From: Namjae Jeon <linkinjeon@kernel.org>
Date: Fri, 22 May 2026 01:00:00 +0000 (+0900)
Subject: exfat: serialize truncate against in-flight DIO
X-Git-Tag: v7.2-rc1~89^2~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c7034e0bcb087754317d058b1149bb53e0a13213;p=thirdparty%2Fkernel%2Flinux.git

exfat: serialize truncate against in-flight DIO

exfat_setattr() did not call inode_dio_wait() before performing a size
change, leaving a window where a concurrent in-flight DIO write could be
operating on clusters that the truncate is about to free.

Add inode_dio_wait() before the truncate_setsize()/exfat_truncate()
sequence so that any in-flight DIO completes before cluster freeing
begins.

Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
---

diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index c5ff2a97a4658..5fc13378d35f7 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -406,6 +406,12 @@ int exfat_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
 	exfat_truncate_inode_atime(inode);
 
 	if (attr->ia_valid & ATTR_SIZE) {
+		/*
+		 * Wait for any in-flight DIO to finish before truncating to
+		 * prevent a concurrent DIO from writing to clusters that are
+		 * about to be freed.
+		 */
+		inode_dio_wait(inode);
 		down_write(&EXFAT_I(inode)->truncate_lock);
 		truncate_setsize(inode, attr->ia_size);