From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-sn1nam02on0131.outbound.protection.outlook.com ([104.47.36.131]:50185 "EHLO NAM02-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1032397AbeCAPeJ (ORCPT ); Thu, 1 Mar 2018 10:34:09 -0500 From: Sasha Levin To: "stable@vger.kernel.org" , "stable-commits@vger.kernel.org" CC: Ivan Vecera , Al Viro , Sasha Levin Subject: [added to the 4.1 stable tree] kernfs: fix regression in kernfs_fop_write caused by wrong type Date: Thu, 1 Mar 2018 15:26:04 +0000 Message-ID: <20180301152116.1486-330-alexander.levin@microsoft.com> References: <20180301152116.1486-1-alexander.levin@microsoft.com> In-Reply-To: <20180301152116.1486-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Ivan Vecera This patch has been added to the 4.1 stable tree. If you have any objections, please let us know. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ Upstream commit ba87977a49913129962af8ac35b0e13e0fa4382d ] Commit b7ce40cff0b9 ("kernfs: cache atomic_write_len in kernfs_open_file") changes type of local variable 'len' from ssize_t to size_t. This change caused that the *ppos value is updated also when the previous write callback failed. Mentioned snippet: ... len =3D ops->write(...); <- return value can be negative ... if (len > 0) <- true here in this case *ppos +=3D len; ... Fixes: b7ce40cff0b9 ("kernfs: cache atomic_write_len in kernfs_open_file") Acked-by: Tejun Heo Signed-off-by: Ivan Vecera Signed-off-by: Al Viro Signed-off-by: Sasha Levin --- fs/kernfs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c index 9ff28bc294c0..5d084638e1f8 100644 --- a/fs/kernfs/file.c +++ b/fs/kernfs/file.c @@ -272,7 +272,7 @@ static ssize_t kernfs_fop_write(struct file *file, cons= t char __user *user_buf, { struct kernfs_open_file *of =3D kernfs_of(file); const struct kernfs_ops *ops; - size_t len; + ssize_t len; char *buf; =20 if (of->atomic_write_len) { --=20 2.14.1