Re: [PATCH 2/2] exfat: don't map EXFAT_EOF_CLUSTER as a physical cluster

[Chi Zhiling <chizhiling@163.com>]

On 11/13/26 4:06 PM, Youling Tang wrote:
> From: Youling Tang <tangyouling@kylinos.cn>
> 
> exfat_map_cluster() reports a hole by returning success with
> *clu == EXFAT_EOF_CLUSTER for !create.  __exfat_iomap_begin() does not
> check that sentinel and converts it into a physical address far beyond
> the device.  A writeback that races with the i_size/i_blocks window in
> exfat_cont_expand() can hit this: it submits a bio past the end of the
> device, and fsync() or msync() returns -EIO.  If the resulting iomap
> length is zero, iomap_add_to_ioend() can loop on a zero-length bio and
> hang a concurrent truncate.
> 
> When a range starts before the end of the cluster chain but extends past
> it, exfat_map_cluster() returns the sentinel for the whole range.  Map
> the valid prefix first and only report the part beyond the chain as a
> hole.  Otherwise a writeback that straddles the end of the chain would
> skip valid dirty data.
> 
> Report the remaining range as a hole instead of turning the sentinel
> into an address, matching the old exfat_get_block() behavior.
> 
> Fixes: 82a81a7352bc ("exfat: add iomap buffered I/O support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Youling Tang <tangyouling@kylinos.cn>
> ---
>   fs/exfat/iomap.c | 29 +++++++++++++++++++++++++++++
>   1 file changed, 29 insertions(+)
> 
> diff --git a/fs/exfat/iomap.c b/fs/exfat/iomap.c
> index 11823591b3a8..d6b420f615d4 100644
> --- a/fs/exfat/iomap.c
> +++ b/fs/exfat/iomap.c
> @@ -74,6 +74,22 @@ static int __exfat_iomap_begin(struct inode *inode, loff_t offset, loff_t length
>   	iomap->bdev = inode->i_sb->s_bdev;
>   	iomap->offset = offset;
>   
> +	if (!may_alloc) {
> +		unsigned int ondisk_clusters =
> +			exfat_bytes_to_cluster(sbi, exfat_ondisk_size(inode));
> +		unsigned int clu_offset =
> +			exfat_bytes_to_cluster(sbi, offset);
> +
> +		/*
> +		 * exfat_map_cluster() returns the EOF sentinel for the whole
> +		 * range if it extends past the cluster chain.  Map the valid
> +		 * prefix first so the hole only covers the part beyond it.
> +		 */
> +		if (clu_offset < ondisk_clusters &&
> +		    num_clusters > ondisk_clusters - clu_offset)
> +			num_clusters = ondisk_clusters - clu_offset;
> +	}

It would be better to put this handling in exfat_map_cluster().

Thanks.

> +
>   	err = exfat_map_cluster(inode, exfat_bytes_to_cluster(sbi, offset),
>   			&cluster, &num_clusters, may_alloc, &balloc);
>   	if (err == -ENOSPC && !(flags & IOMAP_DIRECT)) {
> @@ -90,6 +106,19 @@ static int __exfat_iomap_begin(struct inode *inode, loff_t offset, loff_t length
>   	if (err)
>   		goto out;
>   
> +	/*
> +	 * exfat_map_cluster() reports a hole by returning success with
> +	 * EXFAT_EOF_CLUSTER.  Return it as a hole instead of turning the
> +	 * sentinel into a physical address.
> +	 */
> +	if (!may_alloc && cluster == EXFAT_EOF_CLUSTER) {
> +		iomap->type = IOMAP_HOLE;
> +		iomap->addr = IOMAP_NULL_ADDR;
> +		iomap->offset = offset;
> +		iomap->length = length;
> +		goto out;
> +	}
> +
>   	cluster_offset = exfat_cluster_offset(sbi, offset);
>   	cluster_length = exfat_cluster_to_bytes(sbi, num_clusters);
>