[PATCH] libfs: do not extend i_size when no data was copied

[Hungyu Lin]

simple_write_end() updates i_size to pos + copied even when copied is
zero. A failed buffered write past EOF can therefore extend a ramfs file
without writing any data.

Since prefaulting was moved to the slow write path, this is reproducible
with a one-byte pwrite() at offset 4096 into an empty ramfs file using an
unreadable source buffer. The call fails with EFAULT but leaves the file
size at 4096. generic_perform_write() calls ->write_end() with copied == 0
before trying to fault in the source buffer.

Only extend i_size when data was copied. Keep the existing folio handling
so that zero-progress retries and successful writes retain their current
behavior.

Fixes: 665575cff098 ("filemap: move prefaulting out of hot write path")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hungyu Lin <dennylin0707@xxxxxxxxx>
---
 fs/libfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/libfs.c b/fs/libfs.c
index 8e2cc627bc7f..d889a4a14f41 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -1007,7 +1007,7 @@ static int simple_write_end(const struct kiocb *iocb,
 	 * No need to use i_size_read() here, the i_size
 	 * cannot change under us because we hold the i_rwsem.
 	 */
-	if (last_pos > inode->i_size)
+	if (copied && last_pos > inode->i_size)
 		i_size_write(inode, last_pos);
 
 	folio_mark_dirty(folio);
-- 
2.43.0