Re: [PATCH v2 3/7] exfat: validate cached iomaps during buffered writes

[Namjae Jeon]

> +static bool exfat_iomap_valid(struct inode *inode, const struct iomap *iomap)
> +{
> +       struct folio *folio = iomap->private;
> +       loff_t old_valid_size = iomap->validity_cookie;
> +       loff_t valid_size = exfat_get_valid_size(EXFAT_I(inode));
> +
> +       if (valid_size == old_valid_size)
exfat_write_iomap_begin() reads valid_size before
__exfat_iomap_begin() records the validity cookie. concurrent mmap
fault can advance valid_size between those reads, allowing the stale
value to zero mmap data before iomap_valid() is called:

buffered write [0,128)                       mmap fault
Reads valid_size = 256
                                              Raises valid_size to 4096
                                              Stores 'X' at offset 400
Records cookie = 4096
Zeroes [256,512), erasing 'X'
iomap_valid() sees cookie = 4096 and accepts

The validation runs too late to prevent this data loss. Could we
recheck or serialize valid_size before zeroing?


> +               return true;
> +
> +       if (!folio)
> +               return false;
> +
> +       /* Still valid for this folio. */
> +       if (old_valid_size >= folio_next_pos(folio))
> +               return true;
> +
> +       if (valid_size <= folio_pos(folio))
> +               return true;
> +
> +       return false;
> +}
> +