linux-kernel - [PATCH] tmpfs: fix data loss from failed fallocate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a5dac112-cf4b-7af-a33-f386e347fd38@google.com>
Date:   Sun, 4 Dec 2022 16:51:50 -0800 (PST)
From:   Hugh Dickins <hughd@...gle.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
cc:     Rui Wang <kernel@....cc>, Matthew Wilcox <willy@...radead.org>,
        Guoqi Chen <chenguoqic@....com>,
        Huacai Chen <chenhuacai@...ngson.cn>, Rui Wang <r@....cc>,
        Vishal Moola <vishal.moola@...il.com>,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: [PATCH] tmpfs: fix data loss from failed fallocate

Fix tmpfs data loss when the fallocate system call is interrupted by a
signal, or fails for some other reason.  The partial folio handling in
shmem_undo_range() forgot to consider this unfalloc case, and was liable
to erase or truncate out data which had already been committed earlier.

It turns out that none of the partial folio handling there is appropriate
for the unfalloc case, which just wants to proceed to removal of whole
folios: which find_get_entries() provides, even when partially covered.

Link: https://lore.kernel.org/linux-mm/33b85d82.7764.1842e9ab207.Coremail.chenguoqic@163.com/
Fixes: b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios")
Reported-by: Guoqi Chen <chenguoqic@....com>
Original-patch-by: Rui Wang <kernel@....cc>
Cc: Huacai Chen <chenhuacai@...ngson.cn>
Cc: Matthew Wilcox <willy@...radead.org>
Cc: Vishal Moola (Oracle) <vishal.moola@...il.com>
Cc: stable@...r.kernel.org # 5.17+
Signed-off-by: Hugh Dickins <hughd@...gle.com>
---

 mm/shmem.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- 6.1-rc8/mm/shmem.c
+++ linux/mm/shmem.c
@@ -948,6 +948,15 @@ static void shmem_undo_range(struct inod
 		index++;
 	}
 
+	/*
+	 * When undoing a failed fallocate, we want none of the partial folio
+	 * zeroing and splitting below, but shall want to truncate the whole
+	 * folio when !uptodate indicates that it was added by this fallocate,
+	 * even when [lstart, lend] covers only a part of the folio.
+	 */
+	if (unfalloc)
+		goto whole_folios;
+
 	same_folio = (lstart >> PAGE_SHIFT) == (lend >> PAGE_SHIFT);
 	folio = shmem_get_partial_folio(inode, lstart >> PAGE_SHIFT);
 	if (folio) {
@@ -973,6 +982,8 @@ static void shmem_undo_range(struct inod
 		folio_put(folio);
 	}
 
+whole_folios:
+
 	index = start;
 	while (index < end) {
 		cond_resched();