Commit 8ac5b996 authored by Dave Chinner's avatar Dave Chinner Committed by Darrick J. Wong

xfs: fix off-by-one-block in xfs_discard_folio()

The recent writeback corruption fixes changed the code in
xfs_discard_folio() to calculate a byte range to for punching
delalloc extents. A mistake was made in using round_up(pos) for the
end offset, because when pos points at the first byte of a block, it
does not get rounded up to point to the end byte of the block. hence
the punch range is short, and this leads to unexpected behaviour in
certain cases in xfs_bmap_punch_delalloc_range.

e.g. pos = 0 means we call xfs_bmap_punch_delalloc_range(0,0), so
there is no previous extent and it rounds up the punch to the end of
the delalloc extent it found at offset 0, not the end of the range
given to xfs_bmap_punch_delalloc_range().

Fix this by handling the zero block offset case correctly.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=217030
Link: https://lore.kernel.org/linux-xfs/Y+vOfaxIWX1c%2Fyy9@bfoster/
Fixes: 7348b322 ("xfs: xfs_bmap_punch_delalloc_range() should take a byte range")
Reported-by: default avatarPengfei Xu <pengfei.xu@intel.com>
Found-by: default avatarBrian Foster <bfoster@redhat.com>
Signed-off-by: default avatarDave Chinner <dchinner@redhat.com>
Reviewed-by: default avatarDarrick J. Wong <djwong@kernel.org>
Signed-off-by: default avatarDarrick J. Wong <djwong@kernel.org>
parent 0c7273e4
...@@ -449,15 +449,17 @@ xfs_prepare_ioend( ...@@ -449,15 +449,17 @@ xfs_prepare_ioend(
} }
/* /*
* If the page has delalloc blocks on it, we need to punch them out before we * If the folio has delalloc blocks on it, the caller is asking us to punch them
* invalidate the page. If we don't, we leave a stale delalloc mapping on the * out. If we don't, we can leave a stale delalloc mapping covered by a clean
* inode that can trip up a later direct I/O read operation on the same region. * page that needs to be dirtied again before the delalloc mapping can be
* converted. This stale delalloc mapping can trip up a later direct I/O read
* operation on the same region.
* *
* We prevent this by truncating away the delalloc regions on the page. Because * We prevent this by truncating away the delalloc regions on the folio. Because
* they are delalloc, we can do this without needing a transaction. Indeed - if * they are delalloc, we can do this without needing a transaction. Indeed - if
* we get ENOSPC errors, we have to be able to do this truncation without a * we get ENOSPC errors, we have to be able to do this truncation without a
* transaction as there is no space left for block reservation (typically why we * transaction as there is no space left for block reservation (typically why
* see a ENOSPC in writeback). * we see a ENOSPC in writeback).
*/ */
static void static void
xfs_discard_folio( xfs_discard_folio(
...@@ -475,8 +477,13 @@ xfs_discard_folio( ...@@ -475,8 +477,13 @@ xfs_discard_folio(
"page discard on page "PTR_FMT", inode 0x%llx, pos %llu.", "page discard on page "PTR_FMT", inode 0x%llx, pos %llu.",
folio, ip->i_ino, pos); folio, ip->i_ino, pos);
/*
* The end of the punch range is always the offset of the the first
* byte of the next folio. Hence the end offset is only dependent on the
* folio itself and not the start offset that is passed in.
*/
error = xfs_bmap_punch_delalloc_range(ip, pos, error = xfs_bmap_punch_delalloc_range(ip, pos,
round_up(pos, folio_size(folio))); folio_pos(folio) + folio_size(folio));
if (error && !xfs_is_shutdown(mp)) if (error && !xfs_is_shutdown(mp))
xfs_alert(mp, "page discard unable to remove delalloc mapping."); xfs_alert(mp, "page discard unable to remove delalloc mapping.");
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment