Re: [PATCH] fat: hold truncate_lock in fat_write_failed()

[Matheus Alves de Almeida]

On Fri, Oct 23, 2026 at 04:34:34PM +0900, OGAWA Hirofumi wrote:
>Matheus Alves de Almeida <matheus.aalmeida@xxxxxxxxxxxx> writes:
>
>> The current fat_write_failed() implementation calls into
>> fat_truncate_blocks() without holding truncate_lock. Make it so it is
>> held exclusive while truncating.
>>
>> Fixes: 459f6ed3b8c7 ("fat: convert to use the new truncate convention.")
>> Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@xxxxxxxxxxxx>
>> ---
>>  fs/fat/inode.c | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/fs/fat/inode.c b/fs/fat/inode.c
>> index 141276fcf8db..2a16ed415631 100644
>> --- a/fs/fat/inode.c
>> +++ b/fs/fat/inode.c
>> @@ -216,7 +216,9 @@ static void fat_write_failed(struct address_space *mapping, loff_t to)
>>  
>>  	if (to > inode->i_size) {
>>  		truncate_pagecache(inode, inode->i_size);
>> +		down_write(&MSDOS_I(inode)->truncate_lock);
>>  		fat_truncate_blocks(inode, inode->i_size);
>> +		up_write(&MSDOS_I(inode)->truncate_lock);
>
>Which race this prevent?
>
>Thanks.
>
fat_write_failed() can race with the users of fat_aops.bmap(). bmap()
eventually reaches fat_get_cluster(), which assumes the file's cluster
chain will not be truncated concurrently. fat_write_failed() currently
truncates without holding truncate_lock.

For comparison, fat_setattr() correctly holds truncate_lock during
truncation:

down_write(&MSDOS_I(inode)->truncate_lock);
truncate_setsize(inode, attr->ia_size);
fat_truncate_blocks(inode, attr->ia_size);
up_write(&MSDOS_I(inode)->truncate_lock);

Thanks,
Matheus
>>  	}
>>  }
>
>-- 
>OGAWA Hirofumi <hirofumi@xxxxxxxxxxxxxxxxxx>