btrfs: fix the delalloc range locking if sector size < page size

Inside lock_delalloc_folios(), there are several problems related to
sector size < page size handling:

- Set the writer locks without checking if the folio is still valid
  We call btrfs_folio_start_writer_lock() just like it's folio_lock().
  But since the folio may not even be the folio of the current mapping,
  we can easily screw up the folio->private.

- The range is not clamped inside the page
  This means we can over write other bitmaps if the start/len is not
  properly handled, and trigger the btrfs_subpage_assert().

- @processed_end is always rounded up to page end
  If the delalloc range is not page aligned, and we need to retry
  (returning -EAGAIN), then we will unlock to the page end.

  Thankfully this is not a huge problem, as now
  btrfs_folio_end_writer_lock() can handle range larger than the locked
  range, and only unlock what is already locked.

Fix all these problems by:

- Lock and check the folio first, then call
  btrfs_folio_set_writer_lock()
  So that if we got a folio not belonging to the inode, we won't
  touch folio->private.

- Properly truncate the range inside the page

- Update @processed_end to the locked range end

Fixes: 1e1de38792e0 ("btrfs: make process_one_page() to handle subpage locking")
CC: stable@vger.kernel.org # 6.1+
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 309a8ae4843454289608d4a683c491caf2701e1a..872cca54cc6ce41bd0f6f5809b1a5671e6187239 100644 (file)
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -262,22 +262,23 @@ static noinline int lock_delalloc_folios(struct inode *inode,
 
                for (i = 0; i < found_folios; i++) {
                        struct folio *folio = fbatch.folios[i];
-                       u32 len = end + 1 - start;
+                       u64 range_start;
+                       u32 range_len;
 
                        if (folio == locked_folio)
                                continue;
 
-                       if (btrfs_folio_start_writer_lock(fs_info, folio, start,
-                                                         len))
-                               goto out;
-
+                       folio_lock(folio);
                        if (!folio_test_dirty(folio) || folio->mapping != mapping) {
-                               btrfs_folio_end_writer_lock(fs_info, folio, start,
-                                                           len);
+                               folio_unlock(folio);
                                goto out;
                        }
+                       range_start = max_t(u64, folio_pos(folio), start);
+                       range_len = min_t(u64, folio_pos(folio) + folio_size(folio),
+                                         end + 1) - range_start;
+                       btrfs_folio_set_writer_lock(fs_info, folio, range_start, range_len);
 
-                       processed_end = folio_pos(folio) + folio_size(folio) - 1;
+                       processed_end = range_start + range_len - 1;
                }
                folio_batch_release(&fbatch);
                cond_resched();