diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2023-08-29 01:47:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-11-08 16:11:02 +0300 |
| commit | 9eab5008db6c98273acaa0e0dde0fdb25848217e (patch) | |
| tree | b8ba762ca7287e2d0f7c2a673be9c28dbcddfdb5 /io_uring/rw.c | |
| parent | ed0ba37e7b9b2f9669d3ed0634356aef04ee0ef1 (diff) | |
| download | linux-9eab5008db6c98273acaa0e0dde0fdb25848217e.tar.xz | |
io_uring: kiocb_done() should *not* trust ->ki_pos if ->{read,write}_iter() failed
[ Upstream commit 1939316bf988f3e49a07d9c4dd6f660bf4daa53d ]
->ki_pos value is unreliable in such cases. For an obvious example,
consider O_DSYNC write - we feed the data to page cache and start IO,
then we make sure it's completed. Update of ->ki_pos is dealt with
by the first part; failure in the second ends up with negative value
returned _and_ ->ki_pos left advanced as if sync had been successful.
In the same situation write(2) does not advance the file position
at all.
Reviewed-by: Christian Brauner <brauner@kernel.org>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'io_uring/rw.c')
| -rw-r--r-- | io_uring/rw.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/io_uring/rw.c b/io_uring/rw.c index 0218fae12edd..0133db648d8e 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -326,7 +326,7 @@ static int kiocb_done(struct io_kiocb *req, ssize_t ret, struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); unsigned final_ret = io_fixup_rw_res(req, ret); - if (req->flags & REQ_F_CUR_POS) + if (ret >= 0 && req->flags & REQ_F_CUR_POS) req->file->f_pos = rw->kiocb.ki_pos; if (ret >= 0 && (rw->kiocb.ki_complete == io_complete_rw)) { if (!__io_complete_rw_common(req, ret)) { |