From patchwork Mon Jul 25 04:58:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yifei Liu X-Patchwork-Id: 1660167 X-Patchwork-Delegate: richard@nod.at Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=TyRJmeYt; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=cs-stonybrook-edu.20210112.gappssmtp.com header.i=@cs-stonybrook-edu.20210112.gappssmtp.com header.a=rsa-sha256 header.s=20210112 header.b=rYz3Eqlf; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4Lrnsd6mGcz9sB4 for ; Mon, 25 Jul 2022 15:00:03 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=CkbFCVTDdS5zLp7QDdq9iXoW3Ig59RIZrxxJgs+kikM=; b=TyRJmeYtjs7fHF 40r2VhwRk9fEu/eY/ezZA1ZQc4Rp05LYo1apr6/zUsMN9cNWjX5SC1JWf5E//kDqq4yNVHaMlT5ZR sjvLqBkJcloVbh2JgeoBLSD/UiEKeq7/kaBWMrGK1p7LbS2rRQMkmkXDGTu5YD57lHZxtOu536Q/J wJb8J9Z1YUUsvm8UgnMfIPK8NHMkkcKsijFBuTFHwBkPz2FE+IfuWv04hUlCrESPFAEzHcrxDHo5L aa8EeHMZKtPdWHeftPklBuGNEnx18wYuEJTRNP9r0GzW5+GnpPP9pRlUWX77skilDKFRiO/O6YG3/ CVWDaTjWMSGCrPmLF79g==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1oFqBX-0047kg-Gq; Mon, 25 Jul 2022 04:59:15 +0000 Received: from mail-qk1-x729.google.com ([2607:f8b0:4864:20::729]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1oFqBT-0047dP-Mi for linux-mtd@lists.infradead.org; Mon, 25 Jul 2022 04:59:13 +0000 Received: by mail-qk1-x729.google.com with SMTP id m7so7854039qkk.6 for ; Sun, 24 Jul 2022 21:59:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs-stonybrook-edu.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=f6BGyWRa2BjQbDxlapQ6tA/QtZAsEXjWkQiWpBuogLs=; b=rYz3Eqlfn2BBckMR84v/yxdwG1KuAQwjLcz+sUOT0sk+QIQ+NKdaMpol8SO0bCzgWl f9KvDrKpPa6rHtjP+O167hotM7JZE374Um3ZdtAmtiN1e+2QeNG+2dPOqfGx6dmILAhu OkJV+yh8TOU6AUuTlxLHmrJXq5Hwk4eoWMWdJrs59pG0IATNxhwQHWfoVi3fR59HknUX /7gO6r9ApHxj5Op+5+qKrv5jwsPN6nM/A6WAZP9d9DVPEbko7PKHLp1JayxHIrpzK/Uc dkUKoGbmcgLg1IGhL3KKSl0SMiD2US6tJpzOQZR/LU5r8jZFN0EW1GagpTthqcYq1WV1 RivQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=f6BGyWRa2BjQbDxlapQ6tA/QtZAsEXjWkQiWpBuogLs=; b=jpSh8pohHlTvSgUdRybeudPIbjTZe8L5yzzhJpDRTCy7MLp9kOtD1lD0Tqspfr2Fnh XzrfJKnNSXEqT1nct42ZROONmy8uqnIo6COjH8qjxXR9fRoZZWA6H5uUeq7TZXqxsGLe ZUtfOUFqssza+COPgh08WjAuweUG+tA13Q1c7QX6QWVnxOn03cTSQw4MJIVeVSqcgFxk PVMuon23j/5XBy1MkczjIHmFk62DigQzvv6HNE9c0gxgHxx6HohP9PdRwS3g4IYHadxx P2uchpx8+EwJLSfdb5dcuZs22qcTfMmY/X5eVQfPXiv4Qr3HW+UjyWMMGvlFMAZtu78D l9MQ== X-Gm-Message-State: AJIora90m9F/EOBkzF4HUBCYWbIs5mVsQy5DYPrrFtWHywzg23yGdIPz F8pxl3x+ylwBQs+DFNiO5NfzLA== X-Google-Smtp-Source: AGRyM1uS0iPlsbKkDYNQdF1aWJgVudPzoq9XLqI/N2wu+EpnfqK56z6QlpWSLgUjrEr+wssDnqgeZg== X-Received: by 2002:ae9:e313:0:b0:6b5:e41b:64fe with SMTP id v19-20020ae9e313000000b006b5e41b64femr7815515qkf.323.1658725149192; Sun, 24 Jul 2022 21:59:09 -0700 (PDT) Received: from sgdp06.fsl.cs.sunysb.edu (sgdp6.fsl.cs.sunysb.edu. [130.245.126.123]) by smtp.googlemail.com with ESMTPSA id n8-20020ac86748000000b0031f286f868dsm3766746qtp.92.2022.07.24.21.59.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 24 Jul 2022 21:59:08 -0700 (PDT) From: Yifei Liu To: Cc: yifeliu@cs.stonybrook.edu, ezk@cs.stonybrook.edu, madkar@cs.stonybrook.edu, David Woodhouse , Richard Weinberger , "Matthew Wilcox (Oracle)" , Kyeong Yoo , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] jffs2: correct logic when creating a hole in jffs2_write_begin Date: Mon, 25 Jul 2022 04:58:27 +0000 Message-Id: <20220725045830.11502-1-yifeliu@cs.stonybrook.edu> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220724_215912_074768_5D1B7E77 X-CRM114-Status: GOOD ( 18.20 ) X-Spam-Score: 0.0 (/) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Bug description and fix: 1. Write data to a file, say all 1s from offset 0 to 16. 2. Truncate the file to a smaller size, say 8 bytes. Content analysis details: (0.0 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [2607:f8b0:4864:20:0:0:0:729 listed in] [list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-mtd" Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org Bug description and fix: 1. Write data to a file, say all 1s from offset 0 to 16. 2. Truncate the file to a smaller size, say 8 bytes. 3. Write new bytes (say 2s) from an offset past the original size of the file, say at offset 20, for 4 bytes. This is supposed to create a "hole" in the file, meaning that the bytes from offset 8 (where it was truncated above) up to the new write at offset 20, should all be 0s (zeros). 4. flush all caches using "echo 3 > /proc/sys/vm/drop_caches" (or unmount and remount) the f/s. 5. Check the content of the file. It is wrong. The 1s that used to be between bytes 9 and 16, before the truncation, have REAPPEARED (they should be 0s). We wrote a script and helper C program to reproduce the bug (reproduce_jffs2_write_begin_issue.sh, write_file.c, and Makefile). We can make them available to anyone. The above example is shown when writing a small file within the same first page. But the bug happens for larger files, as long as steps 1, 2, and 3 above all happen within the same page. The problem was traced to the jffs2_write_begin code, where it goes into an 'if' statement intended to handle writes past the current EOF (i.e., writes that may create a hole). The code computes a 'pageofs' that is the floor of the write position (pos), aligned to the page size boundary. In other words, 'pageofs' will never be larger than 'pos'. The code then sets the internal jffs2_raw_inode->isize to the size of max(current inode size, pageofs) but that is wrong: the new file size should be the 'pos', which is larger than both the current inode size and pageofs. Similarly, the code incorrectly sets the internal jffs2_raw_inode->dsize to the difference between the pageofs minus current inode size; instead it should be the current pos minus the current inode size. Finally, inode->i_size was also set incorrectly. The patch below fixes this bug. The bug was discovered using a new tool for finding f/s bugs using model checking, called MCFS (Model Checking File Systems). Signed-off-by: Yifei Liu Signed-off-by: Erez Zadok Signed-off-by: Manish Adkar --- fs/jffs2/file.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c index ba86acbe12d3..0479096b96e4 100644 --- a/fs/jffs2/file.c +++ b/fs/jffs2/file.c @@ -137,19 +137,18 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode); struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb); pgoff_t index = pos >> PAGE_SHIFT; - uint32_t pageofs = index << PAGE_SHIFT; int ret = 0; jffs2_dbg(1, "%s()\n", __func__); - if (pageofs > inode->i_size) { - /* Make new hole frag from old EOF to new page */ + if (pos > inode->i_size) { + /* Make new hole frag from old EOF to new position */ struct jffs2_raw_inode ri; struct jffs2_full_dnode *fn; uint32_t alloc_len; - jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new page\n", - (unsigned int)inode->i_size, pageofs); + jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new position\n", + (unsigned int)inode->i_size, (uint32_t)pos); ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len, ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE); @@ -169,10 +168,10 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, ri.mode = cpu_to_jemode(inode->i_mode); ri.uid = cpu_to_je16(i_uid_read(inode)); ri.gid = cpu_to_je16(i_gid_read(inode)); - ri.isize = cpu_to_je32(max((uint32_t)inode->i_size, pageofs)); + ri.isize = cpu_to_je32((uint32_t)pos); ri.atime = ri.ctime = ri.mtime = cpu_to_je32(JFFS2_NOW()); ri.offset = cpu_to_je32(inode->i_size); - ri.dsize = cpu_to_je32(pageofs - inode->i_size); + ri.dsize = cpu_to_je32((uint32_t)pos - inode->i_size); ri.csize = cpu_to_je32(0); ri.compr = JFFS2_COMPR_ZERO; ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8)); @@ -202,7 +201,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, goto out_err; } jffs2_complete_reservation(c); - inode->i_size = pageofs; + inode->i_size = pos; mutex_unlock(&f->sem); }