Re: [PATCH v9 10/14] xfs: refuse fallocate racing with realtime flag changes

[sashiko-bot@kernel.org]

> On a zoned XFS, fallocate() can dereference a NULL pointer if the
> realtime flag of the file is set during the call.
> 
> xfs_file_fallocate() reserves zoned space only for a zoned inode, and
> tests for that before it takes the iolock. FS_IOC_FSSETXATTR can change
> the realtime flag of a file with no blocks in that gap.
> xfs_falloc_force_zero() then sees a zoned inode and reads the
> reservation, which is NULL:
> 
>     fallocate(FALLOC_FL_ZERO_RANGE)     FS_IOC_FSSETXATTR
>     ===============================     =================
>                                         takes the iolock
>     sees that the inode is not zoned
>     waits for the iolock
>                                         sets the realtime flag
>                                         drops the iolock
>     xfs_falloc_force_zero()
>       sees that the inode is zoned
>       /* ac is NULL */
> 
> The fix used here is to test again under the iolock, and to fail the
> call with -EINVAL if the answer has changed, as the write path does.
> 
> Fixes: 058dd70c65ab ("xfs: implement buffered writes to zoned RT devices")
> Signed-off-by: Chris Mason <mason@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112214604.67875-1-mason@kernel.org?part=10