Commit 2bdf67eb authored by OGAWA Hirofumi's avatar OGAWA Hirofumi Committed by Linus Torvalds

fat: mmu_private race fix

mmu_private is 64bits value, hence it's not atomic to update.

So, the access rule for mmu_private is we must hold ->i_mutex.  But,
fat_get_block() path doesn't follow the rule on non-allocation path.

This fixes by using i_size instead if non-allocation path.
Signed-off-by: default avatarOGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 0e75f5da
...@@ -293,10 +293,12 @@ static int fat_bmap_cluster(struct inode *inode, int cluster) ...@@ -293,10 +293,12 @@ static int fat_bmap_cluster(struct inode *inode, int cluster)
} }
int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys, int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys,
unsigned long *mapped_blocks) unsigned long *mapped_blocks, int create)
{ {
struct super_block *sb = inode->i_sb; struct super_block *sb = inode->i_sb;
struct msdos_sb_info *sbi = MSDOS_SB(sb); struct msdos_sb_info *sbi = MSDOS_SB(sb);
const unsigned long blocksize = sb->s_blocksize;
const unsigned char blocksize_bits = sb->s_blocksize_bits;
sector_t last_block; sector_t last_block;
int cluster, offset; int cluster, offset;
...@@ -309,10 +311,21 @@ int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys, ...@@ -309,10 +311,21 @@ int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys,
} }
return 0; return 0;
} }
last_block = (MSDOS_I(inode)->mmu_private + (sb->s_blocksize - 1))
>> sb->s_blocksize_bits; last_block = (i_size_read(inode) + (blocksize - 1)) >> blocksize_bits;
if (sector >= last_block) if (sector >= last_block) {
return 0; if (!create)
return 0;
/*
* ->mmu_private can access on only allocation path.
* (caller must hold ->i_mutex)
*/
last_block = (MSDOS_I(inode)->mmu_private + (blocksize - 1))
>> blocksize_bits;
if (sector >= last_block)
return 0;
}
cluster = sector >> (sbi->cluster_bits - sb->s_blocksize_bits); cluster = sector >> (sbi->cluster_bits - sb->s_blocksize_bits);
offset = sector & (sbi->sec_per_clus - 1); offset = sector & (sbi->sec_per_clus - 1);
......
...@@ -77,7 +77,7 @@ static int fat__get_entry(struct inode *dir, loff_t *pos, ...@@ -77,7 +77,7 @@ static int fat__get_entry(struct inode *dir, loff_t *pos,
*bh = NULL; *bh = NULL;
iblock = *pos >> sb->s_blocksize_bits; iblock = *pos >> sb->s_blocksize_bits;
err = fat_bmap(dir, iblock, &phys, &mapped_blocks); err = fat_bmap(dir, iblock, &phys, &mapped_blocks, 0);
if (err || !phys) if (err || !phys)
return -1; /* beyond EOF or error */ return -1; /* beyond EOF or error */
......
...@@ -91,7 +91,9 @@ struct msdos_inode_info { ...@@ -91,7 +91,9 @@ struct msdos_inode_info {
/* for avoiding the race between fat_free() and fat_get_cluster() */ /* for avoiding the race between fat_free() and fat_get_cluster() */
unsigned int cache_valid_id; unsigned int cache_valid_id;
loff_t mmu_private; /* NOTE: mmu_private is 64bits, so must hold ->i_mutex to access */
loff_t mmu_private; /* physically allocated size */
int i_start; /* first cluster or 0 */ int i_start; /* first cluster or 0 */
int i_logstart; /* logical first cluster */ int i_logstart; /* logical first cluster */
int i_attrs; /* unused attribute bits */ int i_attrs; /* unused attribute bits */
...@@ -222,7 +224,7 @@ extern void fat_cache_inval_inode(struct inode *inode); ...@@ -222,7 +224,7 @@ extern void fat_cache_inval_inode(struct inode *inode);
extern int fat_get_cluster(struct inode *inode, int cluster, extern int fat_get_cluster(struct inode *inode, int cluster,
int *fclus, int *dclus); int *fclus, int *dclus);
extern int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys, extern int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys,
unsigned long *mapped_blocks); unsigned long *mapped_blocks, int create);
/* fat/dir.c */ /* fat/dir.c */
extern const struct file_operations fat_dir_operations; extern const struct file_operations fat_dir_operations;
......
...@@ -64,7 +64,7 @@ static inline int __fat_get_block(struct inode *inode, sector_t iblock, ...@@ -64,7 +64,7 @@ static inline int __fat_get_block(struct inode *inode, sector_t iblock,
sector_t phys; sector_t phys;
int err, offset; int err, offset;
err = fat_bmap(inode, iblock, &phys, &mapped_blocks); err = fat_bmap(inode, iblock, &phys, &mapped_blocks, create);
if (err) if (err)
return err; return err;
if (phys) { if (phys) {
...@@ -94,7 +94,7 @@ static inline int __fat_get_block(struct inode *inode, sector_t iblock, ...@@ -94,7 +94,7 @@ static inline int __fat_get_block(struct inode *inode, sector_t iblock,
*max_blocks = min(mapped_blocks, *max_blocks); *max_blocks = min(mapped_blocks, *max_blocks);
MSDOS_I(inode)->mmu_private += *max_blocks << sb->s_blocksize_bits; MSDOS_I(inode)->mmu_private += *max_blocks << sb->s_blocksize_bits;
err = fat_bmap(inode, iblock, &phys, &mapped_blocks); err = fat_bmap(inode, iblock, &phys, &mapped_blocks, create);
if (err) if (err)
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment