MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-08 10:25:20 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

UPSTREAM: exfat: fix zero the unwritten part for dio read

Browse Source 
For dio read, bio will be leave in flight when a successful partial
aio read have been setup, blockdev_direct_IO() will return
-EIOCBQUEUED. In the case, iter->iov_offset will be not advanced,
the oops reported by syzbot will occur if revert iter->iov_offset
with iov_iter_revert(). The unwritten part had been zeroed by aio
read, so there is no need to zero it in dio read.

Reported-by: syzbot+fd404f6b03a58e8bc403@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fd404f6b03a58e8bc403
Fixes: 11a347fb6c ("exfat: change to get file size from DataLength")
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
(cherry picked from commit 0991abedde)

Bug: 362138008

Change-Id: I18b2db841118f9b060cbbdd64a7ce3246669c0dc
Signed-off-by: dongliang.cui <dongliang.cui@unisoc.com>
This commit is contained in:
dongliang.cui 2024-08-26 20:47:00 +08:00 committed by Treehugger Robot
parent 26c23077d8
commit 0bcb24636d
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
fs/exfat/inode.c
View File

@ -501,7 +501,7 @@ static ssize_t exfat_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
struct inode *inode = mapping->host; struct inode *inode = mapping->host;
struct exfat_inode_info *ei = EXFAT_I(inode); struct exfat_inode_info *ei = EXFAT_I(inode);
loff_t pos = iocb->ki_pos; loff_t pos = iocb->ki_pos;
loff_t size = iocb->ki_pos + iov_iter_count(iter); loff_t size = pos + iov_iter_count(iter);
int rw = iov_iter_rw(iter); int rw = iov_iter_rw(iter);
ssize_t ret; ssize_t ret;
@ -525,11 +525,10 @@ static ssize_t exfat_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
*/ */
ret = blockdev_direct_IO(iocb, inode, iter, exfat_get_block); ret = blockdev_direct_IO(iocb, inode, iter, exfat_get_block);
if (ret < 0) { if (ret < 0) {
if (rw == WRITE) if (rw == WRITE && ret != -EIOCBQUEUED)
exfat_write_failed(mapping, size); exfat_write_failed(mapping, size);
if (ret != -EIOCBQUEUED) return ret;
return ret;
} else } else
size = pos + ret; size = pos + ret;