[PATCH v2] f2fs: disallow mmap write and data-modifying fallocate on atomic files

[PATCH v2] f2fs: disallow mmap write and data-modifying fallocate on atomic files

[Daeho Jeong]

From: Daeho Jeong <daehojeong@google.com>

Stores through a shared writable mapping and fallocate with
FALLOC_FL_PUNCH_HOLE, FALLOC_FL_ZERO_RANGE, FALLOC_FL_COLLAPSE_RANGE or
FALLOC_FL_INSERT_RANGE do not go through ->write_begin, so they bypass
the COW inode and modify the original inode directly. Reject them while
the file is in atomic write mode, as fallocate already does for pinned
and compressed files. A write fault gets SIGBUS and fallocate gets
-EOPNOTSUPP.

fallocate without these flags only preallocates blocks and stays
allowed.

f2fs_vm_page_mkwrite() cannot take inode_lock, so check the flag under
invalidate_lock, and hold invalidate_lock in
f2fs_ioc_start_atomic_write() from the flush until the flag is set.
Otherwise a fault could check the flag, then start_atomic_write could
flush and set the flag, and the fault would dirty the folio afterwards.

Cc: stable@kernel.org
Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
---
v2: serialize atomic flag check in f2fs_vm_page_mkwrite().
---
 fs/f2fs/file.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index ef4d218e694..7020b3e8940 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -187,6 +187,17 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
 	file_update_time(vmf->vma->vm_file);
 	filemap_invalidate_lock_shared(inode->i_mapping);
 
+	/*
+	 * mmap stores bypass the COW inode and would break atomicity. Check
+	 * under invalidate_lock: f2fs_ioc_start_atomic_write() holds it while
+	 * flushing dirty folios and setting FI_ATOMIC_FILE, so either it sees
+	 * our dirty folio and writes it back, or we see the flag.
+	 */
+	if (unlikely(f2fs_is_atomic_file(inode))) {
+		err = -EOPNOTSUPP;
+		goto out_sem;
+	}
+
 	folio_lock(folio);
 	if (unlikely(folio->mapping != inode->i_mapping ||
 			folio_pos(folio) > i_size_read(inode) ||
@@ -2113,9 +2124,11 @@ static long f2fs_fallocate(struct file *file, int mode,
 
 	/*
 	 * Pinned file should not support partial truncation since the block
-	 * can be used by applications.
+	 * can be used by applications. Atomic files should not either, since
+	 * these modify the original inode directly and break atomicity.
 	 */
-	if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode)) &&
+	if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode) ||
+	     f2fs_is_atomic_file(inode)) &&
 		(mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_COLLAPSE_RANGE |
 			FALLOC_FL_ZERO_RANGE | FALLOC_FL_INSERT_RANGE))) {
 		ret = -EOPNOTSUPP;
@@ -2403,6 +2416,8 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
 
 	f2fs_down_write(&fi->i_gc_rwsem[WRITE]);
 	f2fs_down_write(&fi->i_gc_rwsem[READ]);
+	/* serialize with f2fs_vm_page_mkwrite(), see the comment there */
+	filemap_invalidate_lock(inode->i_mapping);
 
 	/*
 	 * Should wait end_io to count F2FS_WB_CP_DATA correctly by
@@ -2458,6 +2473,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
 	f2fs_i_size_write(fi->cow_inode, isize);
 
 out_unlock:
+	filemap_invalidate_unlock(inode->i_mapping);
 	f2fs_up_write(&fi->i_gc_rwsem[READ]);
 	f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
 	if (ret)
-- 
2.56.0.385.gd3acb90ef8-goog

Re: [f2fs-dev] [PATCH v2] f2fs: disallow mmap write and data-modifying fallocate on atomic files

[Chao Yu]

On 10/10/26 10:41, Daeho Jeong wrote:
> From: Daeho Jeong <daehojeong@google.com>
> 
> Stores through a shared writable mapping and fallocate with
> FALLOC_FL_PUNCH_HOLE, FALLOC_FL_ZERO_RANGE, FALLOC_FL_COLLAPSE_RANGE or
> FALLOC_FL_INSERT_RANGE do not go through ->write_begin, so they bypass
> the COW inode and modify the original inode directly. Reject them while
> the file is in atomic write mode, as fallocate already does for pinned
> and compressed files. A write fault gets SIGBUS and fallocate gets
> -EOPNOTSUPP.
> 
> fallocate without these flags only preallocates blocks and stays
> allowed.
> 
> f2fs_vm_page_mkwrite() cannot take inode_lock, so check the flag under
> invalidate_lock, and hold invalidate_lock in
> f2fs_ioc_start_atomic_write() from the flush until the flag is set.
> Otherwise a fault could check the flag, then start_atomic_write could
> flush and set the flag, and the fault would dirty the folio afterwards.
> 
> Cc: stable@kernel.org
> Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
> Signed-off-by: Daeho Jeong <daehojeong@google.com>

Daeho,

Please take a look at https://sashiko.dev/#/patchset/20261010024133.2444761-1-daeho43%40gmail.com

I think we need to apply this after ("f2fs: remove mappedtodisk flag usage in mmap write path")

More details are in my comments on this patch:
https://lore.kernel.org/linux-f2fs-devel/496b913c-eb81-4fa8-be72-c6a06a10aba2@kernel.org/

Otherwise it looks good to me.

Reviewed-by: Chao Yu <chao@kernel.org>

Thanks,

> ---
> v2: serialize atomic flag check in f2fs_vm_page_mkwrite().
> ---
>  fs/f2fs/file.c | 20 ++++++++++++++++++--
>  1 file changed, 18 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> index ef4d218e694..7020b3e8940 100644
> --- a/fs/f2fs/file.c
> +++ b/fs/f2fs/file.c
> @@ -187,6 +187,17 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
>  	file_update_time(vmf->vma->vm_file);
>  	filemap_invalidate_lock_shared(inode->i_mapping);
>  
> +	/*
> +	 * mmap stores bypass the COW inode and would break atomicity. Check
> +	 * under invalidate_lock: f2fs_ioc_start_atomic_write() holds it while
> +	 * flushing dirty folios and setting FI_ATOMIC_FILE, so either it sees
> +	 * our dirty folio and writes it back, or we see the flag.
> +	 */
> +	if (unlikely(f2fs_is_atomic_file(inode))) {
> +		err = -EOPNOTSUPP;
> +		goto out_sem;
> +	}
> +
>  	folio_lock(folio);
>  	if (unlikely(folio->mapping != inode->i_mapping ||
>  			folio_pos(folio) > i_size_read(inode) ||
> @@ -2113,9 +2124,11 @@ static long f2fs_fallocate(struct file *file, int mode,
>  
>  	/*
>  	 * Pinned file should not support partial truncation since the block
> -	 * can be used by applications.
> +	 * can be used by applications. Atomic files should not either, since
> +	 * these modify the original inode directly and break atomicity.
>  	 */
> -	if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode)) &&
> +	if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode) ||
> +	     f2fs_is_atomic_file(inode)) &&
>  		(mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_COLLAPSE_RANGE |
>  			FALLOC_FL_ZERO_RANGE | FALLOC_FL_INSERT_RANGE))) {
>  		ret = -EOPNOTSUPP;
> @@ -2403,6 +2416,8 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
>  
>  	f2fs_down_write(&fi->i_gc_rwsem[WRITE]);
>  	f2fs_down_write(&fi->i_gc_rwsem[READ]);
> +	/* serialize with f2fs_vm_page_mkwrite(), see the comment there */
> +	filemap_invalidate_lock(inode->i_mapping);
>  
>  	/*
>  	 * Should wait end_io to count F2FS_WB_CP_DATA correctly by
> @@ -2458,6 +2473,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
>  	f2fs_i_size_write(fi->cow_inode, isize);
>  
>  out_unlock:
> +	filemap_invalidate_unlock(inode->i_mapping);
>  	f2fs_up_write(&fi->i_gc_rwsem[READ]);
>  	f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
>  	if (ret)

Re: [f2fs-dev] [PATCH v2] f2fs: disallow mmap write and data-modifying fallocate on atomic files

[Daeho Jeong]

