[PATCH v8 12/15] xfs: test for an extsize hint again under the ILOCK

[Chris Mason <mason@kernel.org>]

A store through a shared mapping can corrupt the data fork and the free
block counter on disk, if the realtime flag of the file is set during
the write fault and realtime extents are larger than one block.

Such a realtime inode has an extent size hint, and cannot use delayed
allocation. xfs_buffered_write_iomap_begin() tests for a hint before it
takes the ILOCK. FS_IOC_FSSETXATTR can change the flag of a file with no
blocks until then, since a fault never takes the IOLOCK:

    write fault                           FS_IOC_FSSETXATTR
    ===========                           =================
    xfs_buffered_write_iomap_begin()
      xfs_get_extsz_hint() is 0
                                          sets the realtime flag
      xfs_ilock_for_iomap()
      xfs_bmapi_reserve_delalloc()
        /* 1 block, 0 realtime extents */

The fix used here is to test for a hint again once the ILOCK is held,
and to allocate the blocks right away if the inode has got one.

Signed-off-by: Chris Mason <mason@kernel.org>
---

Notes:
    v7->v8:
    - New patch.

 fs/xfs/xfs_iomap.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index d36650450cbb..b414e2cff346 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -1903,6 +1903,16 @@ xfs_buffered_write_iomap_begin(
 		goto out_unlock;
 	}
 
+	/*
+	 * A write fault doesn't hold the IOLOCK, so the inode may have got an
+	 * extent size hint since the test above.
+	 */
+	if (xfs_get_extsz_hint(ip)) {
+		xfs_iunlock(ip, lockmode);
+		return xfs_direct_write_iomap_begin(inode, offset, count,
+				flags, iomap, srcmap);
+	}
+
 	if (XFS_IS_CORRUPT(mp, !xfs_ifork_has_extents(&ip->i_df)) ||
 	    XFS_TEST_ERROR(mp, XFS_ERRTAG_BMAPIFORMAT)) {
 		xfs_bmap_mark_sick(ip, XFS_DATA_FORK);
-- 
2.55.0