[PATCH] shmem: do not extend i_size when no data was copied

[PATCH] shmem: do not extend i_size when no data was copied

[Hungyu Lin]

shmem_write_end() advances i_size to pos + copied even when copied is
zero. A buffered write past EOF can therefore extend a tmpfs file
without writing any data.

Moving prefaulting to the slow write path makes this easy to reproduce:
a one-byte pwrite() at offset 4096 into an empty memfd, with an unreadable
source buffer, fails with EFAULT but leaves the file size at 4096.
generic_perform_write() calls ->write_end() with copied == 0 before
trying to fault in the source buffer.

Only extend i_size when data was copied. Leave the existing folio
handling unchanged so successful writes, retries and preallocated
pages retain their current behavior.

Fixes: 665575cff098 ("filemap: move prefaulting out of hot write path")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 mm/shmem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/shmem.c b/mm/shmem.c
index d97fc32e7c94..55287c370c73 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3487,7 +3487,7 @@ shmem_write_end(const struct kiocb *iocb, struct address_space *mapping,
 {
 	struct inode *inode = mapping->host;
 
-	if (pos + copied > inode->i_size)
+	if (copied && pos + copied > inode->i_size)
 		i_size_write(inode, pos + copied);
 
 	if (!folio_test_uptodate(folio)) {
-- 
2.43.0

Re: [PATCH] shmem: do not extend i_size when no data was copied

[Kiryl Shutsemau]

On Sun, Oct 25, 2026 at 04:46:19PM +0000, Hungyu Lin wrote:
> shmem_write_end() advances i_size to pos + copied even when copied is
> zero. A buffered write past EOF can therefore extend a tmpfs file
> without writing any data.

+ willy, jack, fsdevel.

This doesn't seem to be tmpfs-specific, right? I see the same with ext4.

simple_write_end() and generic_write_end() check pos + copied the same
way, so filesystems that use them through generic_perform_write() are
affected too.

It makes me think maybe generic_perform_write() is the right place to
fix it. Hm?

> Moving prefaulting to the slow write path makes this easy to reproduce:
> a one-byte pwrite() at offset 4096 into an empty memfd, with an unreadable
> source buffer, fails with EFAULT but leaves the file size at 4096.
> generic_perform_write() calls ->write_end() with copied == 0 before
> trying to fault in the source buffer.
>
> Only extend i_size when data was copied. Leave the existing folio
> handling unchanged so successful writes, retries and preallocated
> pages retain their current behavior.
>
> Fixes: 665575cff098 ("filemap: move prefaulting out of hot write path")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> ---
>  mm/shmem.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/shmem.c b/mm/shmem.c
> index d97fc32e7c94..55287c370c73 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -3487,7 +3487,7 @@ shmem_write_end(const struct kiocb *iocb, struct address_space *mapping,
>  {
>  	struct inode *inode = mapping->host;
>
> -	if (pos + copied > inode->i_size)
> +	if (copied && pos + copied > inode->i_size)
>  		i_size_write(inode, pos + copied);
>
>  	if (!folio_test_uptodate(folio)) {
> -- 
> 2.43.0
>

-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [PATCH] shmem: do not extend i_size when no data was copied

[Jan Kara]

On Mon 26-10-26 15:34:08, Kiryl Shutsemau wrote:
> On Sun, Oct 25, 2026 at 04:46:19PM +0000, Hungyu Lin wrote:
> > shmem_write_end() advances i_size to pos + copied even when copied is
> > zero. A buffered write past EOF can therefore extend a tmpfs file
> > without writing any data.
> 
> + willy, jack, fsdevel.
> 
> This doesn't seem to be tmpfs-specific, right? I see the same with ext4.
> 
> simple_write_end() and generic_write_end() check pos + copied the same
> way, so filesystems that use them through generic_perform_write() are
> affected too.
> 
> It makes me think maybe generic_perform_write() is the right place to
> fix it. Hm?

Well, that would be nice. But how'd you like to do that? i_size update is
the responsibility of ->write_end and we have to call ->write_end if copied
== 0 so that is undoes what ->write_begin has prepared.

								Honza

-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

Re: [PATCH] shmem: do not extend i_size when no data was copied

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] shmem: shmem_write_end() marks and retains folios when copied is zero
--

commit 8699add3f60dd22c2b86a526ad2c46fc91ebbdec
Author: Hungyu Lin <dennylin0707@gmail.com>

shmem: do not extend i_size when no data was copied

This commit updates shmem_write_end() to only advance inode->i_size when
copied is non-zero, preventing buffered writes that fail to copy data (such
as when faulting in the source buffer fails with -EFAULT) from extending the
file size.

> diff --git a/mm/shmem.c b/mm/shmem.c
> index fd0953d55fd64..3dc14bc589a48 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -3488,7 +3488,7 @@ shmem_write_end(const struct kiocb *iocb, struct address_space *mapping,
>  {
>  	struct inode *inode = mapping->host;
>  
> -	if (pos + copied > inode->i_size)
> +	if (copied && pos + copied > inode->i_size)
>  		i_size_write(inode, pos + copied);
>  
>  	if (!folio_test_uptodate(folio)) {

[Severity: High]
When copied is zero (for example, when generic_perform_write() calls
copy_folio_from_iter_atomic() on an unreadable user buffer and then
fault_in_iov_iter_readable() fails with -EFAULT), skipping i_size_write()
while still running the rest of shmem_write_end() zeroes the folio, marks it
uptodate and dirty, and leaves it in mapping->i_pages:

mm/shmem.c:shmem_write_end() {
	if (copied && pos + copied > inode->i_size)
		i_size_write(inode, pos + copied);

	if (!folio_test_uptodate(folio)) {
		if (copied < folio_size(folio)) {
			size_t from = offset_in_folio(folio, pos);
			folio_zero_segments(folio, 0, from,
					from + copied, folio_size(folio));
		}
		folio_mark_uptodate(folio);
	}
	folio_mark_dirty(folio);
}

Can leaving the folio marked uptodate and dirty in mapping->i_pages when
copied is zero cause several regressions?

