Skip to content

Commit 98e2fb2

Browse files
YuezhangMonamjaejeon
authored andcommitted
exfat: fix the new buffer was not zeroed before writing
Before writing, if a buffer_head marked as new, its data must be zeroed, otherwise uninitialized data in the page cache will be written. So this commit uses folio_zero_new_buffers() to zero the new buffers before ->write_end(). Fixes: 6630ea4 ("exfat: move extend valid_size into ->page_mkwrite()") Reported-by: syzbot+91ae49e1c1a2634d20c0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=91ae49e1c1a2634d20c0 Tested-by: syzbot+91ae49e1c1a2634d20c0@syzkaller.appspotmail.com Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com> Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
1 parent fee8737 commit 98e2fb2

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

fs/exfat/file.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -545,6 +545,7 @@ static int exfat_extend_valid_size(struct file *file, loff_t new_valid_size)
545545
while (pos < new_valid_size) {
546546
u32 len;
547547
struct folio *folio;
548+
unsigned long off;
548549

549550
len = PAGE_SIZE - (pos & (PAGE_SIZE - 1));
550551
if (pos + len > new_valid_size)
@@ -554,6 +555,9 @@ static int exfat_extend_valid_size(struct file *file, loff_t new_valid_size)
554555
if (err)
555556
goto out;
556557

558+
off = offset_in_folio(folio, pos);
559+
folio_zero_new_buffers(folio, off, off + len);
560+
557561
err = ops->write_end(file, mapping, pos, len, len, folio, NULL);
558562
if (err < 0)
559563
goto out;
@@ -563,6 +567,8 @@ static int exfat_extend_valid_size(struct file *file, loff_t new_valid_size)
563567
cond_resched();
564568
}
565569

570+
return 0;
571+
566572
out:
567573
return err;
568574
}

0 commit comments

Comments
 (0)