Skip to content

Commit 7aebdda

Browse files
author
Ronnie Sahlberg
committed
cifs: Fix race between hole punch and page fault
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2218388 commit b092b3e Cifs has a following race between hole punching and page fault: CPU1 CPU2 smb3_fallocate() smb3_punch_hole() truncate_pagecache_range() filemap_fault() - loads old data into the page cache SMB2_ioctl(..., FSCTL_SET_ZERO_DATA, ...) And now we have stale data in the page cache. Fix the problem by locking out faults (as well as reads) using mapping->invalidate_lock while hole punch is running. CC: Steve French <sfrench@samba.org> CC: linux-cifs@vger.kernel.org Signed-off-by: Jan Kara <jack@suse.cz> (cherry picked from commit b092b3e) Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
1 parent 9df3f49 commit 7aebdda

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

fs/cifs/smb2ops.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3405,6 +3405,7 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
34053405
return rc;
34063406
}
34073407

3408+
filemap_invalidate_lock(inode->i_mapping);
34083409
/*
34093410
* We implement the punch hole through ioctl, so we need remove the page
34103411
* caches first, otherwise the data may be inconsistent with the server.
@@ -3422,6 +3423,7 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
34223423
sizeof(struct file_zero_data_information),
34233424
CIFSMaxBufSize, NULL, NULL);
34243425
free_xid(xid);
3426+
filemap_invalidate_unlock(inode->i_mapping);
34253427
return rc;
34263428
}
34273429

0 commit comments

Comments
 (0)