Bug 217209

Summary: ext4_da_write_end: i_disksize exceeds i_size in paritally written case
Product: File System Reporter: Zhihao Cheng (chengzhihao1)
Component: ext4Assignee: fs_ext4 (fs_ext4)
Status: NEW ---    
Severity: normal    
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 6.3.0-rc2 Subsystem:
Regression: No Bisected commit-id:
Attachments: a.c
diff

Description Zhihao Cheng 2023-03-17 01:31:14 UTC
Following process makes i_disksize exceed i_size:
    
    generic_perform_write
     copied = iov_iter_copy_from_user_atomic(len) // copied < len
     ext4_da_write_end
     | ext4_update_i_disksize
     |  new_i_size = pos + copied;
     |  WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize
     | generic_write_end
     |  copied = block_write_end(copied, len) // copied = 0
     |   if (unlikely(copied < len))
     |    if (!PageUptodate(page))
     |     copied = 0;
     |  if (pos + copied > inode->i_size) // return false
     if (unlikely(copied == 0))
      goto again;
     if (unlikely(iov_iter_fault_in_readable(i, bytes))) {
      status = -EFAULT;
      break;
     }
    
We get i_disksize greater than i_size here, which could trigger WARNING check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio:

    ext4_dio_write_iter
     iomap_dio_rw
      __iomap_dio_rw // return err, length is not aligned to 512
     ext4_handle_inode_extension
      WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops
Comment 1 Zhihao Cheng 2023-03-17 01:32:56 UTC
Reproducer:
1. Apply diff and compile kernel
2. gcc -o aa a.c && ./aa

[   60.567873] inject
[   60.568175] iomap_dio_bio_iter len 409
[   60.569383] ------------[ cut here ]------------
[   60.570198] WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319 ext4_file_write_iter+0xbc7/0xd10
[   60.571698] Modules linked in:
[   60.572282] CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2-00009-g5312a778686a-dirty #1136
[   60.573723] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproje4
[   60.575989] RIP: 0010:ext4_file_write_iter+0xbc7/0xd10
[   60.576905] Code: b6 0d e5 0c 01 48 83 05 d6 10 e5 0c 01 e9 f1 fd ff ff 48 83 05 09 13 e5 0c 01 49 89 c7 e9 01 fb ff ff 48 8c
[   60.580074] RSP: 0018:ffffc9000191bde0 EFLAGS: 00010202
[   60.580842] RAX: 000000000000012c RBX: 0000000000000000 RCX: 0000000001bea002
[   60.581516] RDX: 0000000001be8002 RSI: ffff888172aff5c0 RDI: 0000000000030f70
[   60.582184] RBP: ffffc9000191be70 R08: ffff888172aff588 R09: 0000000000000000
[   60.582839] R10: 0000000000000001 R11: 0000000000000199 R12: ffff888173d64610
[   60.583513] R13: 000000000000000a R14: ffffc9000191be98 R15: ffffffffffffffea
[   60.584186] FS:  00007f96cc2f1440(0000) GS:ffff88842fd00000(0000) knlGS:0000000000000000
[   60.584932] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   60.585489] CR2: 0000000000da4048 CR3: 0000000174498000 CR4: 00000000000006e0
[   60.586161] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   60.586816] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   60.587490] Call Trace:
[   60.587727]  <TASK>
[   60.587933]  ? __call_rcu_common.constprop.0+0x111/0xa80
[   60.588450]  vfs_write+0x3b1/0x5c0
[   60.588778]  ksys_write+0x77/0x160
[   60.589117]  __x64_sys_write+0x22/0x30
[   60.589471]  do_syscall_64+0x39/0x80
[   60.589809]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[   60.590296] RIP: 0033:0x7f96cbd00130
[   60.590640] Code: 73 01 c3 48 8b 0d 58 ed 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d b9 45 2d 00 00 75 10 b4
[   60.592365] RSP: 002b:00007ffc18543058 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   60.593065] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96cbd00130
[   60.593751] RDX: 0000000000000199 RSI: 0000000000da3000 RDI: 0000000000000003
[   60.594433] RBP: 00007ffc18543080 R08: 0000000000da4010 R09: 0000000000001050
[   60.595096] R10: 000000000000007c R11: 0000000000000246 R12: 0000000000400600
[   60.595755] R13: 00007ffc18543160 R14: 0000000000000000 R15: 0000000000000000
[   60.596435]  </TASK>
[   60.596647] ---[ end trace 0000000000000000 ]---
Comment 2 Zhihao Cheng 2023-03-17 01:33:13 UTC
Created attachment 303969 [details]
a.c
Comment 3 Zhihao Cheng 2023-03-17 01:33:26 UTC
Created attachment 303970 [details]
diff