6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Frank Sorenson [ Upstream commit c510edb9734af1c274d18f4f31a471a166bbc7e8 ] cifs_setsize() calls truncate_pagecache() but skips pagecache_isize_extended() on extension. truncate_setsize() shows the correct pattern: i_size_write(inode, newsize); if (newsize > oldsize) pagecache_isize_extended(inode, oldsize, newsize); truncate_pagecache(inode, newsize); pagecache_isize_extended() zeroes the tail of the page straddling old EOF. Without it, dirty bytes in that region can be written back to the server, exposing stale data in the newly extended range. Cc: stable@vger.kernel.org Cc: David Howells Signed-off-by: Frank Sorenson Acked-by: Namjae Jeon Signed-off-by: Paulo Alcantara Signed-off-by: Sasha Levin --- fs/smb/client/inode.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index ebc3edf33d20e..ade7ecb3f350b 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -3030,7 +3030,10 @@ int cifs_fiemap(struct inode *inode, struct fiemap_extent_info *fei, u64 start, void cifs_setsize(struct inode *inode, loff_t offset) { + loff_t old_size; + spin_lock(&inode->i_lock); + old_size = i_size_read(inode); i_size_write(inode, offset); /* * Until we can query the server for actual allocation size, @@ -3039,6 +3042,8 @@ void cifs_setsize(struct inode *inode, loff_t offset) inode->i_blocks = CIFS_INO_BLOCKS(offset); spin_unlock(&inode->i_lock); inode_set_mtime_to_ts(inode, inode_set_ctime_current(inode)); + if (offset > old_size) + pagecache_isize_extended(inode, old_size, offset); truncate_pagecache(inode, offset); netfs_wait_for_outstanding_io(inode); fscache_resize_cookie(cifs_inode_cookie(inode), offset); -- 2.53.0