From: Paulo Alcantara <pc@manguebit.org> stable inclusion from stable-v6.6.160 commit 3df27277f8f95345d4a6c57367824bf1aefdbf66 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20573 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit da4fe97fb6c730d9c94a115c7bfa6f98e0d578d0 ] smb3_zero_range() removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data dirtied past EOF through an mmap - was never dropped and became visible as file content once the file was extended. Lower the discard boundary to the smaller of the zero-range offset and the old EOF. Fixes: 72c419d9b073 ("cifs: fix smb3_zero_range so it can expand the file-size when required") Reviewed-by: David Howells <dhowells@redhat.com> Reviewed-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Matthew Wilcox <willy@infradead.org> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com> Cc: Shyam Prasad N <sprasad@microsoft.com> Cc: Tom Talpey <tom@talpey.com> Cc: Bharath SM <bharathsm@microsoft.com> Cc: stable@vger.kernel.org [ sashal: Adjusted context due to the missing netfs_wait_for_outstanding_io() call. ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4@huawei.com> --- fs/smb/client/smb2ops.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 055fd4cbb215..a8636bda1c68 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -3287,8 +3287,13 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon, /* * We zero the range through ioctl, so we need remove the page caches * first, otherwise the data may be inconsistent with the server. + * + * Start at the old EOF when extending so the folio straddling it, which + * may hold data written past EOF through an mmap, is dropped too. */ - truncate_pagecache_range(inode, offset, offset + len - 1); + truncate_pagecache_range(inode, min(offset, + (unsigned long long)i_size_read(inode)), + offset + len - 1); /* if file not oplocked can't be sure whether asking to extend size */ rc = -EOPNOTSUPP; -- 2.52.0