ext4: partial zero eof block on unaligned inode size extension

JIRA: https://issues.redhat.com/browse/RHEL-109217
Conflicts: Minor context difference in setting inode timestamps.

commit c7fc036
Author: Brian Foster <bfoster@redhat.com>
Date:   Thu Sep 19 12:07:40 2024 -0400

    ext4: partial zero eof block on unaligned inode size extension

    Using mapped writes, it's technically possible to expose stale
    post-eof data on a truncate up operation. Consider the following
    example:

    $ xfs_io -fc "pwrite 0 2k" -c "mmap 0 4k" -c "mwrite 2k 2k" \
            -c "truncate 8k" -c "pread -v 2k 16" <file>
    ...
    00000800:  58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58  XXXXXXXXXXXXXXXX
    ...

    This shows that the post-eof data written via mwrite lands within
    EOF after a truncate up. While this is deliberate of the test case,
    behavior is somewhat unpredictable because writeback does post-eof
    zeroing, and writeback can occur at any time in the background. For
    example, an fsync inserted between the mwrite and truncate causes
    the subsequent read to instead return zeroes. This basically means
    that there is a race window in this situation between any subsequent
    extending operation and writeback that dictates whether post-eof
    data is exposed to the file or zeroed.

    To prevent this problem, perform partial block zeroing as part of
    the various inode size extending operations that are susceptible to
    it. For truncate extension, zero around the original eof similar to
    how truncate down does partial zeroing of the new eof. For extension
    via writes and fallocate related operations, zero the newly exposed
    range of the file to cover any partial zeroing that must occur at
    the original and new eof blocks.

    Signed-off-by: Brian Foster <bfoster@redhat.com>
    Link: https://patch.msgid.link/20240919160741.208162-2-bfoster@redhat.com
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>

Signed-off-by: Brian Foster <bfoster@redhat.com>

Author: Brian Foster

fs/ext4/extents.c

@@ -4483,7 +4483,7 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
 	int depth = 0;
 	struct ext4_map_blocks map;
 	unsigned int credits;
-	loff_t epos;
+	loff_t epos, old_size = i_size_read(inode);
 
 	BUG_ON(!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS));
 	map.m_lblk = offset;
@@ -4541,6 +4541,11 @@ static int ext4_alloc_file_blocks(struct file *file, ext4_lblk_t offset,
 				epos = new_size;
 			if (ext4_update_inode_size(inode, epos) & 0x1)
 				inode->i_mtime = inode->i_ctime;
+			if (epos > old_size) {
+				pagecache_isize_extended(inode, old_size, epos);
+				ext4_zero_partial_blocks(handle, inode,
+						     old_size, epos - old_size);
+			}
 		}
 		ret2 = ext4_mark_inode_dirty(handle, inode);
 		ext4_update_inode_fsync_trans(handle, inode, 1);

fs/ext4/inode.c

@@ -1359,8 +1359,10 @@ static int ext4_write_end(struct file *file,
 	unlock_page(page);
 	put_page(page);
 
-	if (old_size < pos && !verity)
+	if (old_size < pos && !verity) {
 		pagecache_isize_extended(inode, old_size, pos);
+		ext4_zero_partial_blocks(handle, inode, old_size, pos - old_size);
+	}
 	/*
 	 * Don't mark the inode dirty under page lock. First, it unnecessarily
 	 * makes the holding time of page lock longer. Second, it forces lock
@@ -1473,8 +1475,10 @@ static int ext4_journalled_write_end(struct file *file,
 	unlock_page(page);
 	put_page(page);
 
-	if (old_size < pos && !verity)
+	if (old_size < pos && !verity) {
 		pagecache_isize_extended(inode, old_size, pos);
+		ext4_zero_partial_blocks(handle, inode, old_size, pos - old_size);
+	}
 
 	if (size_changed) {
 		ret2 = ext4_mark_inode_dirty(handle, inode);
@@ -3154,7 +3158,8 @@ static int ext4_da_do_write_end(struct address_space *mapping,
 	struct inode *inode = mapping->host;
 	loff_t old_size = inode->i_size;
 	bool disksize_changed = false;
-	loff_t new_i_size;
+	loff_t new_i_size, zero_len = 0;
+	handle_t *handle;
 
 	/*
 	 * block_write_end() will mark the inode as dirty with I_DIRTY_PAGES
@@ -3192,18 +3197,21 @@ static int ext4_da_do_write_end(struct address_space *mapping,
 	unlock_page(page);
 	put_page(page);
 
-	if (old_size < pos)
+	if (pos > old_size) {
 		pagecache_isize_extended(inode, old_size, pos);
+		zero_len = pos - old_size;
+	}
 
-	if (disksize_changed) {
-		handle_t *handle;
+	if (!disksize_changed && !zero_len)
+		return copied;
 
-		handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
-		if (IS_ERR(handle))
-			return PTR_ERR(handle);
-		ext4_mark_inode_dirty(handle, inode);
-		ext4_journal_stop(handle);
-	}
+	handle = ext4_journal_start(inode, EXT4_HT_INODE, 2);
+	if (IS_ERR(handle))
+		return PTR_ERR(handle);
+	if (zero_len)
+		ext4_zero_partial_blocks(handle, inode, old_size, zero_len);
+	ext4_mark_inode_dirty(handle, inode);
+	ext4_journal_stop(handle);
 
 	return copied;
 }
@@ -5642,6 +5650,14 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
 		}
 
 		if (attr->ia_size != inode->i_size) {
+			/* attach jbd2 jinode for EOF folio tail zeroing */
+			if (attr->ia_size & (inode->i_sb->s_blocksize - 1) ||
+			    oldsize & (inode->i_sb->s_blocksize - 1)) {
+				error = ext4_inode_attach_jinode(inode);
+				if (error)
+					goto err_out;
+			}
+
 			handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);
 			if (IS_ERR(handle)) {
 				error = PTR_ERR(handle);
@@ -5652,12 +5668,16 @@ int ext4_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
 				orphan = 1;
 			}
 			/*
-			 * Update c/mtime on truncate up, ext4_truncate() will
-			 * update c/mtime in shrink case below
+			 * Update c/mtime and tail zero the EOF folio on
+			 * truncate up. ext4_truncate() handles the shrink case
+			 * below.
 			 */
 			if (!shrink) {
 				inode->i_mtime = current_time(inode);
 				inode->i_ctime = inode->i_mtime;
+				if (oldsize & (inode->i_sb->s_blocksize - 1))
+					ext4_block_truncate_page(handle,
+							inode->i_mapping, oldsize);
 			}
 
 			if (shrink)