[PATCH] affs: honor copied length in OFS write_end

[Hungyu Lin]

affs_write_end_ofs() uses the requested length instead of the number of
bytes copied into the folio. It can therefore write data that was not
copied and report more bytes than the source iterator consumed.

generic_perform_write() then advances the file position without making
the corresponding progress through the source iterator. A one-byte
pwrite() from an unreadable buffer at EOF can repeatedly grow the file
instead of failing with EFAULT. Partial copies are overreported as well.

Limit the range written to the copied bytes. When nothing was copied,
unlock and put the folio without modifying block metadata or reporting
progress. Remove the obsolete comment: an uptodate destination folio does
not guarantee that the copy from the source succeeded.

Fixes: f2b6a16eb8f5 ("fs: affs convert to new aops")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hungyu Lin <dennylin0707@xxxxxxxxx>
---
 fs/affs/file.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/fs/affs/file.c b/fs/affs/file.c
index 23e088a7ed4f..84f53ece87d6 100644
--- a/fs/affs/file.c
+++ b/fs/affs/file.c
@@ -700,15 +700,13 @@ static int affs_write_end_ofs(const struct kiocb *iocb,
 	u32 bidx, boff, bsize;
 	unsigned from, to;
 	u32 tmp;
-	int written;
+	int written = 0;
+
+	if (!copied)
+		goto err_first_bh;
 
 	from = pos & (PAGE_SIZE - 1);
-	to = from + len;
-	/*
-	 * XXX: not sure if this can handle short copies (len < copied), but
-	 * we don't have to, because the folio should always be uptodate here,
-	 * due to write_begin.
-	 */
+	to = from + copied;
 
 	pr_debug("%s(%llu, %llu, %llu)\n", __func__, inode->i_ino, pos,
 		 pos + len);
@@ -716,7 +714,6 @@ static int affs_write_end_ofs(const struct kiocb *iocb,
 	data = folio_address(folio);
 
 	bh = NULL;
-	written = 0;
 	tmp = (folio->index << PAGE_SHIFT) + from;
 	bidx = tmp / bsize;
 	boff = tmp % bsize;

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0