[PATCH] hpfs: don't truncate the file when delete fails

[PATCH] hpfs: don't truncate the file when delete fails

[Mikulas Patocka]

The delete opration can allocate additional space on the HPFS filesystem
due to btree split. The HPFS driver checks in advance if there is
available space, so that it won't corrupt the btree if we run out of space
during splitting.

If there is not enough available space, the HPFS driver attempted to
truncate the file, but this results in a deadlock since the commit
7dd29d8d865efdb00c0542a5d2c87af8c52ea6c7 ("HPFS: Introduce a global mutex
and lock it on every callback from VFS").

This patch removes the code that tries to truncate the file and -ENOSPC is
returned instead. If the user hits -ENOSPC on delete, he should try to
delete other files (that are stored in a leaf btree node), so that the
delete operation will make some space for deleting the file stored in
non-leaf btree node.

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
Cc: stable@vger.kernel.org	# 2.6.39+

Index: linux-4.4.2/fs/hpfs/namei.c
===================================================================
--- linux-4.4.2.orig/fs/hpfs/namei.c
+++ linux-4.4.2/fs/hpfs/namei.c
@@ -375,12 +375,11 @@ static int hpfs_unlink(struct inode *dir
 	struct inode *inode = d_inode(dentry);
 	dnode_secno dno;
 	int r;
-	int rep = 0;
 	int err;
 
 	hpfs_lock(dir->i_sb);
 	hpfs_adjust_length(name, &len);
-again:
+
 	err = -ENOENT;
 	de = map_dirent(dir, hpfs_i(dir)->i_dno, name, len, &dno, &qbh);
 	if (!de)
@@ -400,33 +399,9 @@ again:
 		hpfs_error(dir->i_sb, "there was error when removing dirent");
 		err = -EFSERROR;
 		break;
-	case 2:		/* no space for deleting, try to truncate file */
-
+	case 2:		/* no space for deleting */
 		err = -ENOSPC;
-		if (rep++)
-			break;
-
-		dentry_unhash(dentry);
-		if (!d_unhashed(dentry)) {
-			hpfs_unlock(dir->i_sb);
-			return -ENOSPC;
-		}
-		if (generic_permission(inode, MAY_WRITE) ||
-		    !S_ISREG(inode->i_mode) ||
-		    get_write_access(inode)) {
-			d_rehash(dentry);
-		} else {
-			struct iattr newattrs;
-			/*pr_info("truncating file before delete.\n");*/
-			newattrs.ia_size = 0;
-			newattrs.ia_valid = ATTR_SIZE | ATTR_CTIME;
-			err = notify_change(dentry, &newattrs, NULL);
-			put_write_access(inode);
-			if (!err)
-				goto again;
-		}
-		hpfs_unlock(dir->i_sb);
-		return -ENOSPC;
+		break;
 	default:
 		drop_nlink(inode);
 		err = 0;

Re: [PATCH] hpfs: don't truncate the file when delete fails

[Al Viro]

On Thu, Feb 25, 2016 at 06:17:38PM +0100, Mikulas Patocka wrote:
> The delete opration can allocate additional space on the HPFS filesystem
> due to btree split. The HPFS driver checks in advance if there is
> available space, so that it won't corrupt the btree if we run out of space
> during splitting.
> 
> If there is not enough available space, the HPFS driver attempted to
> truncate the file, but this results in a deadlock since the commit
> 7dd29d8d865efdb00c0542a5d2c87af8c52ea6c7 ("HPFS: Introduce a global mutex
> and lock it on every callback from VFS").
> 
> This patch removes the code that tries to truncate the file and -ENOSPC is
> returned instead. If the user hits -ENOSPC on delete, he should try to
> delete other files (that are stored in a leaf btree node), so that the
> delete operation will make some space for deleting the file stored in
> non-leaf btree node.
> 
> Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
> Signed-off-by: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
> Cc: stable@vger.kernel.org	# 2.6.39+

Picked, but I don't understand that Cc: stable...

Re: [PATCH] hpfs: don't truncate the file when delete fails

[Mikulas Patocka]

On Thu, 25 Feb 2016, Al Viro wrote:

> On Thu, Feb 25, 2016 at 06:17:38PM +0100, Mikulas Patocka wrote:
> > The delete opration can allocate additional space on the HPFS filesystem
> > due to btree split. The HPFS driver checks in advance if there is
> > available space, so that it won't corrupt the btree if we run out of space
> > during splitting.
> > 
> > If there is not enough available space, the HPFS driver attempted to
> > truncate the file, but this results in a deadlock since the commit
> > 7dd29d8d865efdb00c0542a5d2c87af8c52ea6c7 ("HPFS: Introduce a global mutex
> > and lock it on every callback from VFS").
> > 
> > This patch removes the code that tries to truncate the file and -ENOSPC is
> > returned instead. If the user hits -ENOSPC on delete, he should try to
> > delete other files (that are stored in a leaf btree node), so that the
> > delete operation will make some space for deleting the file stored in
> > non-leaf btree node.
> > 
> > Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
> > Signed-off-by: Mikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>
> > Cc: stable@vger.kernel.org	# 2.6.39+
> 
> Picked, but I don't understand that Cc: stable...

This bug is in all kernels since 2.6.39, so I marked it that way so that 
it will be picked by stable kernel maintainers.

Mikulas