releases/4.11.2/mm-fix-data-corruption-due-to-stale-mmap-reads.patch

   1 From cd656375f94632d7b5af57bf67b7b5c0270c591c Mon Sep 17 00:00:00 2001
   2 From: Jan Kara <jack@suse.cz>
   3 Date: Fri, 12 May 2017 15:46:50 -0700
   4 Subject: mm: fix data corruption due to stale mmap reads
   5
   6 From: Jan Kara <jack@suse.cz>
   7
   8 commit cd656375f94632d7b5af57bf67b7b5c0270c591c upstream.
   9
  10 Currently, we didn't invalidate page tables during invalidate_inode_pages2()
  11 for DAX.  That could result in e.g. 2MiB zero page being mapped into
  12 page tables while there were already underlying blocks allocated and
  13 thus data seen through mmap were different from data seen by read(2).
  14 The following sequence reproduces the problem:
  15
  16  - open an mmap over a 2MiB hole
  17
  18  - read from a 2MiB hole, faulting in a 2MiB zero page
  19
  20  - write to the hole with write(3p). The write succeeds but we
  21    incorrectly leave the 2MiB zero page mapping intact.
  22
  23  - via the mmap, read the data that was just written. Since the zero
  24    page mapping is still intact we read back zeroes instead of the new
  25    data.
  26
  27 Fix the problem by unconditionally calling invalidate_inode_pages2_range()
  28 in dax_iomap_actor() for new block allocations and by properly
  29 invalidating page tables in invalidate_inode_pages2_range() for DAX
  30 mappings.
  31
  32 Fixes: c6dcf52c23d2d3fb5235cec42d7dd3f786b87d55
  33 Link: http://lkml.kernel.org/r/20170510085419.27601-3-jack@suse.cz
  34 Signed-off-by: Jan Kara <jack@suse.cz>
  35 Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
  36 Cc: Dan Williams <dan.j.williams@intel.com>
  37 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  38 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  39 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  40
  41 ---
  42  fs/dax.c      |    2 +-
  43  mm/truncate.c |   11 +++++++++++
  44  2 files changed, 12 insertions(+), 1 deletion(-)
  45
  46 --- a/fs/dax.c
  47 +++ b/fs/dax.c
  48 @@ -1003,7 +1003,7 @@ dax_iomap_actor(struct inode *inode, lof
  49          * into page tables. We have to tear down these mappings so that data
  50          * written by write(2) is visible in mmap.
  51          */
  52 -       if ((iomap->flags & IOMAP_F_NEW) && inode->i_mapping->nrpages) {
  53 +       if (iomap->flags & IOMAP_F_NEW) {
  54                 invalidate_inode_pages2_range(inode->i_mapping,
  55                                               pos >> PAGE_SHIFT,
  56                                               (end - 1) >> PAGE_SHIFT);
  57 --- a/mm/truncate.c
  58 +++ b/mm/truncate.c
  59 @@ -683,6 +683,17 @@ int invalidate_inode_pages2_range(struct
  60                 cond_resched();
  61                 index++;
  62         }
  63 +       /*
  64 +        * For DAX we invalidate page tables after invalidating radix tree.  We
  65 +        * could invalidate page tables while invalidating each entry however
  66 +        * that would be expensive. And doing range unmapping before doesn't
  67 +        * work as we have no cheap way to find whether radix tree entry didn't
  68 +        * get remapped later.
  69 +        */
  70 +       if (dax_mapping(mapping)) {
  71 +               unmap_mapping_range(mapping, (loff_t)start << PAGE_SHIFT,
  72 +                                   (loff_t)(end - start + 1) << PAGE_SHIFT, 0);
  73 +       }
  74         cleancache_invalidate_inode(mapping);
  75         return ret;
  76  }