On Sat, Oct 10, 2026 at 12:37 AM Chao Yu <chao@kernel.org> wrote:
>
> On 10/10/26 10:41, Daeho Jeong wrote:
> > From: Daeho Jeong <daehojeong@google.com>
> >
> > Stores through a shared writable mapping and fallocate with
> > FALLOC_FL_PUNCH_HOLE, FALLOC_FL_ZERO_RANGE, FALLOC_FL_COLLAPSE_RANGE or
> > FALLOC_FL_INSERT_RANGE do not go through ->write_begin, so they bypass
> > the COW inode and modify the original inode directly. Reject them while
> > the file is in atomic write mode, as fallocate already does for pinned
> > and compressed files. A write fault gets SIGBUS and fallocate gets
> > -EOPNOTSUPP.
> >
> > fallocate without these flags only preallocates blocks and stays
> > allowed.
> >
> > f2fs_vm_page_mkwrite() cannot take inode_lock, so check the flag under
> > invalidate_lock, and hold invalidate_lock in
> > f2fs_ioc_start_atomic_write() from the flush until the flag is set.
> > Otherwise a fault could check the flag, then start_atomic_write could
> > flush and set the flag, and the fault would dirty the folio afterwards.
> >
> > Cc: stable@kernel.org
> > Fixes: 3db1de0e582c ("f2fs: change the current atomic write way")
> > Signed-off-by: Daeho Jeong <daehojeong@google.com>
>
> Daeho,
>
> Please take a look at https://sashiko.dev/#/patchset/20261010024133.2444761-1-daeho43%40gmail.com
>
> I think we need to apply this after ("f2fs: remove mappedtodisk flag usage in mmap write path")
>
> More details are in my comments on this patch:
> https://lore.kernel.org/linux-f2fs-devel/496b913c-eb81-4fa8-be72-c6a06a10aba2@kernel.org/
>
> Otherwise it looks good to me.
>
> Reviewed-by: Chao Yu <chao@kernel.org>
>
> Thanks,

Oh, got it.

Thanks,

>
> > ---
> > v2: serialize atomic flag check in f2fs_vm_page_mkwrite().
> > ---
> >  fs/f2fs/file.c | 20 ++++++++++++++++++--
> >  1 file changed, 18 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> > index ef4d218e694..7020b3e8940 100644
> > --- a/fs/f2fs/file.c
> > +++ b/fs/f2fs/file.c
> > @@ -187,6 +187,17 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
> >       file_update_time(vmf->vma->vm_file);
> >       filemap_invalidate_lock_shared(inode->i_mapping);
> >
> > +     /*
> > +      * mmap stores bypass the COW inode and would break atomicity. Check
> > +      * under invalidate_lock: f2fs_ioc_start_atomic_write() holds it while
> > +      * flushing dirty folios and setting FI_ATOMIC_FILE, so either it sees
> > +      * our dirty folio and writes it back, or we see the flag.
> > +      */
> > +     if (unlikely(f2fs_is_atomic_file(inode))) {
> > +             err = -EOPNOTSUPP;
> > +             goto out_sem;
> > +     }
> > +
> >       folio_lock(folio);
> >       if (unlikely(folio->mapping != inode->i_mapping ||
> >                       folio_pos(folio) > i_size_read(inode) ||
> > @@ -2113,9 +2124,11 @@ static long f2fs_fallocate(struct file *file, int mode,
> >
> >       /*
> >        * Pinned file should not support partial truncation since the block
> > -      * can be used by applications.
> > +      * can be used by applications. Atomic files should not either, since
> > +      * these modify the original inode directly and break atomicity.
> >        */
> > -     if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode)) &&
> > +     if ((f2fs_compressed_file(inode) || f2fs_is_pinned_file(inode) ||
> > +          f2fs_is_atomic_file(inode)) &&
> >               (mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_COLLAPSE_RANGE |
> >                       FALLOC_FL_ZERO_RANGE | FALLOC_FL_INSERT_RANGE))) {
> >               ret = -EOPNOTSUPP;
> > @@ -2403,6 +2416,8 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
> >
> >       f2fs_down_write(&fi->i_gc_rwsem[WRITE]);
> >       f2fs_down_write(&fi->i_gc_rwsem[READ]);
> > +     /* serialize with f2fs_vm_page_mkwrite(), see the comment there */
> > +     filemap_invalidate_lock(inode->i_mapping);
> >
> >       /*
> >        * Should wait end_io to count F2FS_WB_CP_DATA correctly by
> > @@ -2458,6 +2473,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)
> >       f2fs_i_size_write(fi->cow_inode, isize);
> >
> >  out_unlock:
> > +     filemap_invalidate_unlock(inode->i_mapping);
> >       f2fs_up_write(&fi->i_gc_rwsem[READ]);
> >       f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
> >       if (ret)
>