From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794063167; b=OsqGpNTQz4mEqizBxhnOfnY6PeCgOWKxEVX/zlwnZ9rVgG4hj30qliPipYFPv+v6PymN aO3R8MMp2GmQXiRnhe8bTD8VGaog00TEVjdE13vr/UvZ4TUOaiBGRZtb86Cb2CtQXCbMl l87QhoLDIblVYLe+Z0J2g3wu8CwS6VqZQZlnNDp6fFQTMHSkfDW7MHVhnf5bjPDxFeNF1 QF4UG2yOKoEDvbwy8fyvcsfPNikvRr72KAAZ9y9s70HkNZIlnVNRSiTvJEw1K/O4bZf4H YZBq+B4MSoIbXGdyzYLDDCmawG/Q+BEF2ejTgpcvf19r0uHhI8kBhtOSimCPDDJtbKQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794063167; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=/Brg1FsUbp6gaxTEDBcwsXA3JAvMBTWh4mRVXl9wNKw=; b=xv/wKJqHTAdAai5aGtAgpoajpb9UFYCOUCfPEr86O4WAhUjOEQqT6BAkAQykpQZm3X2O epGSefdVbzHvrtVbBJ7Qq3cEITFhhqS60blFadq8RQH4R6Re14eUHI3svYkanaN3fKJcE Ok0IybiAuhDu9aygHOvkN4dJbo/Cr4pSA9BXx6S41w6jvRrdcw3pOrPfkCemZezz3bYOP xzN/hCGnu0IY+jIRobahg/KnR1eNXtWiVVQXKWZsmsBD0Vsj3tgKz7ENOHAs/rl7qUv8E j5tKMoyfkJzEO5YbHzQmYxOCqHxC/CYdBf86LhlfTKGRZJcUsBgx1cExfGUC0EuO5JQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="14V/vxa+"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E56B606D812; Sat, 7 Nov 2026 14:52:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=14V/vxa+ Received: by smtp.kernel.org (Postfix) with ESMTPSA id C6F941F0089F; Sat, 7 Nov 2026 14:52:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794063167; bh=/Brg1FsUbp6gaxTEDBcwsXA3JAvMBTWh4mRVXl9wNKw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=14V/vxa+FbJfBfO5Cb5K0tBScnOJv69Y+h9XllwALugUHZ8TynpMI7OcxF33QfW// 6zPqrZAAObJhlrPpdkcnRJKIp3sFoCqDv/XmfBatF7o7jDp53k6nzlmrPsm3+Ql9ax lJfdZS/Qr55tYQb3gkwyJNISCYQ5PFST6/rs3Y/E= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, OGAWA Hirofumi , Andrew Morton , syzbot+e64c6472a3d96a75172a@syzkaller.appspotmail.com, syzbot+26461e903494e689c24f@syzkaller.appspotmail.com, Yemu Lu , Ren Wei , Yuan Tan , Yifan Wu , Juefei Pu , Xin Liu , Sasha Levin Subject: [PATCH 6.18 387/869] fat: fix fat_ent_write() for reverting the value Date: Sat, 7 Nov 2026 08:51:09 -0500 Message-ID: <20261107134906.574528076@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: OGAWA Hirofumi [ Upstream commit 63c4b67ee163b2a67a7561314bf2106d6c79c53c ] commit 64d9183203ee ("fat: restore original value when fat_ent_write failed") try to revert the fatent value to old value when got the error on mirror FAT. However it didn't work if the error is when writing the fatent bh. In that case, the bh is cleared the uptodate flag, so reuse bh is invalid. Fix this by reverting the fatent only if got the error on mirror FAT. Link: https://lore.kernel.org/87ik4yz9fv.fsf_-_@mail.parknet.co.jp Fixes: 64d9183203ee ("fat: restore original value when fat_ent_write failed") Signed-off-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Reported-by: syzbot+e64c6472a3d96a75172a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e64c6472a3d96a75172a Reported-by: syzbot+26461e903494e689c24f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=26461e903494e689c24f Cc: Yemu Lu Cc: Ren Wei Cc: Yuan Tan Cc: Yifan Wu Cc: Juefei Pu Cc: Xin Liu Cc: Signed-off-by: Sasha Levin --- fs/fat/fat.h | 2 +- fs/fat/fatent.c | 21 ++++++++++++++++++--- fs/fat/file.c | 3 ++- fs/fat/misc.c | 6 ++---- 4 files changed, 23 insertions(+), 9 deletions(-) diff --git a/fs/fat/fat.h b/fs/fat/fat.h index d3e426de5f016..6748dea6cd216 100644 --- a/fs/fat/fat.h +++ b/fs/fat/fat.h @@ -389,7 +389,7 @@ extern void fat_ent_access_init(struct super_block *sb); extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent, int entry); extern int fat_ent_write(struct inode *inode, struct fat_entry *fatent, - int new, int wait); + int new, int old, int wait); extern int fat_alloc_clusters(struct inode *inode, int *cluster, int nr_cluster); extern int fat_free_clusters(struct inode *inode, int cluster); diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c index a7061c2ad8e4d..515bc0cfc64f1 100644 --- a/fs/fat/fatent.c +++ b/fs/fat/fatent.c @@ -408,7 +408,7 @@ static int fat_mirror_bhs(struct super_block *sb, struct buffer_head **bhs, } int fat_ent_write(struct inode *inode, struct fat_entry *fatent, - int new, int wait) + int new, int old, int wait) { struct super_block *sb = inode->i_sb; const struct fatent_operations *ops = MSDOS_SB(sb)->fatent_ops; @@ -417,10 +417,25 @@ int fat_ent_write(struct inode *inode, struct fat_entry *fatent, ops->ent_put(fatent, new); if (wait) { err = fat_sync_bhs(fatent->bhs, fatent->nr_bhs); - if (err) + if (err) { + /* + * bhs are not uptodate after I/O error. So we + * can't simply re-dirty to revert. And it + * would not have value to write again on I/O + * error. + */ return err; + } } - return fat_mirror_bhs(sb, fatent->bhs, fatent->nr_bhs); + + err = fat_mirror_bhs(sb, fatent->bhs, fatent->nr_bhs); + if (err) { + /* Try to revert if got the error on mirror FAT */ + ops->ent_put(fatent, old); + if (wait) + fat_sync_bhs(fatent->bhs, fatent->nr_bhs); + } + return err; } static inline int fat_ent_next(struct msdos_sb_info *sbi, diff --git a/fs/fat/file.c b/fs/fat/file.c index 4fc49a614fb8f..ca2f9db34da5c 100644 --- a/fs/fat/file.c +++ b/fs/fat/file.c @@ -360,7 +360,8 @@ static int fat_free(struct inode *inode, int skip) __func__, MSDOS_I(inode)->i_pos); ret = -EIO; } else if (ret > 0) { - err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, wait); + err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, ret, + wait); if (err) ret = err; } diff --git a/fs/fat/misc.c b/fs/fat/misc.c index 5c45603bf77ea..c0bc4356eded3 100644 --- a/fs/fat/misc.c +++ b/fs/fat/misc.c @@ -133,11 +133,9 @@ int fat_chain_add(struct inode *inode, int new_dclus, int nr_cluster) ret = fat_ent_read(inode, &fatent, last); if (ret >= 0) { int wait = inode_needs_sync(inode); - int old = ret; - ret = fat_ent_write(inode, &fatent, new_dclus, wait); - if (ret < 0) - fat_ent_write(inode, &fatent, old, wait); + ret = fat_ent_write(inode, &fatent, new_dclus, ret, + wait); fatent_brelse(&fatent); } if (ret < 0) -- 2.53.0