FFS puts the extended attributes blocks at the negative blocks for the

vnode, from -1 down. When vinvalbuf(vp, V_ALT) is done for the vnode, it
incorrectly does vm_object_page_remove(0, 0), removing all pages from
the underlying vm object, not only the pages that back the extended
attributes data.

Change vinvalbuf() to not remove any pages from the object when
V_NORMAL or V_ALT are specified. Instead, the only in-tree caller
in ffs_inode.c:ffs_truncate() that specifies V_ALT explicitely
removes the corresponding page range. The V_NORMAL caller
does vnode_pager_setsize(vp, 0) immediately after the call to
vinvalbuf(V_NORMAL) already.

Reported by:	csjp
Reviewed by:	ups
MFC after:	3 weeks

1 files changed, 9 insertions, 0 deletions

diff --git a/sys/ufs/ffs/ffs_inode.c b/sys/ufs/ffs/ffs_inode.c
index fa679ef..2be220e 100644
--- a/sys/ufs/ffs/ffs_inode.c
+++ b/sys/ufs/ffs/ffs_inode.c
@@ -48,6 +48,7 @@ __FBSDID("$FreeBSD$");
 
 #include <vm/vm.h>
 #include <vm/vm_extern.h>
+#include <vm/vm_object.h>
 
 #include <ufs/ufs/extattr.h>
 #include <ufs/ufs/quota.h>
@@ -151,6 +152,7 @@ ffs_truncate(vp, length, flags, cred, td)
 	struct fs *fs;
 	struct buf *bp;
 	struct ufsmount *ump;
+	vm_object_t object;
 	int needextclean, softdepslowdown, extblocks;
 	int offset, size, level, nblocks;
 	int i, error, allerror;
@@ -205,6 +207,13 @@ ffs_truncate(vp, length, flags, cred, td)
 			(void) chkdq(ip, -extblocks, NOCRED, 0);
 #endif
 			vinvalbuf(vp, V_ALT, 0, 0);
+			if ((object = vp->v_object) != NULL) {
+				VM_OBJECT_LOCK(object);
+				vm_object_page_remove(object,
+				    OFF_TO_IDX(lblktosize(fs, -extblocks)), 0,
+				    FALSE);
+				VM_OBJECT_UNLOCK(object);
+			}
 			ip->i_din2->di_extsize = 0;
 			for (i = 0; i < NXADDR; i++) {
 				oldblks[i] = ip->i_din2->di_extb[i];