ext4: close race between direct IO and ext4_break_layouts()
authorRoss Zwisler <zwisler@kernel.org>
Tue, 11 Sep 2018 17:31:16 +0000 (13:31 -0400)
committerTheodore Ts'o <tytso@mit.edu>
Tue, 11 Sep 2018 17:31:16 +0000 (13:31 -0400)
commitb1f382178d150f256c1cf95b9341fda6eb764459
treea0d4c289912c4150b948abd2729980d85d3e9ade
parent5f8c10936fab2b69a487400f2872902e597dd320
ext4: close race between direct IO and ext4_break_layouts()

If the refcount of a page is lowered between the time that it is returned
by dax_busy_page() and when the refcount is again checked in
ext4_break_layouts() => ___wait_var_event(), the waiting function
ext4_wait_dax_page() will never be called.  This means that
ext4_break_layouts() will still have 'retry' set to false, so we'll stop
looping and never check the refcount of other pages in this inode.

Instead, always continue looping as long as dax_layout_busy_page() gives us
a page which it found with an elevated refcount.

Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
fs/ext4/inode.c