From 196ba8a8aba09f513a7b23ab4bb1f25e2d102dfb Mon Sep 17 00:00:00 2001
From: zhengliang <zhengliang6@huawei.com>
Date: Thu, 24 Jan 2019 20:57:03 +0800
Subject: [PATCH] f2fs: fix to data block override node segment by mistake
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The following race could lead to data block override node segment by mistake.

Task A            |    Task B         |  Task C            |    Task D
=======           |   ========        |==========          |  =========
open file         |                   |                    |
white file        |                   |                    |
submit bio        |                   |                    |
wait io complete  |                   |                    |
		  |   remove file     |                    |
........          |   iput_final      |                    |
		  |                   |   sync             |
		  |                   |  do checkpoint     |
		  |		      |  data segment free |
		  |                   |                    | create file1
		  |		      |		           | allocate node segment（if it is the same segment freed by Task C）
f2fs_write_end_io |		      |                    |

So we need to guarantee io complete before truncate inode
in f2fs_drop_inode.

Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
---
 fs/f2fs/super.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 384d1c248857..e382be2f10f9 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -915,6 +915,10 @@ static int f2fs_drop_inode(struct inode *inode)
 			sb_start_intwrite(inode->i_sb);
 			f2fs_i_size_write(inode, 0);
 
+			f2fs_submit_merged_write_cond(F2FS_I_SB(inode),
+					inode, NULL, 0, DATA);
+			truncate_inode_pages_final(inode->i_mapping);
+
 			if (F2FS_HAS_BLOCKS(inode))
 				f2fs_truncate(inode);