Commit 70fe2f48 authored by Jan Kara's avatar Jan Kara Committed by Al Viro

aio: fix freeze protection of aio writes

Currently we dropped freeze protection of aio writes just after IO was
submitted. Thus aio write could be in flight while the filesystem was
frozen and that could result in unexpected situation like aio completion
wanting to convert extent type on frozen filesystem. Testcase from
Dmitry triggering this is like:

for ((i=0;i<60;i++));do fsfreeze -f /mnt ;sleep 1;fsfreeze -u /mnt;done &
fio --bs=4k --ioengine=libaio --iodepth=128 --size=1g --direct=1 \
    --runtime=60 --filename=/mnt/file --name=rand-write --rw=randwrite

Fix the problem by dropping freeze protection only once IO is completed
in aio_complete().
Reported-by: default avatarDmitry Monakhov <dmonakhov@openvz.org>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
[hch: forward ported on top of various VFS and aio changes]
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 89319d31
...@@ -1078,6 +1078,17 @@ static void aio_complete(struct kiocb *kiocb, long res, long res2) ...@@ -1078,6 +1078,17 @@ static void aio_complete(struct kiocb *kiocb, long res, long res2)
unsigned tail, pos, head; unsigned tail, pos, head;
unsigned long flags; unsigned long flags;
if (kiocb->ki_flags & IOCB_WRITE) {
struct file *file = kiocb->ki_filp;
/*
* Tell lockdep we inherited freeze protection from submission
* thread.
*/
__sb_writers_acquired(file_inode(file)->i_sb, SB_FREEZE_WRITE);
file_end_write(file);
}
/* /*
* Special case handling for sync iocbs: * Special case handling for sync iocbs:
* - events go directly into the iocb for fast handling * - events go directly into the iocb for fast handling
...@@ -1473,9 +1484,15 @@ static ssize_t aio_write(struct kiocb *req, struct iocb *iocb, bool vectored, ...@@ -1473,9 +1484,15 @@ static ssize_t aio_write(struct kiocb *req, struct iocb *iocb, bool vectored,
return ret; return ret;
ret = rw_verify_area(WRITE, file, &req->ki_pos, iov_iter_count(&iter)); ret = rw_verify_area(WRITE, file, &req->ki_pos, iov_iter_count(&iter));
if (!ret) { if (!ret) {
req->ki_flags |= IOCB_WRITE;
file_start_write(file); file_start_write(file);
ret = aio_ret(req, file->f_op->write_iter(req, &iter)); ret = aio_ret(req, file->f_op->write_iter(req, &iter));
file_end_write(file); /*
* We release freeze protection in aio_complete(). Fool lockdep
* by telling it the lock got released so that it doesn't
* complain about held lock when we return to userspace.
*/
__sb_writers_release(file_inode(file)->i_sb, SB_FREEZE_WRITE);
} }
kfree(iovec); kfree(iovec);
return ret; return ret;
......
...@@ -321,6 +321,7 @@ struct writeback_control; ...@@ -321,6 +321,7 @@ struct writeback_control;
#define IOCB_HIPRI (1 << 3) #define IOCB_HIPRI (1 << 3)
#define IOCB_DSYNC (1 << 4) #define IOCB_DSYNC (1 << 4)
#define IOCB_SYNC (1 << 5) #define IOCB_SYNC (1 << 5)
#define IOCB_WRITE (1 << 6)
struct kiocb { struct kiocb {
struct file *ki_filp; struct file *ki_filp;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment