fat: mmu_private race fix

mmu_private is 64bits value, hence it's not atomic to update.

So, the access rule for mmu_private is we must hold ->i_mutex.  But,
fat_get_block() path doesn't follow the rule on non-allocation path.

This fixes by using i_size instead if non-allocation path.

Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/fat/cache.c b/fs/fat/cache.c
index 589edde..b426022 100644 (file)
--- a/fs/fat/cache.c
+++ b/fs/fat/cache.c
@@ -293,10 +293,12 @@ static int fat_bmap_cluster(struct inode *inode, int cluster)
 }
 
 int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys,
-            unsigned long *mapped_blocks)
+            unsigned long *mapped_blocks, int create)
 {
        struct super_block *sb = inode->i_sb;
        struct msdos_sb_info *sbi = MSDOS_SB(sb);
+       const unsigned long blocksize = sb->s_blocksize;
+       const unsigned char blocksize_bits = sb->s_blocksize_bits;
        sector_t last_block;
        int cluster, offset;
 
@@ -309,10 +311,21 @@ int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys,
                }
                return 0;
        }
-       last_block = (MSDOS_I(inode)->mmu_private + (sb->s_blocksize - 1))
-               >> sb->s_blocksize_bits;
-       if (sector >= last_block)
-               return 0;
+
+       last_block = (i_size_read(inode) + (blocksize - 1)) >> blocksize_bits;
+       if (sector >= last_block) {
+               if (!create)
+                       return 0;
+
+               /*
+                * ->mmu_private can access on only allocation path.
+                * (caller must hold ->i_mutex)
+                */
+               last_block = (MSDOS_I(inode)->mmu_private + (blocksize - 1))
+                       >> blocksize_bits;
+               if (sector >= last_block)
+                       return 0;
+       }
 
        cluster = sector >> (sbi->cluster_bits - sb->s_blocksize_bits);
        offset  = sector & (sbi->sec_per_clus - 1);

diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 140fc39..2ecaa17 100644 (file)
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -77,7 +77,7 @@ next:
 
        *bh = NULL;
        iblock = *pos >> sb->s_blocksize_bits;
-       err = fat_bmap(dir, iblock, &phys, &mapped_blocks);
+       err = fat_bmap(dir, iblock, &phys, &mapped_blocks, 0);
        if (err || !phys)
                return -1;      /* beyond EOF or error */
 

diff --git a/fs/fat/fat.h b/fs/fat/fat.h
index a69f7f9..4efc503 100644 (file)
--- a/fs/fat/fat.h
+++ b/fs/fat/fat.h
@@ -91,7 +91,9 @@ struct msdos_inode_info {
        /* for avoiding the race between fat_free() and fat_get_cluster() */
        unsigned int cache_valid_id;
 
-       loff_t mmu_private;
+       /* NOTE: mmu_private is 64bits, so must hold ->i_mutex to access */
+       loff_t mmu_private;     /* physically allocated size */
+
        int i_start;            /* first cluster or 0 */
        int i_logstart;         /* logical first cluster */
        int i_attrs;            /* unused attribute bits */
@@ -222,7 +224,7 @@ extern void fat_cache_inval_inode(struct inode *inode);
 extern int fat_get_cluster(struct inode *inode, int cluster,
                           int *fclus, int *dclus);
 extern int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys,
-                   unsigned long *mapped_blocks);
+                   unsigned long *mapped_blocks, int create);
 
 /* fat/dir.c */
 extern const struct file_operations fat_dir_operations;

diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index be88208..9e37ad9 100644 (file)
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -64,7 +64,7 @@ static inline int __fat_get_block(struct inode *inode, sector_t iblock,
        sector_t phys;
        int err, offset;
 
-       err = fat_bmap(inode, iblock, &phys, &mapped_blocks);
+       err = fat_bmap(inode, iblock, &phys, &mapped_blocks, create);
        if (err)
                return err;
        if (phys) {
@@ -94,7 +94,7 @@ static inline int __fat_get_block(struct inode *inode, sector_t iblock,
        *max_blocks = min(mapped_blocks, *max_blocks);
        MSDOS_I(inode)->mmu_private += *max_blocks << sb->s_blocksize_bits;
 
-       err = fat_bmap(inode, iblock, &phys, &mapped_blocks);
+       err = fat_bmap(inode, iblock, &phys, &mapped_blocks, create);
        if (err)
                return err;