simple_write_end() updates i_size to pos + copied even when copied is zero. A failed buffered write past EOF can therefore extend a ramfs file without writing any data. Since prefaulting was moved to the slow write path, this is reproducible with a one-byte pwrite() at offset 4096 into an empty ramfs file using an unreadable source buffer. The call fails with EFAULT but leaves the file size at 4096. generic_perform_write() calls ->write_end() with copied == 0 before trying to fault in the source buffer. Only extend i_size when data was copied. Keep the existing folio handling so that zero-progress retries and successful writes retain their current behavior. Fixes: 665575cff098 ("filemap: move prefaulting out of hot write path") Cc: stable@vger.kernel.org Signed-off-by: Hungyu Lin --- fs/libfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/libfs.c b/fs/libfs.c index 8e2cc627bc7f..d889a4a14f41 100644 --- a/fs/libfs.c +++ b/fs/libfs.c @@ -1007,7 +1007,7 @@ static int simple_write_end(const struct kiocb *iocb, * No need to use i_size_read() here, the i_size * cannot change under us because we hold the i_rwsem. */ - if (last_pos > inode->i_size) + if (copied && last_pos > inode->i_size) i_size_write(inode, last_pos); folio_mark_dirty(folio); -- 2.43.0