[PATCH] fs/ntfs3: don't write a compressed frame after a short copy

[Zhan Xusheng <zhanxusheng1024@gmail.com>]

From: Zhan Xusheng <zhanxusheng@xiaomi.com>

ntfs_compress_write() skips ni_read_frame() when the write covers the
whole frame, or runs from the start of the frame to past i_size. If
the copy from user space then comes up short, the rest of the frame
is whatever the folios held; ni_write_frame() compresses it to disk
and the folios are marked uptodate.

The copy can come up short after fault_in_iov_iter_readable() has
succeeded if the source buffer is unmapped in between. On a volume
with 4K clusters, writing 64K at offset 0 of a compressed file while
another thread unmaps and remaps the last page of the buffer replaces
the last 4096 bytes of the frame with zeros. The write returns
-EFAULT.

Don't write the frame in that case; fail with -EFAULT as if nothing
had been copied.

Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
Tested in QEMU on v7.4-rc1 with KASAN, page cache dropped before each
write:

  before: 3 of 755 writes left zeros at bytes 61440-65535
  after:  0 of 821 writes changed the file on failure

 fs/ntfs3/file.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c
index 1624f9b014e0..b1b925f95b8d 100644
--- a/fs/ntfs3/file.c
+++ b/fs/ntfs3/file.c
@@ -1099,7 +1099,8 @@ static ssize_t ntfs_compress_write(struct kiocb *iocb, struct iov_iter *from)
 
 	/* Copy user data [pos : pos + count). */
 	while (count) {
-		size_t copied, bytes;
+		size_t copied, bytes, want;
+		bool full_frame = false;
 
 		off = pos & (frame_size - 1);
 		bytes = frame_size - off;
@@ -1135,10 +1136,13 @@ static ssize_t ntfs_compress_write(struct kiocb *iocb, struct iov_iter *from)
 					}
 					goto out;
 				}
+			} else {
+				full_frame = true;
 			}
 		}
 
 		WARN_ON(!bytes);
+		want = bytes;
 		copied = 0;
 		ip = off >> PAGE_SHIFT;
 		off = offset_in_page(pos);
@@ -1165,6 +1169,23 @@ static ssize_t ntfs_compress_write(struct kiocb *iocb, struct iov_iter *from)
 			}
 		}
 
+		/*
+		 * A fully overwritten frame was not read in, so after a short
+		 * copy the rest of it holds whatever the folios contained.
+		 * Don't write that out.
+		 */
+		if (full_frame && copied < want) {
+			iov_iter_revert(from, copied);
+			for (ip = 0; ip < pages_per_frame; ip++) {
+				folio = page_folio(pages[ip]);
+				folio_clear_uptodate(folio);
+				folio_unlock(folio);
+				folio_put(folio);
+			}
+			err = -EFAULT;
+			goto out;
+		}
+
 		ni_lock(ni);
 		err = ni_write_frame(ni, pages, pages_per_frame);
 		ni_unlock(ni);

base-commit: f66469d9905b39d2c260a15d7d6db450f4db67c1
-- 
2.43.0