xfs: fs/xfs/xfs_fs_subr.c die die die

From: Dave Chinner <[email protected]>

It's a buggy, unnecessary wrapper that is duplicating truncate_pagecache_range().

When replacing the call in xfs_change_file_space(), also ensure that the length being allocated/freed is always positive before making any changes. These checks are done in the lower extent manipulation functions, too, but we need to do them before any page cache operations.

Reported-by Andrew Dahl <[email protected]>

Signed-off-by Dave Chinner <[email protected]>

---
 fs/xfs/xfs_dfrag.c    |    3 +--
 fs/xfs/xfs_fs_subr.c  |   12 ------------
 fs/xfs/xfs_vnodeops.c |   28 +++++++++++++++++++++++-----
 fs/xfs/xfs_vnodeops.h |    2 --
 4 files changed, 24 insertions(+), 21 deletions(-)

fs/xfs/xfs_dfrag.c +1 -2

index b9b8646..b2c63a2 100644
@@ -315,8 +315,7 @@ xfs_swap_extents(
 	 * are safe.  We don't really care if non-io related
 	 * fields change.
 	 */
-
-	xfs_tosspages(ip, 0, -1, FI_REMAPF);
+	truncate_pagecache_range(VFS_I(ip), 0, -1);
 
 	tp = xfs_trans_alloc(mp, XFS_TRANS_SWAPEXT);
 	if ((error = xfs_trans_reserve(tp, 0,

fs/xfs/xfs_fs_subr.c +0 -12

index 652b875..d49de3d 100644
@@ -25,18 +25,6 @@
  * note: all filemap functions return negative error codes. These
  * need to be inverted before returning to the xfs core functions.
  */
-void
-xfs_tosspages(
-	xfs_inode_t	*ip,
-	xfs_off_t	first,
-	xfs_off_t	last,
-	int		fiopt)
-{
-	/* can't toss partial tail pages, so mask them out */
-	last &= ~(PAGE_SIZE - 1);
-	truncate_inode_pages_range(VFS_I(ip)->i_mapping, first, last - 1);
-}
-
 int
 xfs_flushinval_pages(
 	xfs_inode_t	*ip,

fs/xfs/xfs_vnodeops.c +21 -4

index c2ddd7a..f7de578 100644
@@ -2118,7 +2118,6 @@ xfs_change_file_space(
 	xfs_fsize_t	fsize;
 	int		setprealloc;
 	xfs_off_t	startoffset;
-	xfs_off_t	llen;
 	xfs_trans_t	*tp;
 	struct iattr	iattr;
 	int		prealloc_type;

@@ -2139,12 +2138,30 @@ xfs_change_file_space(
 		return XFS_ERROR(EINVAL);
 	}
 
-	llen = bf->l_len > 0 ? bf->l_len - 1 : bf->l_len;
+	/*
+	 * length of <= 0 for resv/unresv/zero is invalid.  length for
+	 * alloc/free is ignored completely and we have no idea what userspace
+	 * might have set it to, so set it to zero to allow range
+	 * checks to pass.
+	 */
+	switch (cmd) {
+	case XFS_IOC_ZERO_RANGE:
+	case XFS_IOC_RESVSP:
+	case XFS_IOC_RESVSP64:
+	case XFS_IOC_UNRESVSP:
+	case XFS_IOC_UNRESVSP64:
+		if (bf->l_len <= 0)
+			return XFS_ERROR(EINVAL);
+		break;
+	default:
+		bf->l_len = 0;
+		break;
+	}
 
 	if (bf->l_start < 0 ||
 	    bf->l_start > mp->m_super->s_maxbytes ||
-	    bf->l_start + llen < 0 ||
-	    bf->l_start + llen > mp->m_super->s_maxbytes)
+	    bf->l_start + bf->l_len < 0 ||
+	    bf->l_start + bf->l_len >= mp->m_super->s_maxbytes)
 		return XFS_ERROR(EINVAL);
 
 	bf->l_whence = 0;

fs/xfs/xfs_vnodeops.c +0 -0

 		/* FALLTHRU */
 	case XFS_IOC_RESVSP:
 	case XFS_IOC_RESVSP64:

fs/xfs/xfs_vnodeops.h +0 -0

index 52fafc4..d48141d 100644

Quoted 13 lines · Dave Chinner

From: Dave Chinner <[email protected]>

It's a buggy, unnecessary wrapper that is duplicating truncate_pagecache_range().

When replacing the call in xfs_change_file_space(), also ensure that the length being allocated/freed is always positive before making any changes. These checks are done in the lower extent manipulation functions, too, but we need to do them before any page cache operations.

