[PATCH] affs: honor copied length in OFS write_end

[PATCH] affs: honor copied length in OFS write_end

[Hungyu Lin]

affs_write_end_ofs() uses the requested length instead of the number of
bytes copied into the folio. It can therefore write data that was not
copied and report more bytes than the source iterator consumed.

generic_perform_write() then advances the file position without making
the corresponding progress through the source iterator. A one-byte
pwrite() from an unreadable buffer at EOF can repeatedly grow the file
instead of failing with EFAULT. Partial copies are overreported as well.

Limit the range written to the copied bytes. When nothing was copied,
unlock and put the folio without modifying block metadata or reporting
progress. Remove the obsolete comment: an uptodate destination folio does
not guarantee that the copy from the source succeeded.

Fixes: f2b6a16eb8f5 ("fs: affs convert to new aops")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/affs/file.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/fs/affs/file.c b/fs/affs/file.c
index 23e088a7ed4f..84f53ece87d6 100644
--- a/fs/affs/file.c
+++ b/fs/affs/file.c
@@ -700,15 +700,13 @@ static int affs_write_end_ofs(const struct kiocb *iocb,
 	u32 bidx, boff, bsize;
 	unsigned from, to;
 	u32 tmp;
-	int written;
+	int written = 0;
+
+	if (!copied)
+		goto err_first_bh;
 
 	from = pos & (PAGE_SIZE - 1);
-	to = from + len;
-	/*
-	 * XXX: not sure if this can handle short copies (len < copied), but
-	 * we don't have to, because the folio should always be uptodate here,
-	 * due to write_begin.
-	 */
+	to = from + copied;
 
 	pr_debug("%s(%llu, %llu, %llu)\n", __func__, inode->i_ino, pos,
 		 pos + len);
@@ -716,7 +714,6 @@ static int affs_write_end_ofs(const struct kiocb *iocb,
 	data = folio_address(folio);
 
 	bh = NULL;
-	written = 0;
 	tmp = (folio->index << PAGE_SHIFT) + from;
 	bidx = tmp / bsize;
 	boff = tmp % bsize;

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0

Re: [PATCH] affs: honor copied length in OFS write_end

[David Sterba]

On Wed, Nov 04, 2026 at 10:37:02AM +0000, Hungyu Lin wrote:
> affs_write_end_ofs() uses the requested length instead of the number of
> bytes copied into the folio. It can therefore write data that was not
> copied and report more bytes than the source iterator consumed.
> 
> generic_perform_write() then advances the file position without making
> the corresponding progress through the source iterator. A one-byte
> pwrite() from an unreadable buffer at EOF can repeatedly grow the file
> instead of failing with EFAULT. Partial copies are overreported as well.
> 
> Limit the range written to the copied bytes. When nothing was copied,
> unlock and put the folio without modifying block metadata or reporting
> progress. Remove the obsolete comment: an uptodate destination folio does
> not guarantee that the copy from the source succeeded.
> 
> Fixes: f2b6a16eb8f5 ("fs: affs convert to new aops")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>

Thanks, added to queue.