Re: [syzbot] [exfat?] kernel BUG in iov_iter_revert

[Namjae Jeon]

2024-01-17 1:19 GMT+09:00, syzbot
<syzbot+fd404f6b03a58e8bc403@xxxxxxxxxxxxxxxxxxxxxxxxx>:
> Hello,
Hi,
>
> syzbot found the following issue on:
>
> HEAD commit:    052d534373b7 Merge tag 'exfat-for-6.8-rc1' of
> git://git.ke..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=108ca8b3e80000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=7c8840a4a09eab8
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=fd404f6b03a58e8bc403
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for
> Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1558210be80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14d39debe80000

Thanks for your report!
Can you test if this change fix this issue ?

diff --git a/fs/exfat/inode.c b/fs/exfat/inode.c
index 522edcbb2ce4..65ac7b67c2da 100644
--- a/fs/exfat/inode.c
+++ b/fs/exfat/inode.c
@@ -501,7 +501,7 @@ static ssize_t exfat_direct_IO(struct kiocb *iocb,
struct iov_iter *iter)
 	struct inode *inode = mapping->host;
 	struct exfat_inode_info *ei = EXFAT_I(inode);
 	loff_t pos = iocb->ki_pos;
-	loff_t size = iocb->ki_pos + iov_iter_count(iter);
+	loff_t size = pos + iov_iter_count(iter);
 	int rw = iov_iter_rw(iter);
 	ssize_t ret;

@@ -525,11 +525,9 @@ static ssize_t exfat_direct_IO(struct kiocb
*iocb, struct iov_iter *iter)
 	 */
 	ret = blockdev_direct_IO(iocb, inode, iter, exfat_get_block);
 	if (ret < 0) {
-		if (rw == WRITE)
+		if (rw == WRITE && ret != -EIOCBQUEUED)
 			exfat_write_failed(mapping, size);
-
-		if (ret != -EIOCBQUEUED)
-			return ret;
+		return ret;
 	} else
 		size = pos + ret;

-- 
2.25.1