Commit e86ba12c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'nfs-for-6.17-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs 

Pull NFS client fix from Trond Myklebust:

 - NFS: Fix a data corrupting race when updating an existing write

* tag 'nfs-for-6.17-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFS: Fix a race when updating an existing write
parents 6eba757c 76d2e389

fs/nfs/pagelist.c

+5 −4
Original line number Diff line number Diff line
@@ -253,13 +253,14 @@ nfs_page_group_unlock(struct nfs_page *req) 
	nfs_page_clear_headlock(req);

}



/*

 * nfs_page_group_sync_on_bit_locked

/**

 * nfs_page_group_sync_on_bit_locked - Test if all requests have @bit set

 * @req: request in page group

 * @bit: PG_* bit that is used to sync page group

 *

 * must be called with page group lock held

 */

static bool

nfs_page_group_sync_on_bit_locked(struct nfs_page *req, unsigned int bit)

bool nfs_page_group_sync_on_bit_locked(struct nfs_page *req, unsigned int bit)

{

	struct nfs_page *head = req->wb_head;

	struct nfs_page *tmp;

fs/nfs/write.c

+10 −19
Original line number Diff line number Diff line
@@ -153,20 +153,10 @@ nfs_page_set_inode_ref(struct nfs_page *req, struct inode *inode) 
	}

}



static int

nfs_cancel_remove_inode(struct nfs_page *req, struct inode *inode)

static void nfs_cancel_remove_inode(struct nfs_page *req, struct inode *inode)

{

	int ret;



	if (!test_bit(PG_REMOVE, &req->wb_flags))

		return 0;

	ret = nfs_page_group_lock(req);

	if (ret)

		return ret;

	if (test_and_clear_bit(PG_REMOVE, &req->wb_flags))

		nfs_page_set_inode_ref(req, inode);

	nfs_page_group_unlock(req);

	return 0;

}



/**
@@ -585,19 +575,18 @@ static struct nfs_page *nfs_lock_and_join_requests(struct folio *folio) 
		}

	}



	ret = nfs_page_group_lock(head);

	if (ret < 0)

		goto out_unlock;



	/* Ensure that nobody removed the request before we locked it */

	if (head != folio->private) {

		nfs_page_group_unlock(head);

		nfs_unlock_and_release_request(head);

		goto retry;

	}



	ret = nfs_cancel_remove_inode(head, inode);

	if (ret < 0)

		goto out_unlock;



	ret = nfs_page_group_lock(head);

	if (ret < 0)

		goto out_unlock;

	nfs_cancel_remove_inode(head, inode);



	/* lock each request in the page group */

	for (subreq = head->wb_this_page;
@@ -786,7 +775,8 @@ static void nfs_inode_remove_request(struct nfs_page *req) 
{

	struct nfs_inode *nfsi = NFS_I(nfs_page_to_inode(req));



	if (nfs_page_group_sync_on_bit(req, PG_REMOVE)) {

	nfs_page_group_lock(req);

	if (nfs_page_group_sync_on_bit_locked(req, PG_REMOVE)) {

		struct folio *folio = nfs_page_to_folio(req->wb_head);

		struct address_space *mapping = folio->mapping;
@@ -798,6 +788,7 @@ static void nfs_inode_remove_request(struct nfs_page *req) 
		}

		spin_unlock(&mapping->i_private_lock);

	}

	nfs_page_group_unlock(req);



	if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags)) {

		atomic_long_dec(&nfsi->nrequests);

include/linux/nfs_page.h

+1 −0
Original line number Diff line number Diff line
@@ -160,6 +160,7 @@ extern void nfs_join_page_group(struct nfs_page *head, 
extern int nfs_page_group_lock(struct nfs_page *);

extern void nfs_page_group_unlock(struct nfs_page *);

extern bool nfs_page_group_sync_on_bit(struct nfs_page *, unsigned int);

extern bool nfs_page_group_sync_on_bit_locked(struct nfs_page *, unsigned int);

extern	int nfs_page_set_headlock(struct nfs_page *req);

extern void nfs_page_clear_headlock(struct nfs_page *req);

extern bool nfs_async_iocounter_wait(struct rpc_task *, struct nfs_lock_context *);