[PATCH v3 6/8] exfat: drop i_rwsem from exfat_page_mkwrite

[Chi Zhiling]

From: Chi Zhiling <chizhiling@xxxxxxxxxx>

exfat_page_mkwrite() takes i_rwsem with inode_trylock() and returns
VM_FAULT_RETRY when that fails.  The MM subsystem does not propagate
VM_FAULT_RETRY from ->page_mkwrite(), so the fault still completes and
the page becomes writable without exfat_page_mkwrite() ever advancing
valid_size.

Blocking on i_rwsem is not an option either: ->page_mkwrite() runs under
mmap_lock, so waiting for i_rwsem would create an mmap_lock -> i_rwsem
ordering that can deadlock.

Now that valid_size is advanced under the folio lock, i_rwsem is no
longer needed here.  Take mapping->invalidate_lock shared instead, which
serializes the fault against truncate.

Without i_rwsem, i_size can shrink between the read fault and
->page_mkwrite(), so re-check that the faulting page still starts within
i_size before preparing the range below it; a truncate that slipped in
between would otherwise let the helper populate and dirty folios beyond
EOF and advance valid_size past i_size.

Fixes: 6630ea49103c ("exfat: move extend valid_size into ->page_mkwrite()")
Signed-off-by: Chi Zhiling <chizhiling@xxxxxxxxxx>
---
 fs/exfat/file.c | 32 +++++++++++++++-----------------
 1 file changed, 15 insertions(+), 17 deletions(-)

diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index 6d4f50795332..23b8a36acaf7 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -989,26 +989,25 @@ static vm_fault_t exfat_page_mkwrite(struct vm_fault *vmf)
 	loff_t new_valid_size, mmap_valid_size, fault_page_start;
 	int err;
 
-	if (!inode_trylock(inode))
-		return VM_FAULT_RETRY;
+	sb_start_pagefault(inode->i_sb);
+	file_update_time(vmf->vma->vm_file);
+	filemap_invalidate_lock_shared(inode->i_mapping);
 
 	fault_page_start = ((loff_t)vmf->pgoff) << PAGE_SHIFT;
 
-	/*
-	 * Zero only the gap below the faulting page. The read
-	 * fault populated its folio and iomap_page_mkwrite()
-	 * will dirty it.
-	 */
-	err = exfat_prepare_valid_range(inode, fault_page_start);
-	if (err < 0) {
-		inode_unlock(inode);
-		return vmf_fs_error(err);
+	if (i_size_read(inode) > fault_page_start) {
+		/*
+		 * Zero only the gap below the faulting page. The read
+		 * fault populated its folio and iomap_page_mkwrite()
+		 * will dirty it.
+		 */
+		err = exfat_prepare_valid_range(inode, fault_page_start);
+		if (err < 0) {
+			ret = vmf_fs_error(err);
+			goto out;
+		}
 	}
 
-	sb_start_pagefault(inode->i_sb);
-	file_update_time(vmf->vma->vm_file);
-
-	filemap_invalidate_lock_shared(inode->i_mapping);
 	ret = iomap_page_mkwrite(vmf, &exfat_iomap_ops, NULL);
 
 	if (ret == VM_FAULT_LOCKED) {
@@ -1021,10 +1020,9 @@ static vm_fault_t exfat_page_mkwrite(struct vm_fault *vmf)
 		exfat_advance_zeroed_size(ei,
 				round_up(new_valid_size, i_blocksize(inode)));
 	}
-
+out:
 	filemap_invalidate_unlock_shared(inode->i_mapping);
 	sb_end_pagefault(inode->i_sb);
-	inode_unlock(inode);
 
 	return ret;
 }
-- 
2.53.0