From: Frank Sorenson <sorenson@redhat.com> mainline inclusion from mainline-v7.3-rc1 commit c510edb9734af1c274d18f4f31a471a166bbc7e8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18925 CVE: CVE-2026-89642 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- cifs_setsize() calls truncate_pagecache() but skips pagecache_isize_extended() on extension. truncate_setsize() shows the correct pattern: i_size_write(inode, newsize); if (newsize > oldsize) pagecache_isize_extended(inode, oldsize, newsize); truncate_pagecache(inode, newsize); pagecache_isize_extended() zeroes the tail of the page straddling old EOF. Without it, dirty bytes in that region can be written back to the server, exposing stale data in the newly extended range. Cc: stable@vger.kernel.org Cc: David Howells <dhowells@redhat.com> Signed-off-by: Frank Sorenson <sorenson@redhat.com> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Paulo Alcantara <pc@manguebit.org> Conflicts: fs/cifs/inode.c fs/smb/client/smb2ops.c [Commit c510edb9734a touched fs/smb/client/inode.c which in this tree is fs/cifs/inode.c. This tree's cifs_setsize() lacks old_size, i_blocks clamping and inode_set_mtime_to_ts(), so only add a local old_size = i_size_read(inode) and the pagecache_isize_extended() call while keeping the existing cifs_i->time reset. Compiled objects skipped: upstream path fs/smb/client/inode.c does not exist in this tree. Add lock in smb3_simple_falloc] Signed-off-by: Cai Xinchen <caixinchen1@huawei.com> --- fs/smb/client/inode.c | 4 ++++ fs/smb/client/smb2ops.c | 3 +++ 2 files changed, 7 insertions(+) diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index 71154a0f51c4..d964a1f1e3d9 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -2907,13 +2907,17 @@ int cifs_truncate_page(struct address_space *mapping, loff_t from) void cifs_setsize(struct inode *inode, loff_t offset) { struct cifsInodeInfo *cifs_i = CIFS_I(inode); + loff_t old_size; spin_lock(&inode->i_lock); + old_size = i_size_read(inode); i_size_write(inode, offset); spin_unlock(&inode->i_lock); /* Cached inode must be refreshed on truncate */ cifs_i->time = 0; + if (offset > old_size) + pagecache_isize_extended(inode, old_size, offset); truncate_pagecache(inode, offset); } diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 5e2ae2d95398..296dda29dca3 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -3538,6 +3538,8 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon, return rc; } + inode_lock(inode); + /* * Extending the file */ @@ -3628,6 +3630,7 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon, rc = 0; out: + inode_unlock(inode); if (rc) trace_smb3_falloc_err(xid, cfile->fid.persistent_fid, tcon->tid, tcon->ses->Suid, off, len, rc); -- 2.18.0.huawei.25