Re: [PATCH] fat: hold truncate_lock in fat_write_failed()

[OGAWA Hirofumi]

Matheus Alves de Almeida <matheus.aalmeida@xxxxxxxxxxxx> writes:

> On Fri, Oct 23, 2026 at 04:34:34PM +0900, OGAWA Hirofumi wrote:
>>Matheus Alves de Almeida <matheus.aalmeida@xxxxxxxxxxxx> writes:
>>
>>> The current fat_write_failed() implementation calls into
>>> fat_truncate_blocks() without holding truncate_lock. Make it so it is
>>> held exclusive while truncating.
>>>
>>> Fixes: 459f6ed3b8c7 ("fat: convert to use the new truncate convention.")
>>> Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@xxxxxxxxxxxx>
>>> ---
>>>  fs/fat/inode.c | 2 ++
>>>  1 file changed, 2 insertions(+)
>>>
>>> diff --git a/fs/fat/inode.c b/fs/fat/inode.c
>>> index 141276fcf8db..2a16ed415631 100644
>>> --- a/fs/fat/inode.c
>>> +++ b/fs/fat/inode.c
>>> @@ -216,7 +216,9 @@ static void fat_write_failed(struct address_space *mapping, loff_t to)
>>>  
>>>  	if (to > inode->i_size) {
>>>  		truncate_pagecache(inode, inode->i_size);
>>> +		down_write(&MSDOS_I(inode)->truncate_lock);
>>>  		fat_truncate_blocks(inode, inode->i_size);
>>> +		up_write(&MSDOS_I(inode)->truncate_lock);
>>
>>Which race this prevent?
>>
>>Thanks.
>>
> fat_write_failed() can race with the users of fat_aops.bmap(). bmap()
> eventually reaches fat_get_cluster(), which assumes the file's cluster
> chain will not be truncated concurrently. fat_write_failed() currently
> truncates without holding truncate_lock.
>
> For comparison, fat_setattr() correctly holds truncate_lock during
> truncation:
>
> down_write(&MSDOS_I(inode)->truncate_lock);
> truncate_setsize(inode, attr->ia_size);
> fat_truncate_blocks(inode, attr->ia_size);
> up_write(&MSDOS_I(inode)->truncate_lock);

Hm, looks like true.
-- 
OGAWA Hirofumi <hirofumi@xxxxxxxxxxxxxxxxxx>