[PATCH v8 14/15] xfs: resample the COW extsize hint after cycling ILOCK

[Chris Mason <mason@kernel.org>]

A write fault on a shared extent of a file with an extent size hint, or
of a DAX file, can overrun its block reservation and shut down the
filesystem, if it races with a change of the COW extent size hint.

xfs_reflink_fill_cow_hole() sizes the reservation from the hint and
drops the ILOCK for xfs_trans_alloc_inode(), and the allocator reads the
hint again once the lock is back. But a write fault only holds the
MMAPLOCK, and FS_IOC_FSSETXATTR changes the hint without it:

    write fault                         FS_IOC_FSSETXATTR
    ===========                         =================
    xfs_reflink_fill_cow_hole()
      hint is 1 block
      dblocks = 1 + bmbt blocks
      xfs_iunlock()
                                        xfs_ilock(ILOCK_EXCL)
                                        hint = 4096 blocks
                                        xfs_iunlock(ILOCK_EXCL)
      xfs_trans_alloc_inode()
      xfs_bmapi_write()
        allocates 4096 blocks
        xfs_trans_mod_sb()
          t_blk_res_used > t_blk_res

The fix used here is to compare the hint with the one that sized the
reservation once the ILOCK is held again, and to start over if it has
changed.

Signed-off-by: Chris Mason <mason@kernel.org>
---

Notes:
    v7->v8:
    - New patch.

 fs/xfs/xfs_reflink.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index ff89516154bd..665ee75cd349 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -445,14 +445,17 @@ xfs_reflink_fill_cow_hole(
 	struct xfs_mount	*mp = ip->i_mount;
 	struct xfs_trans	*tp;
 	xfs_filblks_t		resaligned;
+	xfs_extlen_t		cowextsz;
 	unsigned int		seq_before = READ_ONCE(ip->i_df.if_seq);
 	unsigned int		dblocks = 0, rblocks = 0;
 	int			nimaps;
 	int			error;
 	bool			found;
 
+retry:
+	cowextsz = xfs_get_cowextsz_hint(ip);
 	resaligned = xfs_aligned_fsb_count(imap->br_startoff,
-		imap->br_blockcount, xfs_get_cowextsz_hint(ip));
+		imap->br_blockcount, cowextsz);
 	if (XFS_IS_REALTIME_INODE(ip)) {
 		dblocks = XFS_DIOSTRAT_SPACE_RES(mp, 0);
 		rblocks = resaligned;
@@ -471,6 +474,15 @@ xfs_reflink_fill_cow_hole(
 
 	*lockmode = XFS_ILOCK_EXCL;
 
+	/*
+	 * A write fault doesn't hold the IOLOCK, so the hint that sized the
+	 * reservation may have changed while we dropped the ILOCK.
+	 */
+	if (cowextsz != xfs_get_cowextsz_hint(ip)) {
+		xfs_trans_cancel(tp);
+		goto retry;
+	}
+
 	/*
 	 * The data fork mapping may have changed while we dropped the ILOCK
 	 * (a racing O_DIRECT writer under IOLOCK_SHARED can complete a full
-- 
2.55.0