block_zero_eof(handle_t *handle, struct inode *inode,
unsigned int offset;
loff_t length = end - from;
bool did_zero = false;
+ bool zero_written = false;
int err;
offset = from & (blocksize - 1);
@@ -4196,9 +4194,22 @@ int ext4_block_zero_eof(handle_t *handle, struct inode *inode,
if (length > blocksize - offset)
length = blocksize - offset;
- err = ext4_block_zero_range(handle, inode, from, length, &did_zero);
+ err = ext4_block_zero_range(handle, inode, from, length,
+ &did_zero, &zero_written);
if (err)
return err;
+ /*
+ * It's necessary to order zeroed data before update i_disksize when
+ * truncating up or performing an append write, because there might be
+ * exposing stale on-disk data which may caused by concurrent post-EOF
+ * mmap write during folio writeback.
+ */
+ if (ext4_should_order_data(inode) &&
+ did_zero && zero_written && !IS_DAX(inode)) {
+ err = ext4_jbd2_inode_add_write(handle, inode, from, length);
+ if (err)
+ return err;
+ }
return did_zero ? length : 0;
}
@@ -4222,13 +4233,13 @@ int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
if (start == end &&
(partial_start || (partial_end != sb->s_blocksize - 1))) {
err = ext4_block_zero_range(handle, inode, lstart,
- length, NULL);
+ length, NULL, NULL);
return err;
}
/* Handle partial zero out on the start of the range */
if (partial_start) {
err = ext4_block_zero_range(handle, inode, lstart,
- sb->s_blocksize, NULL);
+ sb->s_blocksize, NULL, NULL);
if (err)
return err;
}
@@ -4236,7 +4247,7 @@ int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
if (partial_end != sb->s_blocksize - 1)
err = ext4_block_zero_range(handle, inode,
byte_end - partial_end,
- partial_end + 1, NULL);
+ partial_end + 1, NULL, NULL);
return err;
}
@@ -4411,17 +4422,6 @@ int ext4_punch_hole(struct file *file, loff_t offset, loff_t length)
end = max_end;
length = end - offset;
- /*
- * Attach jinode to inode for jbd2 if we do any zeroing of partial
- * block.
- */
- if (!IS_ALIGNED(offset | end, sb->s_blocksize)) {
- ret = ext4_inode_attach_jinode(inode);
- if (ret < 0)
- return ret;
- }
-
-
ret = ext4_update_disksize_before_punch(inode, offset, length);
if (ret)
return ret;
--
2.52.0
^ permalink raw reply related
* [PATCH 04/10] ext4: factor out journalled block zeroing range
From: Zhang Yi @ 2026-03-10 1:40 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
In-Reply-To: <20260310014101.4140698-1-yi.zhang@huaweicloud.com>
From: Zhang Yi <yi.zhang@huawei.com>
Refactor __ext4_block_zero_page_range() by separating the block zeroing
operations for ordered data mode and journal data mode into two distinct
functions:
- ext4_block_do_zero_range(): handles non-journal data mode with
ordered data support
- ext4_block_journalled_zero_range(): handles journal data mode
Also extract a common helper, ext4_block_get_zero_range(), to handle
buffer head and folio retrieval, along with the associated error
handling. This prepares for converting the partial block zero range to
the iomap infrastructure.
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
fs/ext4/inode.c | 99 ++++++++++++++++++++++++++++++++++---------------
1 file changed, 70 insertions(+), 29 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 52c6a86ad9f9..d63d455831b9 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4002,13 +4002,12 @@ void ext4_set_aops(struct inode *inode)
* ext4_punch_hole, etc) which needs to be properly zeroed out. Otherwise a
* racing writeback can come later and flush the stale pagecache to disk.
*/
-static int __ext4_block_zero_page_range(handle_t *handle,
- struct address_space *mapping, loff_t from, loff_t length,
- bool *did_zero)
+static struct buffer_head *ext4_block_get_zero_range(struct inode *inode,
+ loff_t from, loff_t length)
{
unsigned int offset, blocksize, pos;
ext4_lblk_t iblock;
- struct inode *inode = mapping->host;
+ struct address_space *mapping = inode->i_mapping;
struct buffer_head *bh;
struct folio *folio;
int err = 0;
@@ -4017,7 +4016,7 @@ static int __ext4_block_zero_page_range(handle_t *handle,
FGP_LOCK | FGP_ACCESSED | FGP_CREAT,
mapping_gfp_constraint(mapping, ~__GFP_FS));
if (IS_ERR(folio))
- return PTR_ERR(folio);
+ return ERR_CAST(folio);
blocksize = inode->i_sb->s_blocksize;
@@ -4069,33 +4068,73 @@ static int __ext4_block_zero_page_range(handle_t *handle,
}
}
}
- if (ext4_should_journal_data(inode)) {
- BUFFER_TRACE(bh, "get write access");
- err = ext4_journal_get_write_access(handle, inode->i_sb, bh,
- EXT4_JTR_NONE);
- if (err)
- goto unlock;
- }
- folio_zero_range(folio, offset, length);
+ return bh;
+
+unlock:
+ folio_unlock(folio);
+ folio_put(folio);
+ return err ? ERR_PTR(err) : NULL;
+}
+
+static int ext4_block_do_zero_range(handle_t *handle, struct inode *inode,
+ loff_t from, loff_t length, bool *did_zero)
+{
+ struct buffer_head *bh;
+ struct folio *folio;
+ int err = 0;
+
+ bh = ext4_block_get_zero_range(inode, from, length);
+ if (IS_ERR_OR_NULL(bh))
+ return PTR_ERR_OR_ZERO(bh);
+
+ folio = bh->b_folio;
+ folio_zero_range(folio, offset_in_folio(folio, from), length);
BUFFER_TRACE(bh, "zeroed end of block");
- if (ext4_should_journal_data(inode)) {
- err = ext4_dirty_journalled_data(handle, bh);
- } else {
- mark_buffer_dirty(bh);
- /*
- * Only the written block requires ordered data to prevent
- * exposing stale data.
