[PATCH] configfs: avoid committing failed binary attribute writes

[Yichong Chen]

Configfs binary attributes buffer write data and submit the final buffer
on release.  The write path sets write_in_progress before it knows
whether the current write can be accepted.

If the first write fails before any data is copied, for example because
the write exceeds cb_max_size or the buffer allocation fails, release still
treats the file as having a pending binary write and calls the attribute
write callback with the current buffer state.  For ACPI configfs, an
oversized first write to the aml attribute can therefore fail with -EFBIG
and then oops on close when acpi_table_aml_write() is called with a NULL
buffer.

Only mark the binary attribute as having a write in progress after data
has actually been copied into the buffer.

Fixes: 03607ace807b ("configfs: implement binary attributes")
Signed-off-by: Yichong Chen <chenyichong@xxxxxxxxxxxxx>
---
 fs/configfs/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index a48cece775a3..c55634931c05 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -249,7 +249,6 @@ static ssize_t configfs_bin_write_iter(struct kiocb *iocb,
 		len = -ETXTBSY;
 		goto out;
 	}
-	buffer->write_in_progress = true;
 
 	/* buffer grows? */
 	end_offset = iocb->ki_pos + iov_iter_count(from);
@@ -281,6 +280,8 @@ static ssize_t configfs_bin_write_iter(struct kiocb *iocb,
 
 	len = copy_from_iter(buffer->bin_buffer + iocb->ki_pos,
 			     buffer->bin_buffer_size - iocb->ki_pos, from);
+	if (len > 0)
+		buffer->write_in_progress = true;
 	iocb->ki_pos += len;
 out:
 	mutex_unlock(&buffer->mutex);
-- 
2.51.0