From: Zhang Yi When splitting an unwritten extent in the middle and converting it to initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent. Assume we have an unwritten file and buffered write in the middle of it without dioread_nolock enabled, it will allocate blocks as written extent. 0 A B N [UUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDD--] D: valid data |<- ->| ----> this range needs to be initialized ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and leave the entire extent as unwritten. 0 A B N [UUUUUUUUUUUU] on-disk extent [UUUUUUUUUUUU] extent status tree [--DDDDDDDDZZ] Z: zeroed data ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and leave an written extent from A to N. 0 A B N [UU|WWWWWWWWWW] on-disk extent W: written extent [UU|UUUUUUUUUU] extent status tree [--|DDDDDDDDZZ] Finally ext4_map_create_blocks() only insert extent A to B to the extent status tree, and leave an stale unwritten extent in the status tree. 0 A B N [UU|WWWWWWWWWW] on-disk extent W: written extent [UU|WWWWWWWWUU] extent status tree [--|DDDDDDDDZZ] Fix this issue by always remove cached extent status entry before splitting extent. Signed-off-by: Zhang Yi --- fs/ext4/extents.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 2b5aec3f8882..9bb80af4b5cf 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3367,6 +3367,12 @@ static struct ext4_ext_path *ext4_split_extent(handle_t *handle, ee_len = ext4_ext_get_actual_len(ex); unwritten = ext4_ext_is_unwritten(ex); + /* + * Drop extent cache to prevent stale unwritten extents remaining + * after zeroing out. + */ + ext4_es_remove_extent(inode, ee_block, ee_len); + /* Do not cache extents that are in the process of being modified. */ flags |= EXT4_EX_NOCACHE; -- 2.46.1