iomap: fix error handling regressions - #2648
Open
vfsci-bot[bot] wants to merge 3 commits into
Open
vfsci-bot[bot] wants to merge 3 commits into
vfsci-bot[bot] wants to merge 3 commits into
Conversation
iomap_add_to_ioend() submits the pending ioend through ->writeback_submit() before allocating a new one for the current range. When the submission fails the helper completes the ioend with an error, but iomap_add_to_ioend() returns the error without clearing wpc->wb_ctx. iomap_writepages() then submits whatever wpc->wb_ctx points to, so the already completed ioend is submitted a second time. For XFS the second bio_endio() lands in xfs_end_bio(), which list_add_tail()s the already linked ioend into ip->i_ioend_list. This corrupts the list and leaves a use-after-free/double-free window against the ioend completion worker. Clear wpc->wb_ctx when ->writeback_submit() fails. The old iomap_submit_ioend() cleared the context unconditionally; that clear was lost when submission moved to iomap_ioend_writeback_submit(). Fixes: f4fa798 ("iomap: hide ioends from the generic writeback code") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
iomap_fiemap() emits extents one behind: iomap_fiemap_iter() flushes the previous extent and remembers the current one, and the remembered extent is written with FIEMAP_EXTENT_LAST after the iteration loop. That final flush overwrites ret, so when ->iomap_begin() fails partway through the iteration the error is replaced by the result of iomap_to_fiemap() (zero on success) and iomap_fiemap() returns success with a truncated extent list whose last entry is wrongly marked as the last extent in the file. The pre-iomap_iter code returned the error from inside the loop, before flushing the pending extent. Check for the iteration error before flushing the pending extent, so that real errors are propagated and only a successful iteration emits the final FIEMAP_EXTENT_LAST extent. -ENOENT (no mapping) is still not an error, and the pending extent is still emitted in that case. Fixes: 7892386 ("iomap: switch iomap_fiemap to use iomap_iter") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
iomap_dio_bio_iter() falls through to the sub-block tail zeroing when the data bio submission fails, so that the rest of the block is still zeroed and stale data is not exposed. The zeroing result is assigned to ret, which overwrites the submission error with the successful zeroing result (zero) and the failed write is reported as success. Store the zeroing result separately and only use it when the data path did not already fail. Fixes: 10553a9 ("iomap: fix iomap_dio_zero() for fs bs > system page size") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Series: https://patchwork.kernel.org/project/linux-fsdevel/list/?series=1170161
Submitter: Andrea Parri
Version: 1
Patches: 3/3
Message-ID:
<20260921083133.2960-1-parri.andrea@gmail.com>Base: vfs.base.ci
Lore: https://lore.kernel.org/linux-fsdevel/20260921083133.2960-1-parri.andrea@gmail.com
Automated by ml2pr