[PATCH] libfs: do not extend i_size when no data was copied

[PATCH] libfs: do not extend i_size when no data was copied

[Hungyu Lin]

simple_write_end() updates i_size to pos + copied even when copied is
zero. A failed buffered write past EOF can therefore extend a ramfs file
without writing any data.

Since prefaulting was moved to the slow write path, this is reproducible
with a one-byte pwrite() at offset 4096 into an empty ramfs file using an
unreadable source buffer. The call fails with EFAULT but leaves the file
size at 4096. generic_perform_write() calls ->write_end() with copied == 0
before trying to fault in the source buffer.

Only extend i_size when data was copied. Keep the existing folio handling
so that zero-progress retries and successful writes retain their current
behavior.

Fixes: 665575cff098 ("filemap: move prefaulting out of hot write path")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/libfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/libfs.c b/fs/libfs.c
index 8e2cc627bc7f..d889a4a14f41 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -1007,7 +1007,7 @@ static int simple_write_end(const struct kiocb *iocb,
 	 * No need to use i_size_read() here, the i_size
 	 * cannot change under us because we hold the i_rwsem.
 	 */
-	if (last_pos > inode->i_size)
+	if (copied && last_pos > inode->i_size)
 		i_size_write(inode, last_pos);
 
 	folio_mark_dirty(folio);
-- 
2.43.0

Re: [PATCH] libfs: do not extend i_size when no data was copied

[Jan Kara]

On Sun 25-10-26 17:11:30, Hungyu Lin wrote:
> simple_write_end() updates i_size to pos + copied even when copied is
> zero. A failed buffered write past EOF can therefore extend a ramfs file
> without writing any data.
> 
> Since prefaulting was moved to the slow write path, this is reproducible
> with a one-byte pwrite() at offset 4096 into an empty ramfs file using an
> unreadable source buffer. The call fails with EFAULT but leaves the file
> size at 4096. generic_perform_write() calls ->write_end() with copied == 0
> before trying to fault in the source buffer.
> 
> Only extend i_size when data was copied. Keep the existing folio handling
> so that zero-progress retries and successful writes retain their current
> behavior.
> 
> Fixes: 665575cff098 ("filemap: move prefaulting out of hot write path")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>

Looks good. Feel free to add:

Reviewed-by: Jan Kara <jack@suse.cz>

								Honza

> ---
>  fs/libfs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/libfs.c b/fs/libfs.c
> index 8e2cc627bc7f..d889a4a14f41 100644
> --- a/fs/libfs.c
> +++ b/fs/libfs.c
> @@ -1007,7 +1007,7 @@ static int simple_write_end(const struct kiocb *iocb,
>  	 * No need to use i_size_read() here, the i_size
>  	 * cannot change under us because we hold the i_rwsem.
>  	 */
> -	if (last_pos > inode->i_size)
> +	if (copied && last_pos > inode->i_size)
>  		i_size_write(inode, last_pos);
>  
>  	folio_mark_dirty(folio);
> -- 
> 2.43.0
> 
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR