Re: [PATCH v9 11/14] xfs: take the MMAPLOCK in xfs_fileattr_set()

[sashiko-bot@kernel.org]

> A store through a shared mapping can corrupt a realtime file system on
> disk, or shut a file system down, if FS_IOC_FSSETXATTR changes the
> realtime flag or an extent size hint of the file during the write fault.
> 
> A write fault reads the flag and the hints more than once: to choose
> delayed allocation, to size the block reservation, and again in the
> allocator. All of these have to see the same values. System calls that
> write do the same, but they hold the IOLOCK, which keeps the ioctl out.
> A fault only holds the MMAPLOCK, which the ioctl does not take:
> 
>     write fault                         FS_IOC_FSSETXATTR
>     ===========                         =================
>     takes the MMAPLOCK
>     xfs_iomap_write_direct()
>       reserves blocks for the old hint
>                                         takes the ILOCK
>                                         raises the hint
>                                         drops the ILOCK
>       takes the ILOCK
>       xfs_bmapi_write()
>         allocates for the new hint
>         /* more than was reserved */
> 
> The fix used here is to make the ioctl take the MMAPLOCK of a regular
> file as well.
> 
> Signed-off-by: Chris Mason <mason@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112214604.67875-1-mason@kernel.org?part=11