Reported-by Andrew Dahl <[email protected]>

Signed-off-by Dave Chinner <[email protected]>

Quoted 5 lines

fs/xfs/xfs_vnodeops.c +0 -1

@@ -2169,7 +2186,8 @@ xfs_change_file_space(
 	switch (cmd) {
 	case XFS_IOC_ZERO_RANGE:
 		prealloc_type |= XFS_BMAPI_CONVERT;
-		xfs_tosspages(ip, startoffset, startoffset + bf->l_len, 0);

fs/xfs/xfs_vnodeops.c xfs_change_file_space( · line 2190

Quoted 2 lines

fs/xfs/xfs_vnodeops.c +2 -0

+		truncate_pagecache_range(VFS_I(ip), startoffset,
+			 round_down(startoffset + bf->l_len, PAGE_SIZE) - 1);

When calling XFS_IOC_ZERO_RANGE with a range [0, 4095] or [0,1] it's tossing pages because the call to round_down() is returning 0 and passing -1 in for the end will toss all pages. So, we need to make sure round_down() isn't going to return a 0, or that (startoffset + bf->l_len) > PAGE_SIZE.

So, something like...

xfs_off_t end;

[...]

if((end = round_down(startoffset + bf->l_len, PAGE_SIZE)) > 0) {
	truncate_pagecache_range(VFS_I(ip), startoffset, end - 1);
}

Quoted 14 lines · Andrew Dahl

Quoted 13 lines · Dave Chinner

From: Dave Chinner <[email protected]>

It's a buggy, unnecessary wrapper that is duplicating truncate_pagecache_range().

When replacing the call in xfs_change_file_space(), also ensure that the length being allocated/freed is always positive before making any changes. These checks are done in the lower extent manipulation functions, too, but we need to do them before any page cache operations.

Reported-by Andrew Dahl <[email protected]>

Signed-off-by Dave Chinner <[email protected]>

....

Quoted 5 lines

Quoted 5 lines

fs/xfs/xfs_vnodeops.c +0 -1

@@ -2169,7 +2186,8 @@ xfs_change_file_space(
 	switch (cmd) {
 	case XFS_IOC_ZERO_RANGE:
 		prealloc_type |= XFS_BMAPI_CONVERT;
-		xfs_tosspages(ip, startoffset, startoffset + bf->l_len, 0);

Quoted 8 lines

fs/xfs/xfs_vnodeops.c xfs_change_file_space( · line 2190

Quoted 2 lines

fs/xfs/xfs_vnodeops.c +2 -0

+		truncate_pagecache_range(VFS_I(ip), startoffset,
+			 round_down(startoffset + bf->l_len, PAGE_SIZE) - 1);

When calling XFS_IOC_ZERO_RANGE with a range [0, 4095] or [0,1] it's tossing pages because the call to round_down() is returning 0 and passing -1 in for the end will toss all pages. So, we need to make sure round_down() isn't going to return a 0, or that (startoffset + bf->l_len) > PAGE_SIZE.

Right, which was the original bug. I didn't think that through fully....

Quoted 10 lines

So, something like...

xfs_off_t end;

[...]

if((end = round_down(startoffset + bf->l_len, PAGE_SIZE)) > 0) {
	truncate_pagecache_range(VFS_I(ip), startoffset, end - 1);
}

Actually, it is more complex than that. Think of the range [4096, 4097]. That would result in passing 4096, 4095 to truncate_pagecache_range(), which is also wrong but implicitly handled correctly in truncate_inode_pages_range(). Hence it should be:

		end = round_down(startoffset + bf->l_len, PAGE_SIZE) - 1;
		if (startoffset > end)
			truncate_pagecache_range(VFS_I(ip), startoffset, end);

That's similar to your original fix, which had a last < first check in it. I'll post a fix in a few minutes...

From: Dave Chinner <[email protected]>

It's just a simple wrapper around a VFS function that is only called by another function in xfs_fs_subr.c. Remove it and call the VFS function directly.

Signed-off-by Dave Chinner <[email protected]>

---
 fs/xfs/xfs_fs_subr.c  |   18 ++----------------
 fs/xfs/xfs_vnodeops.h |    1 -
 2 files changed, 2 insertions(+), 17 deletions(-)

fs/xfs/xfs_fs_subr.c +2 -16

index d49de3d..3365823 100644
@@ -62,23 +62,9 @@ xfs_flush_pages(
 				last == -1 ? LLONG_MAX : last);
 	if (flags & XBF_ASYNC)
 		return ret;
-	ret2 = xfs_wait_on_pages(ip, first, last);
+	ret2 = -filemap_fdatawait_range(mapping, first,
+				last == -1 ? XFS_ISIZE(ip) - 1 : last);
 	if (!ret)
 		ret = ret2;
 	return ret;
 }
-
-int
-xfs_wait_on_pages(
-	xfs_inode_t	*ip,
-	xfs_off_t	first,
-	xfs_off_t	last)
-{
-	struct address_space *mapping = VFS_I(ip)->i_mapping;
-
-	if (mapping_tagged(mapping, PAGECACHE_TAG_WRITEBACK)) {
-		return -filemap_fdatawait_range(mapping, first,
-					last == -1 ? XFS_ISIZE(ip) - 1 : last);
-	}
-	return 0;
-}

fs/xfs/xfs_vnodeops.h +0 -0

index d48141d..c8ad48b 100644

From: Dave Chinner <[email protected]>

It is a complex wrapper around VFS functions, but there are VFS functions that provide exactly the same functionality. Call the VFS functions directly and remove the unnecessary indirection and complexity.

We don't need to care about clearing the XFS_ITRUNCATED flag, as that is done during .writepages. Hence is cleared by the VFS writeback path if there is anything to write back during the flush.

Signed-off-by Dave Chinner <[email protected]>

---
 fs/xfs/xfs_aops.c     |    2 +-
 fs/xfs/xfs_bmap.c     |    2 +-
 fs/xfs/xfs_fs_subr.c  |   24 ------------------------
 fs/xfs/xfs_iops.c     |    4 ++--
 fs/xfs/xfs_vnodeops.c |    7 +++++--
 fs/xfs/xfs_vnodeops.h |    2 --
 6 files changed, 9 insertions(+), 32 deletions(-)

fs/xfs/xfs_aops.c +1 -1

index e562dd4..42ef842 100644
@@ -1617,7 +1617,7 @@ xfs_vm_bmap(
 
 	trace_xfs_vm_bmap(XFS_I(inode));
 	xfs_ilock(ip, XFS_IOLOCK_SHARED);
-	xfs_flush_pages(ip, (xfs_off_t)0, -1, 0, FI_REMAPF);
+	filemap_write_and_wait(mapping);
 	xfs_iunlock(ip, XFS_IOLOCK_SHARED);
 	return generic_block_bmap(mapping, block, xfs_get_blocks);
 }

fs/xfs/xfs_bmap.c +1 -1

index 83d0cf3..a60f3d1 100644
@@ -5599,7 +5599,7 @@ xfs_getbmap(
 	xfs_ilock(ip, XFS_IOLOCK_SHARED);
 	if (whichfork == XFS_DATA_FORK && !(iflags & BMV_IF_DELALLOC)) {
 		if (ip->i_delayed_blks || XFS_ISIZE(ip) > ip->i_d.di_size) {
-			error = xfs_flush_pages(ip, 0, -1, 0, FI_REMAPF);
+			error = -filemap_write_and_wait(VFS_I(ip)->i_mapping);
 			if (error)
 				goto out_unlock_iolock;
 		}

fs/xfs/xfs_fs_subr.c +0 -24

index 3365823..b538089 100644
@@ -44,27 +44,3 @@ xfs_flushinval_pages(
 		truncate_inode_pages_range(mapping, first, last);
 	return -ret;
 }
-
-int
-xfs_flush_pages(
-	xfs_inode_t	*ip,
-	xfs_off_t	first,
-	xfs_off_t	last,
-	uint64_t	flags,
-	int		fiopt)
-{
-	struct address_space *mapping = VFS_I(ip)->i_mapping;
-	int		ret = 0;
-	int		ret2;
-
-	xfs_iflags_clear(ip, XFS_ITRUNCATED);
-	ret = -filemap_fdatawrite_range(mapping, first,
-				last == -1 ? LLONG_MAX : last);
-	if (flags & XBF_ASYNC)
-		return ret;
-	ret2 = -filemap_fdatawait_range(mapping, first,
-				last == -1 ? XFS_ISIZE(ip) - 1 : last);
-	if (!ret)
-		ret = ret2;
-	return ret;
-}

fs/xfs/xfs_iops.c +2 -2

index 81f5c49..d82efaa 100644
@@ -780,8 +780,8 @@ xfs_setattr_size(
 	 * care about here.
 	 */
 	if (oldsize != ip->i_d.di_size && newsize > ip->i_d.di_size) {
-		error = xfs_flush_pages(ip, ip->i_d.di_size, newsize, 0,
-					FI_NONE);
+		error = -filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
+						      ip->i_d.di_size, newsize);
 		if (error)
 			goto out_unlock;
 	}

fs/xfs/xfs_vnodeops.c +5 -2

index f7de578..31de73e 100644
@@ -428,8 +428,11 @@ xfs_release(
 		truncated = xfs_iflags_test_and_clear(ip, XFS_ITRUNCATED);
 		if (truncated) {
 			xfs_iflags_clear(ip, XFS_IDIRTY_RELEASE);
-			if (VN_DIRTY(VFS_I(ip)) && ip->i_delayed_blks > 0)
-				xfs_flush_pages(ip, 0, -1, XBF_ASYNC, FI_NONE);
+			if (VN_DIRTY(VFS_I(ip)) && ip->i_delayed_blks > 0) {
+				error = -filemap_flush(VFS_I(ip)->i_mapping);
+				if (error)
+					return error;
+			}
 		}
 	}
 

fs/xfs/xfs_vnodeops.h +0 -0

index c8ad48b..73cb3cb 100644

From: Dave Chinner <[email protected]>

It's just a simple wrapper around VFS functionality, and is actually bugging in that it doesn't remove mappings before invalidating the page cache. Remove it and replace it with the correct VFS functionality.

Signed-off-by Dave Chinner <[email protected]>

---

This patch series replaces all the functions in fs/xfs/xfs_fs_subr.c with direct calls to their VFS equivalents. This fixes bugs and removes code at the same time.

I haven't bothered to change the ranges passed to the functions - that requires a lot more scrutiny and testing - the ranges have now may not be optimal but they are a known factor. The changes have passed smoke testing on several different configurations and about 6 hours of continuous fsx testing, which is what I'd expect seeing as I have changed the ranges at all.