- */
- if (!buffer_unwritten(bh) && !buffer_delay(bh) &&
- ext4_should_order_data(inode))
- err = ext4_jbd2_inode_add_write(handle, inode, from,
- length);
- }
+ mark_buffer_dirty(bh);
+ /*
+ * Only the written block requires ordered data to prevent exposing
+ * stale data.
+ */
+ if (ext4_should_order_data(inode) &&
+ !buffer_unwritten(bh) && !buffer_delay(bh))
+ err = ext4_jbd2_inode_add_write(handle, inode, from, length);
if (!err && did_zero)
*did_zero = true;
-unlock:
+ folio_unlock(folio);
+ folio_put(folio);
+ return err;
+}
+
+static int ext4_block_journalled_zero_range(handle_t *handle,
+ struct inode *inode, loff_t from, loff_t length, bool *did_zero)
+{
+ struct buffer_head *bh;
+ struct folio *folio;
+ int err;
+
+ bh = ext4_block_get_zero_range(inode, from, length);
+ if (IS_ERR_OR_NULL(bh))
+ return PTR_ERR_OR_ZERO(bh);
+ folio = bh->b_folio;
+
+ BUFFER_TRACE(bh, "get write access");
+ err = ext4_journal_get_write_access(handle, inode->i_sb, bh,
+ EXT4_JTR_NONE);
+ if (err)
+ goto out;
+
+ folio_zero_range(folio, offset_in_folio(folio, from), length);
+ BUFFER_TRACE(bh, "zeroed end of block");
+
+ err = ext4_dirty_journalled_data(handle, bh);
+ if (err)
+ goto out;
+
+ if (did_zero)
+ *did_zero = true;
+out:
folio_unlock(folio);
folio_put(folio);
return err;
@@ -4126,9 +4165,11 @@ static int ext4_block_zero_page_range(handle_t *handle,
if (IS_DAX(inode)) {
return dax_zero_range(inode, from, length, did_zero,
&ext4_iomap_ops);
+ } else if (ext4_should_journal_data(inode)) {
+ return ext4_block_journalled_zero_range(handle, inode, from,
+ length, did_zero);
}
- return __ext4_block_zero_page_range(handle, mapping, from, length,
- did_zero);
+ return ext4_block_do_zero_range(handle, inode, from, length, did_zero);
}
/*
--
2.52.0
^ permalink raw reply related
* [PATCH 03/10] ext4: rename and extend ext4_block_truncate_page()
From: Zhang Yi @ 2026-03-10 1:40 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
In-Reply-To: <20260310014101.4140698-1-yi.zhang@huaweicloud.com>
From: Zhang Yi <yi.zhang@huawei.com>
Rename ext4_block_truncate_page() to ext4_block_zero_eof() and extend
its signature to accept an explicit 'end' offset instead of calculating
the block boundary. This helper function now can replace all cases
requiring zeroing of the partial EOF block, including the append
buffered write paths in ext4_*_write_end().
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
fs/ext4/ext4.h | 2 ++
fs/ext4/extents.c | 4 ++--
fs/ext4/inode.c | 43 +++++++++++++++++++++++--------------------
3 files changed, 27 insertions(+), 22 deletions(-)
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 293f698b7042..c62459ef9796 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -3099,6 +3099,8 @@ extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks);
extern int ext4_chunk_trans_extent(struct inode *inode, int nrblocks);
extern int ext4_meta_trans_blocks(struct inode *inode, int lblocks,
int pextents);
+extern int ext4_block_zero_eof(handle_t *handle, struct inode *inode,
+ loff_t from, loff_t end);
extern int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
loff_t lstart, loff_t lend);
extern vm_fault_t ext4_page_mkwrite(struct vm_fault *vmf);
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index ae3804f36535..a265070c1b79 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4625,8 +4625,8 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
inode_get_ctime(inode));
if (epos > old_size) {
pagecache_isize_extended(inode, old_size, epos);
- ext4_zero_partial_blocks(handle, inode,
- old_size, epos - old_size);
+ ext4_block_zero_eof(handle, inode, old_size,
+ epos);
}
}
ret2 = ext4_mark_inode_dirty(handle, inode);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index a737ce05e768..52c6a86ad9f9 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1458,7 +1458,7 @@ static int ext4_write_end(const struct kiocb *iocb,
if (old_size < pos && !verity) {
pagecache_isize_extended(inode, old_size, pos);
- ext4_zero_partial_blocks(handle, inode, old_size, pos - old_size);
+ ext4_block_zero_eof(handle, inode, old_size, pos);
}
/*
* Don't mark the inode dirty under folio lock. First, it unnecessarily
@@ -1576,7 +1576,7 @@ static int ext4_journalled_write_end(const struct kiocb *iocb,
if (old_size < pos && !verity) {
pagecache_isize_extended(inode, old_size, pos);
- ext4_zero_partial_blocks(handle, inode, old_size, pos - old_size);
+ ext4_block_zero_eof(handle, inode, old_size, pos);
}
if (size_changed) {
@@ -3252,7 +3252,7 @@ static int ext4_da_do_write_end(struct address_space *mapping,
if (IS_ERR(handle))
return PTR_ERR(handle);
if (zero_len)
- ext4_zero_partial_blocks(handle, inode, old_size, zero_len);
+ ext4_block_zero_eof(handle, inode, old_size, pos);
ext4_mark_inode_dirty(handle, inode);
ext4_journal_stop(handle);
@@ -4132,29 +4132,32 @@ static int ext4_block_zero_page_range(handle_t *handle,
}
/*
- * ext4_block_truncate_page() zeroes out a mapping from file offset `from'
- * up to the end of the block which corresponds to `from'.
- * This required during truncate. We need to physically zero the tail end
- * of that block so it doesn't yield old data if the file is later grown.
- * Return the zeroed length on success.
+ * Zero out a mapping from file offset 'from' up to the end of the block
+ * which corresponds to 'from' or to the given 'end' inside this block.
+ * This required during truncate up and performing append writes. We need
+ * to physically zero the tail end of that block so it doesn't yield old
+ * data if the file is grown. Return the zeroed length on success.
*/
-static int ext4_block_truncate_page(handle_t *handle,
- struct address_space *mapping, loff_t from)
+int ext4_block_zero_eof(handle_t *handle, struct inode *inode,
+ loff_t from, loff_t end)
{
- unsigned length;
- unsigned blocksize;
- struct inode *inode = mapping->host;
+ unsigned int blocksize = i_blocksize(inode);
+ unsigned int offset;
+ loff_t length = end - from;
bool did_zero = false;
int err;
+ offset = from & (blocksize - 1);
+ if (!offset || from >= end)
+ return 0;
/* If we are processing an encrypted inode during orphan list handling */
if (IS_ENCRYPTED(inode) && !fscrypt_has_encryption_key(inode))
return 0;
- blocksize = i_blocksize(inode);
- length = blocksize - (from & (blocksize - 1));
+ if (length > blocksize - offset)
+ length = blocksize - offset;
- err = ext4_block_zero_page_range(handle, mapping, from, length,
+ err = ext4_block_zero_page_range(handle, inode->i_mapping, from, length,
&did_zero);
if (err)
return err;
@@ -4508,7 +4511,6 @@ int ext4_truncate(struct inode *inode)
unsigned int credits;
int err = 0, err2;
handle_t *handle;
- struct address_space *mapping = inode->i_mapping;
/*
* There is a possibility that we're either freeing the inode
@@ -4551,8 +4553,9 @@ int ext4_truncate(struct inode *inode)
goto out_trace;
}
+ /* Zero to the end of the block containing i_size */
if (inode->i_size & (inode->i_sb->s_blocksize - 1))
- ext4_block_truncate_page(handle, mapping, inode->i_size);
+ ext4_block_zero_eof(handle, inode, inode->i_size, LLONG_MAX);
/*
* We add the inode to the orphan list, so that if this
@@ -5911,8 +5914,8 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
inode_set_mtime_to_ts(inode,
inode_set_ctime_current(inode));
if (oldsize & (inode->i_sb->s_blocksize - 1))
- ext4_block_truncate_page(handle,
- inode->i_mapping, oldsize);
+ ext4_block_zero_eof(handle, inode,
+ oldsize, LLONG_MAX);
}
if (shrink)
--
2.52.0
^ permalink raw reply related
* [PATCH 01/10] ext4: add did_zero output parameter to ext4_block_zero_page_range()
From: Zhang Yi @ 2026-03-10 1:40 UTC (permalink / raw)
To: linux-ext4
Cc: linux-fsdevel, linux-kernel, tytso, adilger.kernel, jack, ojaswin,
ritesh.list, libaokun, yi.zhang, yi.zhang, yizhang089, yangerkun,
yukuai
In-Reply-To: <20260310014101.4140698-1-yi.zhang@huaweicloud.com>
From: Zhang Yi <yi.zhang@huawei.com>
Add a bool *did_zero output parameter to ext4_block_zero_page_range()
and __ext4_block_zero_page_range(). The parameter reports whether a
partial block was zeroed out, which is needed for the upcoming iomap
buffered I/O conversion.
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
---
fs/ext4/inode.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 396dc3a5d16b..1e037a314dab 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4003,7 +4003,8 @@ void ext4_set_aops(struct inode *inode)
* racing writeback can come later and flush the stale pagecache to disk.
