From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 37CFF3A1D2 for ; Wed, 18 Mar 2026 00:27:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773793628; cv=none; b=ji9elCRNyaW/nnbHfmeIto+UtOQkixg3fj75423g40wcEM2HYGJiUZzK3wa0Ptza+e5J8cF8thgFnJAsx406yMXDm0ve9CXVE2HXZq1BVmwJCGIPQsJJFe/IHvkVGCw12NzuybWNZmUbjnQeu81Hp+4E62QtK7nJSxCNYASWP48= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773793628; c=relaxed/simple; bh=CdjofAXhgHBxExrrj7eI98tH4RFUEsA2GWFVmpXyLus=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=F4tg4X1EIiIl0uuFgQqOq4jofBtb/DEWpwvfym7d/ZMBxRgYIn2QMThfXfvJN+f1LUu/0orDsMxH8irznuxKsiQZ1OazYG8UDk913cKnfTJqEGNJAJuTUjPDzPdsaC859iLwBIu3SOXc2l5myPYa2xSGrtAztOME9354lbfnRmk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=WTtTFjNN; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="WTtTFjNN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 158C8C4CEF7; Wed, 18 Mar 2026 00:27:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1773793627; bh=CdjofAXhgHBxExrrj7eI98tH4RFUEsA2GWFVmpXyLus=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WTtTFjNND2WWb35LviLVb06LKipq9gkA8CSvW5Z7c+YDFQgX2hd+SU05DHurCjver aLWcwjkibtkLh8PVENN63hJaamR7xWQ3lmGhOvB5vleibaMlXI2X/XNiCmDofnHMc8 ddr6BKatD6eqWU/cSWTTlQcLqYzyf2YkT2un7bQ1dZc+dYi4NT1cWZ3L93Eri2FaZX aZ+nnv1Bm3j/yuHtouCtkc9su/V9gXN1gtCvkCSRZeaQWkxgqEW0TMaZTCGcMTR8nH hAB/mJZSnBr78+UNWGqMDI7L8lwm9NYU9HEV2Ukv27tYoeE2D7e7yhzNRgN5G0zAiv 4kmsKYDDDk0sw== From: Sasha Levin To: stable@vger.kernel.org Cc: "Darrick J. Wong" , Christoph Hellwig , Carlos Maiolino , Christian Brauner , Sasha Levin Subject: [PATCH 6.12.y] iomap: reject delalloc mappings during writeback Date: Tue, 17 Mar 2026 20:27:04 -0400 Message-ID: <20260318002704.392804-1-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <2026031712-recant-discount-9829@gregkh> References: <2026031712-recant-discount-9829@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: "Darrick J. Wong" [ Upstream commit d320f160aa5ff36cdf83c645cca52b615e866e32 ] Filesystems should never provide a delayed allocation mapping to writeback; they're supposed to allocate the space before replying. This can lead to weird IO errors and crashes in the block layer if the filesystem is being malicious, or if it hadn't set iomap->dev because it's a delalloc mapping. Fix this by failing writeback on delalloc mappings. Currently no filesystems actually misbehave in this manner, but we ought to be stricter about things like that. Cc: stable@vger.kernel.org # v5.5 Fixes: 598ecfbaa742ac ("iomap: lift the xfs writeback code to iomap") Signed-off-by: Darrick J. Wong Link: https://patch.msgid.link/20260302173002.GL13829@frogsfrogsfrogs Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Christian Brauner [ iomap_add_to_ioend() => iomap_writepage_map_blocks() ] Signed-off-by: Sasha Levin --- fs/iomap/buffered-io.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index 397c96c25c31f..0178292c18648 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -1879,18 +1879,19 @@ static int iomap_writepage_map_blocks(struct iomap_writepage_ctx *wpc, WARN_ON_ONCE(!folio->private && map_len < dirty_len); switch (wpc->iomap.type) { - case IOMAP_INLINE: - WARN_ON_ONCE(1); - error = -EIO; - break; - case IOMAP_HOLE: - break; - default: + case IOMAP_UNWRITTEN: + case IOMAP_MAPPED: error = iomap_add_to_ioend(wpc, wbc, folio, inode, pos, end_pos, map_len); if (!error) (*count)++; break; + case IOMAP_HOLE: + break; + default: + WARN_ON_ONCE(1); + error = -EIO; + break; } dirty_len -= map_len; pos += map_len; -- 2.51.0