[PATCH 0/2] hfs/hfsplus: set s_maxbytes from the volume capacity

[PATCH 0/2] hfs/hfsplus: set s_maxbytes from the volume capacity

[Viacheslav Dubeyko]

HFS and HFS+ do not support sparse files: every byte of a file
up to end-of-file has to be backed by an allocated block. As a
result, a write, truncate or copy_file_range() far beyond the
current end-of-file makes the driver zero-fill the whole gap,
which runs out of free space and fails with -ENOSPC rather than
reporting -EFBIG.

Since a file can never be larger than the volume, this series sets
s_maxbytes to the volume capacity instead (capped by
MAX_LFS_FILESIZE for HFS+ and by MAX_NON_LFS for HFS). The VFS then
returns -EFBIG for write(), copy_file_range(), truncate and
fallocate beyond the limit, and trims writes that straddle it. The
now redundant local checks are removed.

Viacheslav Dubeyko (2):
  hfsplus: set s_maxbytes from the volume capacity
  hfs: set s_maxbytes from the volume capacity

 fs/hfs/inode.c     |  7 -------
 fs/hfs/super.c     |  8 ++++++++
 fs/hfsplus/inode.c |  7 -------
 fs/hfsplus/super.c | 10 +++++++++-
 4 files changed, 17 insertions(+), 15 deletions(-)

-- 
2.43.0

[PATCH 1/2] hfsplus: set s_maxbytes from the volume capacity

[Viacheslav Dubeyko]

The xfstests' test-case generic/564 expects -EFBIG when
copy_file_range() targets a destination offset near 8EiB.
hfsplus_fill_super() sets s_maxbytes to MAX_LFS_FILESIZE,
so the VFS limit checks (generic_write_check_limits())
only trim the length instead of failing, and the request
reaches the file system. Because HFS+ does not support
holes, the driver then tries to zero-fill the whole gap
up to the target offset, and the operation fails with
-ENOSPC instead of -EFBIG.

This was previously worked around by a local check
against the volume capacity in hfsplus_write_begin().
That check only covered the write path and only the
start offset: truncate up, copy_file_range() and writes
that straddle the limit were not handled.

Every byte of an HFS+ file up to end-of-file must be
backed by an allocated block, so a file can never be
larger than the volume. Set s_maxbytes to the volume
capacity (total_blocks << alloc_blksz_shift, capped by
MAX_LFS_FILESIZE). The VFS then returns -EFBIG for
write(), copy_file_range(), truncate and fallocate
beyond that limit, and trims writes that straddle it.
Drop the now redundant local check from
hfsplus_write_begin().

Fixes: 56a4dbc90601 ("hfsplus: fix error code when writing beyond volume capacity")
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
cc: Yangtao Li <frank.li@vivo.com>
cc: linux-fsdevel@vger.kernel.org
---
 fs/hfsplus/inode.c |  7 -------
 fs/hfsplus/super.c | 10 +++++++++-
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
index aed0866499b2..5fa72b465922 100644
--- a/fs/hfsplus/inode.c
+++ b/fs/hfsplus/inode.c
@@ -44,15 +44,8 @@ int hfsplus_write_begin(const struct kiocb *iocb,
 			void **fsdata)
 {
 	struct inode *inode = mapping->host;
-	struct hfsplus_sb_info *sbi = HFSPLUS_SB(inode->i_sb);
-	loff_t total_capacity;
 	int ret;
 
-	total_capacity = (loff_t)sbi->total_blocks << sbi->alloc_blksz_shift;
-
-	if (pos >= total_capacity)
-		return -EFBIG;
-
 	ret = cont_write_begin(iocb, mapping, pos, len, foliop, fsdata,
 				hfsplus_get_block,
 				&HFSPLUS_I(inode)->phys_size);
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 4e878641fb59..f3283e9b42c8 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -672,7 +672,15 @@ static int hfsplus_fill_super(struct super_block *sb, struct fs_context *fc)
 
 	/* Set up operations so we can load metadata */
 	sb->s_op = &hfsplus_sops;
-	sb->s_maxbytes = MAX_LFS_FILESIZE;
+
+	/*
+	 * HFS+ does not support sparse files, so every byte up to
+	 * the end-of-file has to be backed by an allocated block.
+	 * Therefore, a file can never be larger than the volume.
+	 */
+	sb->s_maxbytes = min_t(loff_t, MAX_LFS_FILESIZE,
+			       (loff_t)sbi->total_blocks <<
+					sbi->alloc_blksz_shift);
 
 	if (!(vhdr->attributes & cpu_to_be32(HFSPLUS_VOL_UNMNT))) {
 		pr_warn("Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended.  mounting read-only.\n");
-- 
2.43.0

[PATCH 2/2] hfs: set s_maxbytes from the volume capacity

[Viacheslav Dubeyko]

Likewise HFS+, HFS returned -ENOSPC instead of -EFBIG when
a write targets an offset beyond the capacity of the volume.
hfs_fill_super() does not set s_maxbytes, so it keeps the
VFS default of MAX_NON_LFS (2GiB - 1). On a volume smaller
than that, the VFS limit checks consider the position valid
and the request reaches the file system. Because HFS does
not support holes, cont_write_begin() then tries to zero-fill
the whole gap up to the target offset, and the operation
fails with -ENOSPC.

This was previously worked around by a local check against
the volume capacity in hfs_write_begin(). That check only
covered the write path and only the start offset: truncate
up, copy_file_range() and writes that straddle the limit
were not handled.

Every byte of an HFS file up to end-of-file must be backed
by an allocated block, so a file can never be larger than
the volume. Set s_maxbytes to the volume capacity
(fs_ablocks * alloc_blksz, capped by MAX_NON_LFS). The VFS
then returns -EFBIG for write(), copy_file_range(), truncate
and fallocate beyond that limit, and trims writes that
straddle it. Drop the now redundant local check from
hfs_write_begin().

Fixes: c6decf13bf90 ("hfs: fix error code when writing beyond volume capacity")
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
cc: Yangtao Li <frank.li@vivo.com>
cc: linux-fsdevel@vger.kernel.org
---
 fs/hfs/inode.c | 7 -------
 fs/hfs/super.c | 8 ++++++++
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
index e7a8a5350216..ef1275bbbcbb 100644
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -50,15 +50,8 @@ int hfs_write_begin(const struct kiocb *iocb, struct address_space *mapping,
 		    void **fsdata)
 {
 	struct inode *inode = mapping->host;
-	struct hfs_sb_info *sbi = HFS_SB(inode->i_sb);
-	loff_t total_capacity;
 	int ret;
 
-	total_capacity = (loff_t)sbi->fs_ablocks * sbi->alloc_blksz;
-
-	if (pos >= total_capacity)
-		return -EFBIG;
-
 	ret = cont_write_begin(iocb, mapping, pos, len, foliop, fsdata,
 				hfs_get_block,
 				&HFS_I(inode)->phys_size);
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index d20150277eb3..fb8c6c0ba212 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -359,6 +359,14 @@ static int hfs_fill_super(struct super_block *sb, struct fs_context *fc)
 		goto bail;
 	}
 
+	/*
+	 * HFS does not support sparse files, so every byte up to
+	 * the end-of-file has to be backed by an allocated block.
+	 * Therefore, a file can never be larger than the volume.
+	 */
+	sb->s_maxbytes = min_t(loff_t, MAX_NON_LFS,
+			       (loff_t)sbi->fs_ablocks * sbi->alloc_blksz);
+
 	/* try to get the root inode */
 	res = hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
 	if (res)
-- 
2.43.0