* [PATCH] fat: hold truncate_lock in fat_write_failed()
@ 2026-10-21 16:21 Matheus Alves de Almeida
2026-10-23 7:34 ` OGAWA Hirofumi
2026-10-24 19:26 ` OGAWA Hirofumi
0 siblings, 2 replies; 5+ messages in thread
From: Matheus Alves de Almeida @ 2026-10-21 16:21 UTC (permalink / raw)
To: OGAWA Hirofumi; +Cc: linux-fsdevel, linux-kernel, Matheus Alves de Almeida
The current fat_write_failed() implementation calls into
fat_truncate_blocks() without holding truncate_lock. Make it so it is
held exclusive while truncating.
Fixes: 459f6ed3b8c7 ("fat: convert to use the new truncate convention.")
Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br>
---
fs/fat/inode.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 141276fcf8db..2a16ed415631 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -216,7 +216,9 @@ static void fat_write_failed(struct address_space *mapping, loff_t to)
if (to > inode->i_size) {
truncate_pagecache(inode, inode->i_size);
+ down_write(&MSDOS_I(inode)->truncate_lock);
fat_truncate_blocks(inode, inode->i_size);
+ up_write(&MSDOS_I(inode)->truncate_lock);
}
}
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fat: hold truncate_lock in fat_write_failed()
2026-10-21 16:21 [PATCH] fat: hold truncate_lock in fat_write_failed() Matheus Alves de Almeida
@ 2026-10-23 7:34 ` OGAWA Hirofumi
2026-10-23 21:17 ` Matheus Alves de Almeida
2026-10-24 19:26 ` OGAWA Hirofumi
1 sibling, 1 reply; 5+ messages in thread
From: OGAWA Hirofumi @ 2026-10-23 7:34 UTC (permalink / raw)
To: Matheus Alves de Almeida; +Cc: linux-fsdevel, linux-kernel
Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br> writes:
> The current fat_write_failed() implementation calls into
> fat_truncate_blocks() without holding truncate_lock. Make it so it is
> held exclusive while truncating.
>
> Fixes: 459f6ed3b8c7 ("fat: convert to use the new truncate convention.")
> Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br>
> ---
> fs/fat/inode.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/fs/fat/inode.c b/fs/fat/inode.c
> index 141276fcf8db..2a16ed415631 100644
> --- a/fs/fat/inode.c
> +++ b/fs/fat/inode.c
> @@ -216,7 +216,9 @@ static void fat_write_failed(struct address_space *mapping, loff_t to)
>
> if (to > inode->i_size) {
> truncate_pagecache(inode, inode->i_size);
> + down_write(&MSDOS_I(inode)->truncate_lock);
> fat_truncate_blocks(inode, inode->i_size);
> + up_write(&MSDOS_I(inode)->truncate_lock);
Which race this prevent?
Thanks.
> }
> }
--
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fat: hold truncate_lock in fat_write_failed()
2026-10-23 7:34 ` OGAWA Hirofumi
@ 2026-10-23 21:17 ` Matheus Alves de Almeida
2026-10-23 23:46 ` OGAWA Hirofumi
0 siblings, 1 reply; 5+ messages in thread
From: Matheus Alves de Almeida @ 2026-10-23 21:17 UTC (permalink / raw)
To: OGAWA Hirofumi; +Cc: linux-fsdevel, linux-kernel
On Fri, Oct 23, 2026 at 04:34:34PM +0900, OGAWA Hirofumi wrote:
>Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br> writes:
>
>> The current fat_write_failed() implementation calls into
>> fat_truncate_blocks() without holding truncate_lock. Make it so it is
>> held exclusive while truncating.
>>
>> Fixes: 459f6ed3b8c7 ("fat: convert to use the new truncate convention.")
>> Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br>
>> ---
>> fs/fat/inode.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/fs/fat/inode.c b/fs/fat/inode.c
>> index 141276fcf8db..2a16ed415631 100644
>> --- a/fs/fat/inode.c
>> +++ b/fs/fat/inode.c
>> @@ -216,7 +216,9 @@ static void fat_write_failed(struct address_space *mapping, loff_t to)
>>
>> if (to > inode->i_size) {
>> truncate_pagecache(inode, inode->i_size);
>> + down_write(&MSDOS_I(inode)->truncate_lock);
>> fat_truncate_blocks(inode, inode->i_size);
>> + up_write(&MSDOS_I(inode)->truncate_lock);
>
>Which race this prevent?
>
>Thanks.
>
fat_write_failed() can race with the users of fat_aops.bmap(). bmap()
eventually reaches fat_get_cluster(), which assumes the file's cluster
chain will not be truncated concurrently. fat_write_failed() currently
truncates without holding truncate_lock.
For comparison, fat_setattr() correctly holds truncate_lock during
truncation:
down_write(&MSDOS_I(inode)->truncate_lock);
truncate_setsize(inode, attr->ia_size);
fat_truncate_blocks(inode, attr->ia_size);
up_write(&MSDOS_I(inode)->truncate_lock);
Thanks,
Matheus
>> }
>> }
>
>--
>OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fat: hold truncate_lock in fat_write_failed()
2026-10-23 21:17 ` Matheus Alves de Almeida
@ 2026-10-23 23:46 ` OGAWA Hirofumi
0 siblings, 0 replies; 5+ messages in thread
From: OGAWA Hirofumi @ 2026-10-23 23:46 UTC (permalink / raw)
To: Matheus Alves de Almeida; +Cc: linux-fsdevel, linux-kernel
Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br> writes:
> On Fri, Oct 23, 2026 at 04:34:34PM +0900, OGAWA Hirofumi wrote:
>>Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br> writes:
>>
>>> The current fat_write_failed() implementation calls into
>>> fat_truncate_blocks() without holding truncate_lock. Make it so it is
>>> held exclusive while truncating.
>>>
>>> Fixes: 459f6ed3b8c7 ("fat: convert to use the new truncate convention.")
>>> Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br>
>>> ---
>>> fs/fat/inode.c | 2 ++
>>> 1 file changed, 2 insertions(+)
>>>
>>> diff --git a/fs/fat/inode.c b/fs/fat/inode.c
>>> index 141276fcf8db..2a16ed415631 100644
>>> --- a/fs/fat/inode.c
>>> +++ b/fs/fat/inode.c
>>> @@ -216,7 +216,9 @@ static void fat_write_failed(struct address_space *mapping, loff_t to)
>>>
>>> if (to > inode->i_size) {
>>> truncate_pagecache(inode, inode->i_size);
>>> + down_write(&MSDOS_I(inode)->truncate_lock);
>>> fat_truncate_blocks(inode, inode->i_size);
>>> + up_write(&MSDOS_I(inode)->truncate_lock);
>>
>>Which race this prevent?
>>
>>Thanks.
>>
> fat_write_failed() can race with the users of fat_aops.bmap(). bmap()
> eventually reaches fat_get_cluster(), which assumes the file's cluster
> chain will not be truncated concurrently. fat_write_failed() currently
> truncates without holding truncate_lock.
>
> For comparison, fat_setattr() correctly holds truncate_lock during
> truncation:
>
> down_write(&MSDOS_I(inode)->truncate_lock);
> truncate_setsize(inode, attr->ia_size);
> fat_truncate_blocks(inode, attr->ia_size);
> up_write(&MSDOS_I(inode)->truncate_lock);
Hm, looks like true.
--
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fat: hold truncate_lock in fat_write_failed()
2026-10-21 16:21 [PATCH] fat: hold truncate_lock in fat_write_failed() Matheus Alves de Almeida
2026-10-23 7:34 ` OGAWA Hirofumi
@ 2026-10-24 19:26 ` OGAWA Hirofumi
1 sibling, 0 replies; 5+ messages in thread
From: OGAWA Hirofumi @ 2026-10-24 19:26 UTC (permalink / raw)
To: Andrew Morton; +Cc: Matheus Alves de Almeida, linux-fsdevel, linux-kernel
Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br> writes:
> The current fat_write_failed() implementation calls into
> fat_truncate_blocks() without holding truncate_lock. Make it so it is
> held exclusive while truncating.
>
> Fixes: 459f6ed3b8c7 ("fat: convert to use the new truncate convention.")
> Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br>
Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
> ---
> fs/fat/inode.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/fs/fat/inode.c b/fs/fat/inode.c
> index 141276fcf8db..2a16ed415631 100644
> --- a/fs/fat/inode.c
> +++ b/fs/fat/inode.c
> @@ -216,7 +216,9 @@ static void fat_write_failed(struct address_space *mapping, loff_t to)
>
> if (to > inode->i_size) {
> truncate_pagecache(inode, inode->i_size);
> + down_write(&MSDOS_I(inode)->truncate_lock);
> fat_truncate_blocks(inode, inode->i_size);
> + up_write(&MSDOS_I(inode)->truncate_lock);
> }
> }
--
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-24 19:26 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-21 16:21 [PATCH] fat: hold truncate_lock in fat_write_failed() Matheus Alves de Almeida
2026-10-23 7:34 ` OGAWA Hirofumi
2026-10-23 21:17 ` Matheus Alves de Almeida
2026-10-23 23:46 ` OGAWA Hirofumi
2026-10-24 19:26 ` OGAWA Hirofumi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®