*/
static int __ext4_block_zero_page_range(handle_t *handle,
- struct address_space *mapping, loff_t from, loff_t length)
+ struct address_space *mapping, loff_t from, loff_t length,
+ bool *did_zero)
{
unsigned int offset, blocksize, pos;
ext4_lblk_t iblock;
@@ -4091,6 +4092,8 @@ static int __ext4_block_zero_page_range(handle_t *handle,
err = ext4_jbd2_inode_add_write(handle, inode, from,
length);
}
+ if (!err && did_zero)
+ *did_zero = true;
unlock:
folio_unlock(folio);
@@ -4106,7 +4109,8 @@ static int __ext4_block_zero_page_range(handle_t *handle,
* that corresponds to 'from'
*/
static int ext4_block_zero_page_range(handle_t *handle,
- struct address_space *mapping, loff_t from, loff_t length)
+ struct address_space *mapping, loff_t from, loff_t length,
+ bool *did_zero)
{
struct inode *inode = mapping->host;
unsigned blocksize = inode->i_sb->s_blocksize;
@@ -4120,10 +4124,11 @@ static int ext4_block_zero_page_range(handle_t *handle,
length = max;
if (IS_DAX(inode)) {
- return dax_zero_range(inode, from, length, NULL,
+ return dax_zero_range(inode, from, length, did_zero,
&ext4_iomap_ops);
}
- return __ext4_block_zero_page_range(handle, mapping, from, length);
+ return __ext4_block_zero_page_range(handle, mapping, from, length,
+ did_zero);
}
/*
@@ -4146,7 +4151,7 @@ static int ext4_block_truncate_page(handle_t *handle,
blocksize = i_blocksize(inode);
length = blocksize - (from & (blocksize - 1));
- return ext4_block_zero_page_range(handle, mapping, from, length);
+ return ext4_block_zero_page_range(handle, mapping, from, length, NULL);
}
int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
@@ -4169,13 +4174,13 @@ int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
if (start == end &&
(partial_start || (partial_end != sb->s_blocksize - 1))) {
err = ext4_block_zero_page_range(handle, mapping,
- lstart, length);
+ lstart, length, NULL);
return err;
}
/* Handle partial zero out on the start of the range */
if (partial_start) {
- err = ext4_block_zero_page_range(handle, mapping,
- lstart, sb->s_blocksize);
+ err = ext4_block_zero_page_range(handle, mapping, lstart,
+ sb->s_blocksize, NULL);
if (err)
return err;
}
@@ -4183,7 +4188,7 @@ int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
if (partial_end != sb->s_blocksize - 1)
err = ext4_block_zero_page_range(handle, mapping,
byte_end - partial_end,
- partial_end + 1);
+ partial_end + 1, NULL);
return err;
}
--
2.52.0
^ permalink raw reply related
* Re: [PATCH v4 19/25] xfs: remove unwritten extents after preallocations in fsverity metadata
From: Darrick J. Wong @ 2026-03-10 1:29 UTC (permalink / raw)
To: Andrey Albershteyn
Cc: linux-xfs, fsverity, linux-fsdevel, ebiggers, hch, linux-ext4,
linux-f2fs-devel, linux-btrfs
In-Reply-To: <20260309192355.176980-20-aalbersh@kernel.org>
On Mon, Mar 09, 2026 at 08:23:34PM +0100, Andrey Albershteyn wrote:
> XFS preallocates spaces during writes. In normal I/O this space, if
> unused, is removed by truncate. For files with fsverity, XFS does not
> use truncate as fsverity metadata is stored past EOF.
>
> After we're done with writing fsverity metadata iterate over extents in
> that region and remove any unwritten ones. These would be preallocation
> leftovers in the merkle tree holes and past fsverity descriptor.
>
> Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
> ---
> fs/xfs/xfs_fsverity.c | 62 +++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 62 insertions(+)
>
> diff --git a/fs/xfs/xfs_fsverity.c b/fs/xfs/xfs_fsverity.c
> index e5cd17ec15b6..f78e5f0c2fd0 100644
> --- a/fs/xfs/xfs_fsverity.c
> +++ b/fs/xfs/xfs_fsverity.c
> @@ -21,6 +21,8 @@
> #include "xfs_iomap.h"
> #include "xfs_error.h"
> #include "xfs_health.h"
> +#include "xfs_bmap.h"
> +#include "xfs_bmap_util.h"
> #include <linux/fsverity.h>
> #include <linux/iomap.h>
> #include <linux/pagemap.h>
> @@ -189,6 +191,58 @@ xfs_fsverity_delete_metadata(
> return error;
> }
>
> +static int
> +xfs_fsverity_cancel_unwritten(
> + struct xfs_inode *ip,
> + xfs_fileoff_t start,
> + xfs_fileoff_t end)
> +{
> + struct xfs_mount *mp = ip->i_mount;
> + struct xfs_trans *tp;
> + xfs_fileoff_t offset_fsb = XFS_B_TO_FSB(mp, start);
> + xfs_fileoff_t end_fsb = XFS_B_TO_FSB(mp, end);
> + struct xfs_bmbt_irec imap;
> + int nimaps;
> + int error = 0;
> + int done;
> +
> + error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, 0, 0, 0, &tp);
> + if (error)
> + return error;
> +
> + xfs_ilock(ip, XFS_ILOCK_EXCL);
> + xfs_trans_ijoin(tp, ip, 0);
> +
> + while (offset_fsb < end_fsb) {
> + nimaps = 1;
> +
> + error = xfs_bmapi_read(ip, offset_fsb, end_fsb - offset_fsb,
> + &imap, &nimaps, 0);
Indent two tabs, plz. :)
> + if (error)
> + goto out_cancel;
> +
> + if (nimaps == 0)
> + break;
> +
> + if (imap.br_state == XFS_EXT_UNWRITTEN) {
> + error = xfs_bunmapi(tp, ip, imap.br_startoff,
> + imap.br_blockcount, 0, 1, &done);
> + if (error)
> + goto out_cancel;
> + }
> +
> + offset_fsb = imap.br_startoff + imap.br_blockcount;
There's an upper limit on the number of blocks you can unmap/free in a
single transaction. Maybe move the xfs_trans_{alloc,commit} into the
loop body?
Oh wait, you skip the written extents. Ok, so maybe just roll it after
you've done a bunmapi.
