splice: always fsnotify_access(in), fsnotify_modify(out) on success

The current behaviour caused an asymmetry where some write APIs
(write, sendfile) would notify the written-to/read-from objects,
but splice wouldn't.

This affected userspace which uses inotify, most notably coreutils
tail -f, to monitor pipes.
If the pipe buffer had been filled by a splice-family function:
  * tail wouldn't know and thus wouldn't service the pipe, and
  * all writes to the pipe would block because it's full,
thus service was denied.
(For the particular case of tail -f this could be worked around
 with ---disable-inotify.)

Fixes: 983652c69199 ("splice: report related fsnotify events")
Link: https://lore.kernel.org/linux-fsdevel/jbyihkyk5dtaohdwjyivambb2gffyjs3dodpofafnkkunxq7bu@jngkdxx65pux/t/#u
Link: https://bugs.debian.org/1039488
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
Acked-by: Jan Kara <jack@suse.cz>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Message-Id: <604ec704d933e0e0121d9e107ce914512e045fad.1688393619.git.nabijaczleweli@nabijaczleweli.xyz>
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/fs/splice.c b/fs/splice.c
index 004eb1c4ce318c9e7e74b49f272e1e033a4a4fa1..016b0a83df44ccfdb487035afa3e2b5fc71a1bc2 100644 (file)
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -1267,10 +1267,8 @@ long do_splice(struct file *in, loff_t *off_in, struct file *out,
                if ((in->f_flags | out->f_flags) & O_NONBLOCK)
                        flags |= SPLICE_F_NONBLOCK;
 
-               return splice_pipe_to_pipe(ipipe, opipe, len, flags);
-       }
-
-       if (ipipe) {
+               ret = splice_pipe_to_pipe(ipipe, opipe, len, flags);
+       } else if (ipipe) {
                if (off_in)
                        return -ESPIPE;
                if (off_out) {
@@ -1295,18 +1293,11 @@ long do_splice(struct file *in, loff_t *off_in, struct file *out,
                ret = do_splice_from(ipipe, out, &offset, len, flags);
                file_end_write(out);
 
-               if (ret > 0)
-                       fsnotify_modify(out);
-
                if (!off_out)
                        out->f_pos = offset;
                else
                        *off_out = offset;
-
-               return ret;
-       }
-
-       if (opipe) {
+       } else if (opipe) {
                if (off_out)
                        return -ESPIPE;
                if (off_in) {
@@ -1322,18 +1313,25 @@ long do_splice(struct file *in, loff_t *off_in, struct file *out,
 
                ret = splice_file_to_pipe(in, opipe, &offset, len, flags);
 
-               if (ret > 0)
-                       fsnotify_access(in);
-
                if (!off_in)
                        in->f_pos = offset;
                else
                        *off_in = offset;
+       } else {
+               ret = -EINVAL;
+       }
 
-               return ret;
+       if (ret > 0) {
+               /*
+                * Generate modify out before access in:
+                * do_splice_from() may've already sent modify out,
+                * and this ensures the events get merged.
+                */
+               fsnotify_modify(out);
+               fsnotify_access(in);
        }
 
-       return -EINVAL;
+       return ret;
 }
 
 static long __do_splice(struct file *in, loff_t __user *off_in,