Re: [PATCH v9 12/14] xfs: restart faults racing with realtime flag changes

[sashiko-bot@kernel.org]

> On a zoned XFS, a store through a shared mapping can dereference a NULL
> pointer if the realtime flag of the file is set as the write fault
> starts.
> 
> xfs_write_fault() reserves zoned space only for a zoned inode. The
> reservation can wait for garbage collection, which takes the MMAPLOCK,
> so it comes ahead of that lock, and so does the test for a zoned inode.
> FS_IOC_FSSETXATTR can set the flag of a file with no blocks right after
> the test:
> 
>     write fault                           FS_IOC_FSSETXATTR
>     ===========                           =================
>     xfs_write_fault()
>       sees that the inode is not zoned
>                                           sets the realtime flag
>       takes the MMAPLOCK
>     xfs_buffered_write_iomap_begin()
>       sees that the inode is zoned
>       /* ac is NULL */
> 
> The fix used here is to test again under the MMAPLOCK, which keeps the
> ioctl out since "xfs: take the MMAPLOCK in xfs_fileattr_set()", and to
> start the fault over if the flag has changed.
> 
> Fixes: 058dd70c65ab ("xfs: implement buffered writes to zoned RT devices")
> Signed-off-by: Chris Mason <mason@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112214604.67875-1-mason@kernel.org?part=12