Do you need to purge the cow fork too?
--D
> + }
> +
> + error = xfs_trans_commit(tp);
> + xfs_iunlock(ip, XFS_ILOCK_EXCL);
> + return error;
> +out_cancel:
> + xfs_trans_cancel(tp);
> + xfs_iunlock(ip, XFS_ILOCK_EXCL);
> + return error;
> +}
> +
>
> /*
> * Prepare to enable fsverity by clearing old metadata.
> @@ -264,6 +318,14 @@ xfs_fsverity_end_enable(
> if (error)
> goto out;
>
> + /*
> + * Remove unwritten extents left by preallocations in the merkle tree
> + * holes and past descriptor
> + */
> + error = xfs_fsverity_cancel_unwritten(ip, range_start, LLONG_MAX);
> + if (error)
> + goto out;
> +
> /*
> * Set fsverity inode flag
> */
> --
> 2.51.2
>
>
^ permalink raw reply
* Re: [PATCH v4 18/25] xfs: add fs-verity support
From: Darrick J. Wong @ 2026-03-10 1:26 UTC (permalink / raw)
To: Andrey Albershteyn
Cc: linux-xfs, fsverity, linux-fsdevel, ebiggers, hch, linux-ext4,
linux-f2fs-devel, linux-btrfs
In-Reply-To: <20260309192355.176980-19-aalbersh@kernel.org>
On Mon, Mar 09, 2026 at 08:23:33PM +0100, Andrey Albershteyn wrote:
> Add integration with fs-verity. XFS stores fs-verity descriptor and
> Merkle tree in the inode data fork at first block aligned to 64k past
> EOF.
>
> The Merkle tree reading/writing is done through iomap interface. The
> data itself is read to the inode's page cache. When XFS reads from this
> region iomap doesn't call into fsverity to verify it against Merkle
> tree. For data, verification is done at ioend completion in a workqueue.
>
> When fs-verity is enabled on an inode, the XFS_IVERITY_CONSTRUCTION
> flag is set meaning that the Merkle tree is being build. The
> initialization ends with storing of verity descriptor and setting
> inode on-disk flag (XFS_DIFLAG2_VERITY). Lastly, the
> XFS_IVERITY_CONSTRUCTION is dropped and I_VERITY is set on inode.
>
> The descriptor is stored in a new block aligned to 64k after the last
> Merkle tree block. The size of the descriptor is stored at the end of
> the last descriptor block (descriptor can be multiple blocks).
>
> Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
> ---
> fs/xfs/xfs_bmap_util.c | 8 +
> fs/xfs/xfs_fsverity.c | 342 ++++++++++++++++++++++++++++++++++++++++-
> fs/xfs/xfs_fsverity.h | 2 +
> fs/xfs/xfs_message.c | 4 +
> fs/xfs/xfs_message.h | 1 +
> fs/xfs/xfs_mount.h | 2 +
> fs/xfs/xfs_super.c | 7 +
> 7 files changed, 365 insertions(+), 1 deletion(-)
>
> diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
> index 0ab00615f1ad..18348f4fd2aa 100644
> --- a/fs/xfs/xfs_bmap_util.c
> +++ b/fs/xfs/xfs_bmap_util.c
> @@ -31,6 +31,7 @@
> #include "xfs_rtbitmap.h"
> #include "xfs_rtgroup.h"
> #include "xfs_zone_alloc.h"
> +#include <linux/fsverity.h>
>
> /* Kernel only BMAP related definitions and functions */
>
> @@ -553,6 +554,13 @@ xfs_can_free_eofblocks(
> if (last_fsb <= end_fsb)
> return false;
>
> + /*
> + * Nothing to clean on fsverity inodes as they don't use prealloc and
> + * there no delalloc as only written data is fsverity metadata
> + */
> + if (IS_VERITY(VFS_I(ip)))
> + return false;
> +
> /*
> * Check if there is an post-EOF extent to free. If there are any
> * delalloc blocks attached to the inode (data fork delalloc
> diff --git a/fs/xfs/xfs_fsverity.c b/fs/xfs/xfs_fsverity.c
> index dc66ffb7d132..e5cd17ec15b6 100644
> --- a/fs/xfs/xfs_fsverity.c
> +++ b/fs/xfs/xfs_fsverity.c
> @@ -4,14 +4,26 @@
> */
> #include "xfs_platform.h"
> #include "xfs_format.h"
> -#include "xfs_inode.h"
> #include "xfs_shared.h"
> #include "xfs_trans_resv.h"
> #include "xfs_mount.h"
> #include "xfs_fsverity.h"
> +#include "xfs_da_format.h"
> +#include "xfs_da_btree.h"
> +#include "xfs_inode.h"
> +#include "xfs_log_format.h"
> +#include "xfs_bmap_util.h"
> +#include "xfs_log_format.h"
> +#include "xfs_trans.h"
> +#include "xfs_trace.h"
> +#include "xfs_quota.h"
> #include "xfs_fsverity.h"
> +#include "xfs_iomap.h"
> +#include "xfs_error.h"
> +#include "xfs_health.h"
> #include <linux/fsverity.h>
> #include <linux/iomap.h>
> +#include <linux/pagemap.h>
>
> /*
> * At maximum of 8 levels with 128 hashes per block (32 bytes SHA-256) maximum
> @@ -43,3 +55,331 @@ xfs_fsverity_is_file_data(
> return fsverity_active(inode) &&
> offset < xfs_fsverity_metadata_offset(ip);
> }
> +
> +/*
> + * Retrieve the verity descriptor.
> + */
> +static int
> +xfs_fsverity_get_descriptor(
> + struct inode *inode,
> + void *buf,
> + size_t buf_size)
> +{
> + struct xfs_inode *ip = XFS_I(inode);
> + struct xfs_mount *mp = ip->i_mount;
> + __be32 d_desc_size;
> + u32 desc_size;
> + u64 desc_size_pos;
> + int error;
> + u64 desc_pos;
> + struct xfs_bmbt_irec rec;
> + int is_empty;
> + uint32_t blocksize = i_blocksize(VFS_I(ip));
> + xfs_fileoff_t last_block_offset;
> +
> + ASSERT(inode->i_flags & S_VERITY);
> + error = xfs_bmap_last_extent(NULL, ip, XFS_DATA_FORK, &rec, &is_empty);
> + if (error)
> + return error;
> +
> + if (is_empty)
> + return -ENODATA;
> +
> + last_block_offset =
> + XFS_FSB_TO_B(mp, rec.br_startoff + rec.br_blockcount);
> + if (last_block_offset < xfs_fsverity_metadata_offset(ip))
> + return -ENODATA;
> +
> + desc_size_pos = last_block_offset - sizeof(__be32);
> + error = fsverity_pagecache_read(inode, (char *)&d_desc_size,
> + sizeof(d_desc_size), desc_size_pos);
> + if (error)
> + return error;
> +
> + desc_size = be32_to_cpu(d_desc_size);
> + if (XFS_IS_CORRUPT(mp, desc_size > FS_VERITY_MAX_DESCRIPTOR_SIZE))
> + return -ERANGE;
> + if (XFS_IS_CORRUPT(mp, desc_size > desc_size_pos))
> + return -ERANGE;
> +
> + if (!buf_size)
> + return desc_size;
> +
> + if (XFS_IS_CORRUPT(mp, desc_size > buf_size))
> + return -ERANGE;
> +
> + desc_pos = round_down(desc_size_pos - desc_size, blocksize);
> + error = fsverity_pagecache_read(inode, buf, desc_size, desc_pos);
Hmm so at this point ... the very last u32 mapped in the data fork
contains the size of the fsverity descriptor; and the descriptor itself
is in the bytes just before that u32 size field?
The merkle tree itself is in the bytes between
xfs_fsverity_metadata_offset() and the block(s) consumed by the
descriptor, right?
Eventually it'd be awful nice to see an update to the ondisk format
docs, though it's probably more useful to have me guess at the format
and have you confirm that I got the details right; then at least two
people will know what the ondisk format is for fsverity stuff. :)
> + if (error)
> + return error;
> +
> + return desc_size;
> +}
> +
> +static int
> +xfs_fsverity_write_descriptor(
> + struct file *file,
> + const void *desc,
> + u32 desc_size,
> + u64 merkle_tree_size)
> +{
> + int error;
> + struct inode *inode = file_inode(file);
> + struct xfs_inode *ip = XFS_I(inode);
> + unsigned int blksize = ip->i_mount->m_attr_geo->blksize;
> + u64 tree_last_block =
> + xfs_fsverity_metadata_offset(ip) + merkle_tree_size;
> + u64 desc_pos = round_up(tree_last_block, 65536);
> + u64 desc_end = desc_pos + desc_size;
> + __be32 desc_size_disk = cpu_to_be32(desc_size);
> + u64 desc_size_pos =
> + round_up(desc_end + sizeof(desc_size_disk), blksize) -
> + sizeof(desc_size_disk);
> +
> + error = iomap_fsverity_write(file, desc_size_pos, sizeof(__be32),
> + (const void *)&desc_size_disk,
> + &xfs_buffered_write_iomap_ops,
> + &xfs_iomap_write_ops);
> + if (error)
> + return error;
> +
> + error = iomap_fsverity_write(file, desc_pos, desc_size, desc,
> + &xfs_buffered_write_iomap_ops,
> + &xfs_iomap_write_ops);
> +
> + return error;
This could turn into the shorter "return iomap_fsverity_write()"
I don't see anything objectionable here, but I would like confirmation
that I've sniffed out the ondisk format correctly.
--D
> +}
> +
> +/*
> + * Try to remove all the fsverity metadata after a failed enablement.
> + */
> +static int
> +xfs_fsverity_delete_metadata(
> + struct xfs_inode *ip)
> +{
> + struct xfs_trans *tp;
> + struct xfs_mount *mp = ip->i_mount;
> + int error;
> +
> + error = xfs_trans_alloc(mp, &M_RES(mp)->tr_itruncate, 0, 0, 0, &tp);
> + if (error)
> + return error;
> +
> + xfs_ilock(ip, XFS_ILOCK_EXCL);
> + xfs_trans_ijoin(tp, ip, 0);
> +
> + /*
> + * We removing post EOF data, no need to update i_size as fsverity
> + * didn't move i_size in the first place
> + */
> + error = xfs_itruncate_extents(&tp, ip, XFS_DATA_FORK, XFS_ISIZE(ip));
> + if (error)
> + goto err_cancel;
> +
> + error = xfs_trans_commit(tp);
> + if (error)
> + goto err_cancel;
> + xfs_iunlock(ip, XFS_ILOCK_EXCL);
> +
> + return error;
> +
> +err_cancel:
> + xfs_iunlock(ip, XFS_ILOCK_EXCL);
> + xfs_trans_cancel(tp);
> + return error;
> +}
> +
> +
> +/*
> + * Prepare to enable fsverity by clearing old metadata.
> + */
> +static int
> +xfs_fsverity_begin_enable(
> + struct file *filp)
> +{
> + struct inode *inode = file_inode(filp);
> + struct xfs_inode *ip = XFS_I(inode);
> + int error;
> +
> + xfs_assert_ilocked(ip, XFS_IOLOCK_EXCL);
> +
> + if (IS_DAX(inode))
> + return -EINVAL;
> +
> + if (inode->i_size > XFS_FSVERITY_LARGEST_FILE)
> + return -EFBIG;
> +
> + /*
> + * Flush pagecache before building Merkle tree. Inode is locked and no
> + * further writes will happen to the file except fsverity metadata
> + */
> + error = filemap_write_and_wait(inode->i_mapping);
> + if (error)
> + return error;
> +
> + if (xfs_iflags_test_and_set(ip, XFS_VERITY_CONSTRUCTION))
> + return -EBUSY;
> +
> + error = xfs_qm_dqattach(ip);
> + if (error)
> + return error;
> +
> + return xfs_fsverity_delete_metadata(ip);
> +}
> +
> +/*
> + * Complete (or fail) the process of enabling fsverity.
> + */
> +static int
> +xfs_fsverity_end_enable(
> + struct file *file,
> + const void *desc,
> + size_t desc_size,
> + u64 merkle_tree_size)
> +{
> + struct inode *inode = file_inode(file);
> + struct xfs_inode *ip = XFS_I(inode);
> + struct xfs_mount *mp = ip->i_mount;
> + struct xfs_trans *tp;
> + int error = 0;
> + loff_t range_start = xfs_fsverity_metadata_offset(ip);
> +
> + xfs_assert_ilocked(ip, XFS_IOLOCK_EXCL);
> +
> + /* fs-verity failed, just cleanup */
> + if (desc == NULL)
> + goto out;
> +
> + error = xfs_fsverity_write_descriptor(file, desc, desc_size,
> + merkle_tree_size);
> + if (error)
> + goto out;
> +
> + /*
> + * Wait for Merkle tree get written to disk before setting on-disk inode
> + * flag and clearing XFS_VERITY_CONSTRUCTION
> + */
> + error = filemap_write_and_wait_range(inode->i_mapping, range_start,
> + LLONG_MAX);
> + if (error)
> + goto out;
> +
> + /*
> + * Set fsverity inode flag
> + */
> + error = xfs_trans_alloc_inode(ip, &M_RES(mp)->tr_ichange,
> + 0, 0, false, &tp);
> + if (error)
> + goto out;
> +
> + /*
> + * Ensure that we've persisted the verity information before we enable
> + * it on the inode and tell the caller we have sealed the inode.
> + */
> + ip->i_diflags2 |= XFS_DIFLAG2_VERITY;
> +
> + xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
> + xfs_trans_set_sync(tp);
> +
> + error = xfs_trans_commit(tp);
> + xfs_iunlock(ip, XFS_ILOCK_EXCL);
> +
> + if (!error)
> + inode->i_flags |= S_VERITY;
> +
> +out:
> + if (error) {
> + int error2;
> +
> + error2 = xfs_fsverity_delete_metadata(ip);
> + if (error2)
> + xfs_alert(ip->i_mount,
> +"ino 0x%llx failed to clean up new fsverity metadata, err %d",
> + ip->i_ino, error2);
> + }
> +
> + xfs_iflags_clear(ip, XFS_VERITY_CONSTRUCTION);
> + return error;
> +}
> +
> +/*
> + * Retrieve a merkle tree block.
> + */
> +static struct page *
> +xfs_fsverity_read_merkle(
> + struct inode *inode,
> + pgoff_t index)
> +{
> + index += xfs_fsverity_metadata_offset(XFS_I(inode)) >> PAGE_SHIFT;
> +
> + return generic_read_merkle_tree_page(inode, index);
> +}
> +
> +/*
> + * Retrieve a merkle tree block.
> + */
> +static void
> +xfs_fsverity_readahead_merkle_tree(
> + struct inode *inode,
> + pgoff_t index,
> + unsigned long nr_pages)
> +{
> + index += xfs_fsverity_metadata_offset(XFS_I(inode)) >> PAGE_SHIFT;
> +
> + generic_readahead_merkle_tree(inode, index, nr_pages);
> +}
> +
> +/*
> + * Write a merkle tree block.
> + */
> +static int
> +xfs_fsverity_write_merkle(
> + struct file *file,
> + const void *buf,
> + u64 pos,
> + unsigned int size,
> + const u8 *zero_digest,
> + unsigned int digest_size)
> +{
> + struct inode *inode = file_inode(file);
> + struct xfs_inode *ip = XFS_I(inode);
> + loff_t position = pos +
> + xfs_fsverity_metadata_offset(ip);
> + const char *p;
> + unsigned int i;
> +
> + if (position + size > inode->i_sb->s_maxbytes)
> + return -EFBIG;
> +
> + /*
> + * If this is a block full of hashes of zeroed blocks, don't bother
> + * storing the block. We can synthesize them later.
> + *
> + * However, do this only in case Merkle tree block == fs block size.
> + * Iomap synthesizes these blocks based on holes in the merkle tree. We
> + * won't be able to tell if something need to be synthesizes for the
> + * range in the fs block. For example, for 4k filesystem block
> + *
> + * [ 1k | zero hashes | zero hashes | 1k ]
> + *
> + * Iomap won't know about these empty blocks.
> + */
> + for (i = 0, p = buf; i < size; i += digest_size, p += digest_size)
> + if (memcmp(p, zero_digest, digest_size))
> + break;
> + if (i == size && size == ip->i_mount->m_sb.sb_blocksize)
> + return 0;
> +
> + return iomap_fsverity_write(file, position, size, buf,
> + &xfs_buffered_write_iomap_ops,
> + &xfs_iomap_write_ops);
> +}
> +
> +const struct fsverity_operations xfs_fsverity_ops = {
> + .begin_enable_verity = xfs_fsverity_begin_enable,
> + .end_enable_verity = xfs_fsverity_end_enable,
> + .get_verity_descriptor = xfs_fsverity_get_descriptor,
> + .read_merkle_tree_page = xfs_fsverity_read_merkle,
> + .readahead_merkle_tree = xfs_fsverity_readahead_merkle_tree,
> + .write_merkle_tree_block = xfs_fsverity_write_merkle,
> +};
> diff --git a/fs/xfs/xfs_fsverity.h b/fs/xfs/xfs_fsverity.h
> index ec77ba571106..6a981e20a75b 100644
> --- a/fs/xfs/xfs_fsverity.h
> +++ b/fs/xfs/xfs_fsverity.h
> @@ -6,8 +6,10 @@
> #define __XFS_FSVERITY_H__
>
> #include "xfs_platform.h"
> +#include <linux/fsverity.h>
>
> #ifdef CONFIG_FS_VERITY
> +extern const struct fsverity_operations xfs_fsverity_ops;
> loff_t xfs_fsverity_metadata_offset(const struct xfs_inode *ip);
> bool xfs_fsverity_is_file_data(const struct xfs_inode *ip, loff_t offset);
> #else
> diff --git a/fs/xfs/xfs_message.c b/fs/xfs/xfs_message.c
> index fd297082aeb8..9818d8f8f239 100644
> --- a/fs/xfs/xfs_message.c
> +++ b/fs/xfs/xfs_message.c
> @@ -153,6 +153,10 @@ xfs_warn_experimental(
> .opstate = XFS_OPSTATE_WARNED_ZONED,
> .name = "zoned RT device",
> },
> + [XFS_EXPERIMENTAL_FSVERITY] = {
> + .opstate = XFS_OPSTATE_WARNED_FSVERITY,
> + .name = "fsverity",
> + },
> };
> ASSERT(feat >= 0 && feat < XFS_EXPERIMENTAL_MAX);
> BUILD_BUG_ON(ARRAY_SIZE(features) != XFS_EXPERIMENTAL_MAX);
> diff --git a/fs/xfs/xfs_message.h b/fs/xfs/xfs_message.h
> index 49b0ef40d299..083403944f11 100644
> --- a/fs/xfs/xfs_message.h
> +++ b/fs/xfs/xfs_message.h
> @@ -94,6 +94,7 @@ enum xfs_experimental_feat {
> XFS_EXPERIMENTAL_SHRINK,
> XFS_EXPERIMENTAL_LARP,
> XFS_EXPERIMENTAL_ZONED,
> + XFS_EXPERIMENTAL_FSVERITY,
>
> XFS_EXPERIMENTAL_MAX,
> };
> diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
> index c746bc90cf3e..a4885fe7aa3b 100644
> --- a/fs/xfs/xfs_mount.h
> +++ b/fs/xfs/xfs_mount.h
> @@ -583,6 +583,8 @@ __XFS_HAS_FEAT(nouuid, NOUUID)
> #define XFS_OPSTATE_WARNED_ZONED 19
> /* (Zoned) GC is in progress */
> #define XFS_OPSTATE_ZONEGC_RUNNING 20
> +/* Kernel has logged a warning about fsverity support */
> +#define XFS_OPSTATE_WARNED_FSVERITY 21
>
> #define __XFS_IS_OPSTATE(name, NAME) \
> static inline bool xfs_is_ ## name (struct xfs_mount *mp) \
> diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
> index abc45f860a73..b7a16dc8de52 100644
> --- a/fs/xfs/xfs_super.c
> +++ b/fs/xfs/xfs_super.c
> @@ -30,6 +30,7 @@
> #include "xfs_filestream.h"
> #include "xfs_quota.h"
> #include "xfs_sysfs.h"
> +#include "xfs_fsverity.h"
> #include "xfs_ondisk.h"
> #include "xfs_rmap_item.h"
> #include "xfs_refcount_item.h"
> @@ -1686,6 +1687,9 @@ xfs_fs_fill_super(
> sb->s_quota_types = QTYPE_MASK_USR | QTYPE_MASK_GRP | QTYPE_MASK_PRJ;
> #endif
> sb->s_op = &xfs_super_operations;
> +#ifdef CONFIG_FS_VERITY
> + sb->s_vop = &xfs_fsverity_ops;
> +#endif
>
> /*
> * Delay mount work if the debug hook is set. This is debug
> @@ -1939,6 +1943,9 @@ xfs_fs_fill_super(
> if (error)
> goto out_filestream_unmount;
>
> + if (xfs_has_verity(mp))
> + xfs_warn_experimental(mp, XFS_EXPERIMENTAL_FSVERITY);
> +
> root = igrab(VFS_I(mp->m_rootip));
> if (!root) {
> error = -ENOENT;
> --
> 2.51.2
>
>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox