]> git-server-git.apps.pok.os.sepia.ceph.com Git - ceph-client.git/commit
udf: Fix race between file type conversion and writeback
authorJan Kara <jack@suse.cz>
Thu, 26 Mar 2026 14:06:32 +0000 (15:06 +0100)
committerJan Kara <jack@suse.cz>
Fri, 27 Mar 2026 16:01:40 +0000 (17:01 +0100)
commit102e57d56f81fa5c5ed78f576101d1bf1b3e6fe2
tree468af3d0dae05dacd6d64a155e0989696e7ad31a
parentfffca572f9ca51607f180a37d0c898404c8f9112
udf: Fix race between file type conversion and writeback

udf_setsize() can race with udf_writepages() as follows:

udf_setsize() udf_writepages()
  if (iinfo->i_alloc_type ==
ICBTAG_FLAG_AD_IN_ICB)
  err = udf_expand_file_adinicb(inode);
  err = udf_extend_file(inode, newsize);
    udf_adinicb_writepages()
      memcpy_from_file_folio() - crash
because inode size is too big.

Fix the problem by checking the file type under folio lock in
udf_handle_page_wb() handler called from __mpage_writepages() which
properly serializes with udf_expand_file_adinicb().

Reported-by: Jianzhou Zhao <luckd0g@163.com>
Link: https://lore.kernel.org/all/f622c01.67ac.19cdbdd777d.Coremail.luckd0g@163.com
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260326140635.15895-4-jack@suse.cz
Signed-off-by: Jan Kara <jack@suse.cz>
fs/udf/inode.c