1. If a write fails on a hole or an unwritten preallocated folio created by
   shmem_fallocate(), shmem_get_folio_gfp() intentionally leaves the folio
   !folio_test_uptodate(folio) so that mapping_seek_hole_data() ->
   folio_seek_hole_data() treats it as a hole:

   mm/filemap.c:folio_seek_hole_data() {
	if (xa_is_value(folio) || folio_test_uptodate(folio))
		return seek_data ? start : end;
	if (!ops->is_partially_uptodate)
		return seek_data ? end : start;
   }

   Does marking the folio uptodate when copied is zero turn unwritten
   fallocated ranges and holes into SEEK_DATA?

2. When a write past i_size fails with copied == 0, shmem_write_begin() has
   already allocated and charged a folio at index = pos >> PAGE_SHIFT,
   incrementing info->alloced and inode->i_blocks. Because inode->i_size is
   not updated, the file retains allocated dirty blocks beyond EOF (visible
   in st_blocks via shmem_getattr()). If the file is later extended via
   ftruncate(), shmem_setattr() only calls shmem_truncate_range() when
   newsize <= oldsize:

   mm/shmem.c:shmem_setattr() {
		if (newsize <= oldsize) {
			loff_t holebegin = round_up(newsize, PAGE_SIZE);
			if (oldsize > holebegin)
				unmap_mapping_range(inode->i_mapping,
							holebegin, 0, 1);
			if (info->alloced)
				shmem_truncate_range(inode,
							newsize, (loff_t)-1);
   }

   Won't extending i_size with ftruncate() expose those uptodate folios left
   beyond oldsize as SEEK_DATA?

3. When large folios are enabled, shmem_write_begin() can allocate a large
   folio at folio->index >= DIV_ROUND_UP(i_size, PAGE_SIZE) (for instance,
   at folio->index == 0 when i_size == 0) and queue the inode on
   sbinfo->shrinklist via shmem_unused_huge_add(). When i_size remains 0 and
   info->fallocend is 0, shmem_unused_huge_shrink() computes end == 0 and
   bails out without splitting or freeing the folio:

   mm/shmem.c:shmem_unused_huge_shrink() {
		i_size = i_size_read(inode);
		folio = filemap_get_entry(inode->i_mapping, i_size / PAGE_SIZE);
		if (!folio || xa_is_value(folio))
			goto drop;
		...
		folio_end = folio_next_index(folio);
		end = shmem_fallocend(inode, DIV_ROUND_UP(i_size, PAGE_SIZE));
		if (end <= folio->index || end >= folio_end) {
			folio_put(folio);
			goto drop;
		}
   }

   Similarly, shmem_writeout() only splits a large folio if index >
   folio->index:

   mm/shmem.c:shmem_writeout() {
	if (folio_test_large(folio)) {
		index = shmem_fallocend(inode,
			DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE));
		if ((index > folio->index && index < folio_next_index(folio)) ||
		    !IS_ENABLED(CONFIG_THP_SWAP))
			split = true;
	}
   }

   Doesn't this prevent both shmem_unused_huge_shrink() and shmem_writeout()
   from splitting large folios allocated past i_size when copied is zero?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261025164619.89992-1-dennylin0707@gmail.com?part=1

Re: [PATCH] shmem: do not extend i_size when no data was copied

[Kiryl Shutsemau]

On Mon, Oct 26, 2026 at 04:48:58PM +0100, Jan Kara wrote:
> On Mon 26-10-26 15:34:08, Kiryl Shutsemau wrote:
> > On Sun, Oct 25, 2026 at 04:46:19PM +0000, Hungyu Lin wrote:
> > > shmem_write_end() advances i_size to pos + copied even when copied is
> > > zero. A buffered write past EOF can therefore extend a tmpfs file
> > > without writing any data.
> > 
> > + willy, jack, fsdevel.
> > 
> > This doesn't seem to be tmpfs-specific, right? I see the same with ext4.
> > 
> > simple_write_end() and generic_write_end() check pos + copied the same
> > way, so filesystems that use them through generic_perform_write() are
> > affected too.
> > 
> > It makes me think maybe generic_perform_write() is the right place to
> > fix it. Hm?
> 
> Well, that would be nice. But how'd you like to do that? i_size update is
> the responsibility of ->write_end and we have to call ->write_end if copied
> == 0 so that is undoes what ->write_begin has prepared.

Hm.

A zero-length copy only moves i_size if the write starts beyond EOF.
So we can bring the prefault back just for that case, before
->write_begin():

        if (unlikely(pos > i_size_read(mapping->host)) &&
            fault_in_iov_iter_readable(i, bytes) == bytes) {
                status = -EFAULT;
                break;
        }

Overwrites and appends keep skipping the prefault. It is racy against
a concurrent munmap(), as it was before 665575cff098, but that is
userspace racing with itself.

The per-filesystem alternative is a 'copied &&' in every ->write_end.

And generic_write_end() cannot take it as is: generic_cont_expand_simple()
relies on a zero-length ->write_end() extending i_size. So we need some
replacement.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov