[PATCH] buffer: avoid extending i_size after failed writes

[PATCH] buffer: avoid extending i_size after failed writes

[Hungyu Lin]

generic_write_end() updates i_size to pos + copied even when a nonempty
write copied no data. Since prefaulting moved to the slow write path, a
pwrite() past EOF from an unreadable buffer can fail with EFAULT after
extending the file to the write offset.

For example, on ext2, a one-byte pwrite() at offset 4096 into an empty
file fails with EFAULT but leaves a 4096-byte file.

Require copied data before extending i_size for a nonempty write. Keep
zero-length write_end() calls working, since generic_cont_expand_simple()
uses them for expanding truncate operations.

Also call pagecache_isize_extended() only when i_size changed. Otherwise,
blocking the size update would leave its endpoint beyond EOF and trigger
its warning.

Fixes: 665575cff098 ("filemap: move prefaulting out of hot write path")
Reported-by: Kiryl Shutsemau <kas@kernel.org>
Link: https://lore.kernel.org/linux-mm/at9xXRhD2xZhszEj@thinkstation/
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 fs/buffer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/buffer.c b/fs/buffer.c
index 5d3852b726d6b113542e9761315cfdaf99f14587..f88ca7c079bee3462288fdebf57131da60b74798 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2203,7 +2203,7 @@ int generic_write_end(const struct kiocb *iocb, struct address_space *mapping,
 	 * But it's important to update i_size while still holding folio lock:
 	 * page writeout could otherwise come in and zero beyond i_size.
 	 */
-	if (pos + copied > inode->i_size) {
+	if ((copied || !len) && pos + copied > inode->i_size) {
 		i_size_write(inode, pos + copied);
 		i_size_changed = true;
 	}
@@ -2211,7 +2211,7 @@ int generic_write_end(const struct kiocb *iocb, struct address_space *mapping,
 	folio_unlock(folio);
 	folio_put(folio);
 
-	if (old_size < pos)
+	if (i_size_changed && old_size < pos)
 		pagecache_isize_extended(inode, old_size, pos);
 	/*
 	 * Don't mark the inode dirty under folio lock. First, it unnecessarily

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0

Re: [PATCH] buffer: avoid extending i_size after failed writes

[Kiryl Shutsemau]

On Tue, Nov 03, 2026 at 07:22:34AM +0000, Hungyu Lin wrote:
> generic_write_end() updates i_size to pos + copied even when a nonempty
> write copied no data. Since prefaulting moved to the slow write path, a
> pwrite() past EOF from an unreadable buffer can fail with EFAULT after
> extending the file to the write offset.
> 
> For example, on ext2, a one-byte pwrite() at offset 4096 into an empty
> file fails with EFAULT but leaves a 4096-byte file.
> 
> Require copied data before extending i_size for a nonempty write. Keep
> zero-length write_end() calls working, since generic_cont_expand_simple()
> uses them for expanding truncate operations.
> 
> Also call pagecache_isize_extended() only when i_size changed. Otherwise,
> blocking the size update would leave its endpoint beyond EOF and trigger
> its warning.
> 
> Fixes: 665575cff098 ("filemap: move prefaulting out of hot write path")
> Reported-by: Kiryl Shutsemau <kas@kernel.org>
> Link: https://lore.kernel.org/linux-mm/at9xXRhD2xZhszEj@thinkstation/
> Cc: stable@vger.kernel.org
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>

Jan is okay with what I proposed here:

https://lore.kernel.org/all/at-XtWBQg3jv3H8Z@thinkstation

Do you want to give it a try instead? Or want me to submit a proper patch?

-- 
  Kiryl Shutsemau / Kirill A. Shutemov