linux-kernel - [PATCH] xfs: Honor FALLOC_FL_KEEP_SIZE when punching ends of files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <22a11e65fd5037498a78de61f3ed4dae466ad854.1489791330.git.calvinowens@fb.com>
Date:   Fri, 17 Mar 2017 18:24:48 -0700
From:   Calvin Owens <calvinowens@...com>
To:     "Darrick J. Wong" <darrick.wong@...cle.com>
CC:     <linux-xfs@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        Christoph Hellwig <hch@....de>,
        Dave Chinner <david@...morbit.com>, <kernel-team@...com>,
        <stable@...r.kernel.org>
Subject: [PATCH] xfs: Honor FALLOC_FL_KEEP_SIZE when punching ends of files

Commit 3c2bdc912a1cc050 ("xfs: kill xfs_zero_remaining_bytes") replaced
xfs_zero_remaining_bytes() with calls to iomap helpers.

Unfortunately the new iomap helpers don't enforce that [pos,count) lies
strictly on [0,i_size). This causes fallocate(mode=PUNCH_HOLE|KEEP_SIZE)
calls touching [i_size & ~PAGE_MASK, OFF_T_MAX] to round i_size up to
the nearest multiple of PAGE_SIZE:

  calvinow@...disks/generic-xfs-1 ~$ dd if=/dev/urandom of=test bs=2048 count=1
  calvinow@...disks/generic-xfs-1 ~$ stat test
    Size: 2048            Blocks: 8          IO Block: 4096   regular file
  calvinow@...disks/generic-xfs-1 ~$ fallocate -n -l 2048 -o 2048 -p test
  calvinow@...disks/generic-xfs-1 ~$ stat test
    Size: 4096            Blocks: 8          IO Block: 4096   regular file

Fix this by reintroducing the checks xfs_zero_remaining_bytes() did
against i_size into xfs_zero_range().

Reported-by: Aaron Gao <gzh@...com>
Fixes: 3c2bdc912a1cc050 ("xfs: kill xfs_zero_remaining_bytes")
Cc: Christoph Hellwig <hch@....de>
Cc: <stable@...r.kernel.org> # 4.8+
Signed-off-by: Calvin Owens <calvinowens@...com>
---
 fs/xfs/xfs_file.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 35703a8..da7cd27 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -58,6 +58,17 @@ xfs_zero_range(
 	xfs_off_t		count,
 	bool			*did_zero)
 {
+	/*
+	 * Avoid doing I/O beyond eof - it's not necessary
+	 * since nothing can read beyond eof.  The space will
+	 * be zeroed when the file is extended anyway.
+	 */
+	if (pos >= XFS_ISIZE(ip))
+		return 0;
+
+	if ((pos + count) >= XFS_ISIZE(ip))
+		count = XFS_ISIZE(ip) - pos - 1;
+
 	return iomap_zero_range(VFS_I(ip), pos, count, NULL, &xfs_iomap_ops);
 }
 
-- 
2.9.3