Date:   Fri, 7 Jan 2022 20:21:46 -0800
From:   Eric Biggers <ebiggers@kernel.org>
To:     Jaegeuk Kim <jaegeuk@kernel.org>
Cc:     linux-kernel@vger.kernel.org,
        linux-f2fs-devel@lists.sourceforge.net
Subject: Re: [PATCH 3/6] f2fs: do not expose unwritten blocks to user by DIO
Message-ID: <YdkRWgvZEkRM+RSP@sol.localdomain>
References: <20220104212419.1879225-1-jaegeuk@kernel.org>
 <20220104212419.1879225-3-jaegeuk@kernel.org>
 <YdjJAS7Ua4aJEFhz@sol.localdomain>
 <YdjucBBopEDuUb5b@google.com>
 <Ydj1JvEeLo1mrqvb@sol.localdomain>
 <YdkGnA3/3f/Qka5M@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <YdkGnA3/3f/Qka5M@google.com>
Precedence: bulk

On Fri, Jan 07, 2022 at 07:35:56PM -0800, Jaegeuk Kim wrote:
> On 01/07, Eric Biggers wrote:
> > On Fri, Jan 07, 2022 at 05:52:48PM -0800, Jaegeuk Kim wrote:
> > > On 01/07, Eric Biggers wrote:
> > > > Hi Jaegeuk,
> > > > 
> > > > On Tue, Jan 04, 2022 at 01:24:16PM -0800, Jaegeuk Kim wrote:
> > > > > DIO preallocates physical blocks before writing data, but if an error occurrs
> > > > > or power-cut happens, we can see block contents from the disk. This patch tries
> > > > > to fix it by 1) turning to buffered writes for DIO into holes, 2) truncating
> > > > > unwritten blocks from error or power-cut.
> > > > > 
> > > > > Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
> > > > > ---
> > > > >  fs/f2fs/data.c  |  5 ++++-
> > > > >  fs/f2fs/f2fs.h  |  5 +++++
> > > > >  fs/f2fs/file.c  | 27 ++++++++++++++++++---------
> > > > >  fs/f2fs/inode.c |  8 ++++++++
> > > > >  4 files changed, 35 insertions(+), 10 deletions(-)
> > > > 
> > > > Unfortunately, this patch doesn't completely fix the uninitialized data
> > > > exposure.  The problem is that it only makes DIO writes fall back to buffered
> > > > writes for holes, and not for reserved blocks (NEW_ADDR).  f2fs's reserved
> > > > blocks are *not* the same as the unwritten extents that other filesystems have;
> > > > f2fs's reserved blocks have to be turned into regular blocks before DIO can
> > > > write to them.  That immediately exposes them to concurrent reads (at least
> > > > buffered reads, but I think DIO reads too).
> > > 
> > > Isn't it resolved by i_size which gives the written blocks only?
> > > 
> > 
> > I'm not sure what you mean, but this is for non-extending writes, so i_size
> > isn't relevant.
> 
> Ah, do you mean the file has NEW_ADDR within i_size? If so, let me continue
> to investigate further based on the current -dev, as it's quite hard to remove
> the old commits.
> 

Yes, "NEW_ADDR within i_size" is the intended result of fallocate() on f2fs,
right?  The problem is that DIO writes convert the NEW_ADDR blocks to real
blocks, which makes uninitialized data immediately visible to reads before the
write actually happens.

- Eric