[PATCH] fuse: clear the old EOF tail when copying past EOF

[PATCH] fuse: clear the old EOF tail when copying past EOF

[Hungyu Lin]

__fuse_copy_file_range() invalidates the copied range before updating the
destination size, but does not clear the tail of the old EOF page. If that
tail was modified through a shared mapping and the copy starts in a later
page, the newly exposed gap can contain stale data instead of zeros. A
subsequent writeback can also send those stale bytes to the server.

Remember the destination size before sending the COPY request. After a
positive copy result, clear the gap from the old EOF to the copy start
before publishing the new size. Keep the existing invalidation of the
copied range. Apply the page-cache cleanup to non-DAX inodes and cover
both write-through and writeback-cache connections.

Fixes: 88bc7d5097a1 ("fuse: add support for copy_file_range()")
Reported-by: shaos <shawnq1@163.com>
Link: https://lore.kernel.org/r/20261020003429.1009226-1-shawnq1@163.com
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/fuse/file.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index d5e1cb53d86a6b35e63ca31b1065068ea5bdb6be..d3fa2bac9903acbd15cdbe9483fe3605f7ab5da5 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -3000,6 +3000,7 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
 	struct fuse_copy_file_range_out outarg_64;
 	u64 bytes_copied;
 	ssize_t err;
+	loff_t oldsize;
 	/* mark unstable when write-back is not used, and file_out gets
 	 * extended */
 	bool is_unstable = (!fc->writeback_cache) &&
@@ -3047,6 +3048,8 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
 	if (err)
 		goto out;
 
+	oldsize = i_size_read(inode_out);
+
 	if (is_unstable)
 		set_bit(FUSE_I_SIZE_UNSTABLE, &fi_out->state);
 
@@ -3087,6 +3090,9 @@ static ssize_t __fuse_copy_file_range(struct file *file_in, loff_t pos_in,
 		goto out;
 	}
 
+	if (bytes_copied && !IS_DAX(inode_out) && pos_out > oldsize)
+		truncate_pagecache_range(inode_out, oldsize, pos_out - 1);
+
 	if (bytes_copied)
 		invalidate_inode_pages2_range(inode_out->i_mapping,
 					      pos_out >> PAGE_SHIFT,

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0