diff options
| author | Yuezhang Mo <Yuezhang.Mo@sony.com> | 2024-12-12 16:29:23 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-01-17 13:40:35 +0100 |
| commit | 942c6f91ab8d82a41650e717940b4e577173762f (patch) | |
| tree | 3c9857c00332eb062583f85b1bb429182670dd9f /fs/exfat | |
| parent | d9ea94f5cd117d56e573696d0045ab3044185a15 (diff) | |
| download | linux-942c6f91ab8d82a41650e717940b4e577173762f.tar.gz linux-942c6f91ab8d82a41650e717940b4e577173762f.tar.bz2 linux-942c6f91ab8d82a41650e717940b4e577173762f.zip | |
exfat: fix the new buffer was not zeroed before writing
[ Upstream commit 98e2fb26d1a9eafe79f46d15d54e68e014d81d8c ]
Before writing, if a buffer_head marked as new, its data must
be zeroed, otherwise uninitialized data in the page cache will
be written.
So this commit uses folio_zero_new_buffers() to zero the new
buffers before ->write_end().
Fixes: 6630ea49103c ("exfat: move extend valid_size into ->page_mkwrite()")
Reported-by: syzbot+91ae49e1c1a2634d20c0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=91ae49e1c1a2634d20c0
Tested-by: syzbot+91ae49e1c1a2634d20c0@syzkaller.appspotmail.com
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs/exfat')
| -rw-r--r-- | fs/exfat/file.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/fs/exfat/file.c b/fs/exfat/file.c index fb38769c3e39..05b51e721783 100644 --- a/fs/exfat/file.c +++ b/fs/exfat/file.c @@ -545,6 +545,7 @@ static int exfat_extend_valid_size(struct file *file, loff_t new_valid_size) while (pos < new_valid_size) { u32 len; struct folio *folio; + unsigned long off; len = PAGE_SIZE - (pos & (PAGE_SIZE - 1)); if (pos + len > new_valid_size) @@ -554,6 +555,9 @@ static int exfat_extend_valid_size(struct file *file, loff_t new_valid_size) if (err) goto out; + off = offset_in_folio(folio, pos); + folio_zero_new_buffers(folio, off, off + len); + err = ops->write_end(file, mapping, pos, len, len, folio, NULL); if (err < 0) goto out; @@ -563,6 +567,8 @@ static int exfat_extend_valid_size(struct file *file, loff_t new_valid_size) cond_resched(); } + return 0; + out: return err; } |