Commit f10f59f9 authored by Qu Wenruo's avatar Qu Wenruo Committed by David Sterba
Browse files

btrfs: fix the delalloc range locking if sector size < page size 



Inside lock_delalloc_folios(), there are several problems related to
sector size < page size handling:

- Set the writer locks without checking if the folio is still valid
  We call btrfs_folio_start_writer_lock() just like it's folio_lock().
  But since the folio may not even be the folio of the current mapping,
  we can easily screw up the folio->private.

- The range is not clamped inside the page
  This means we can over write other bitmaps if the start/len is not
  properly handled, and trigger the btrfs_subpage_assert().

- @processed_end is always rounded up to page end
  If the delalloc range is not page aligned, and we need to retry
  (returning -EAGAIN), then we will unlock to the page end.

  Thankfully this is not a huge problem, as now
  btrfs_folio_end_writer_lock() can handle range larger than the locked
  range, and only unlock what is already locked.

Fix all these problems by:

- Lock and check the folio first, then call
  btrfs_folio_set_writer_lock()
  So that if we got a folio not belonging to the inode, we won't
  touch folio->private.

- Properly truncate the range inside the page

- Update @processed_end to the locked range end

Fixes: 1e1de387 ("btrfs: make process_one_page() to handle subpage locking")
CC: stable@vger.kernel.org # 6.1+
Signed-off-by: default avatarQu Wenruo <wqu@suse.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 5f9062a4

fs/btrfs/extent_io.c

+9 −8
Original line number Diff line number Diff line
@@ -262,22 +262,23 @@ static noinline int lock_delalloc_folios(struct inode *inode, 


		for (i = 0; i < found_folios; i++) {

			struct folio *folio = fbatch.folios[i];

			u32 len = end + 1 - start;

			u64 range_start;

			u32 range_len;



			if (folio == locked_folio)

				continue;



			if (btrfs_folio_start_writer_lock(fs_info, folio, start,

							  len))

				goto out;



			folio_lock(folio);

			if (!folio_test_dirty(folio) || folio->mapping != mapping) {

				btrfs_folio_end_writer_lock(fs_info, folio, start,

							    len);

				folio_unlock(folio);

				goto out;

			}

			range_start = max_t(u64, folio_pos(folio), start);

			range_len = min_t(u64, folio_pos(folio) + folio_size(folio),

					  end + 1) - range_start;

			btrfs_folio_set_writer_lock(fs_info, folio, range_start, range_len);



			processed_end = folio_pos(folio) + folio_size(folio) - 1;

			processed_end = range_start + range_len - 1;

		}

		folio_batch_release(&fbatch);

		cond_resched();