Commit 23fffa92 authored by Lukas Czerner's avatar Lukas Czerner Committed by Theodore Ts'o

fs: move falloc collapse range check into the filesystem methods

Currently in do_fallocate in collapse range case we're checking
whether offset + len is not bigger than i_size.  However there is
nothing which would prevent i_size from changing so the check is
pointless.  It should be done in the file system itself and the file
system needs to make sure that i_size is not going to change.  The
i_size check for the other fallocate modes are also done in the
filesystems.

As it is now we can easily crash the kernel by having two processes
doing truncate and fallocate collapse range at the same time.  This
can be reproduced on ext4 and it is theoretically possible on xfs even
though I was not able to trigger it with this simple test.

This commit removes the check from do_fallocate and adds it to the
file system.
Signed-off-by: default avatarLukas Czerner <lczerner@redhat.com>
Signed-off-by: default avatar"Theodore Ts'o" <tytso@mit.edu>
Acked-by: default avatarDave Chinner <david@fromorbit.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
parent 8fc61d92
...@@ -5368,8 +5368,6 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) ...@@ -5368,8 +5368,6 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)
loff_t new_size; loff_t new_size;
int ret; int ret;
BUG_ON(offset + len > i_size_read(inode));
/* Collapse range works only on fs block size aligned offsets. */ /* Collapse range works only on fs block size aligned offsets. */
if (offset & (EXT4_BLOCK_SIZE(sb) - 1) || if (offset & (EXT4_BLOCK_SIZE(sb) - 1) ||
len & (EXT4_BLOCK_SIZE(sb) - 1)) len & (EXT4_BLOCK_SIZE(sb) - 1))
...@@ -5398,6 +5396,15 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) ...@@ -5398,6 +5396,15 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len)
/* Take mutex lock */ /* Take mutex lock */
mutex_lock(&inode->i_mutex); mutex_lock(&inode->i_mutex);
/*
* There is no need to overlap collapse range with EOF, in which case
* it is effectively a truncate operation
*/
if (offset + len >= i_size_read(inode)) {
ret = -EINVAL;
goto out_mutex;
}
if (IS_SWAPFILE(inode)) { if (IS_SWAPFILE(inode)) {
ret = -ETXTBSY; ret = -ETXTBSY;
goto out_mutex; goto out_mutex;
......
...@@ -284,14 +284,6 @@ int do_fallocate(struct file *file, int mode, loff_t offset, loff_t len) ...@@ -284,14 +284,6 @@ int do_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0)) if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0))
return -EFBIG; return -EFBIG;
/*
* There is no need to overlap collapse range with EOF, in which case
* it is effectively a truncate operation
*/
if ((mode & FALLOC_FL_COLLAPSE_RANGE) &&
(offset + len >= i_size_read(inode)))
return -EINVAL;
if (!file->f_op->fallocate) if (!file->f_op->fallocate)
return -EOPNOTSUPP; return -EOPNOTSUPP;
......
...@@ -840,7 +840,15 @@ xfs_file_fallocate( ...@@ -840,7 +840,15 @@ xfs_file_fallocate(
goto out_unlock; goto out_unlock;
} }
ASSERT(offset + len < i_size_read(inode)); /*
* There is no need to overlap collapse range with EOF,
* in which case it is effectively a truncate operation
*/
if (offset + len >= i_size_read(inode)) {
error = -EINVAL;
goto out_unlock;
}
new_size = i_size_read(inode) - len; new_size = i_size_read(inode) - len;
error = xfs_collapse_file_space(ip, offset, len); error = xfs_collapse_file_space(ip, offset, len);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment