linux-kernel - [PATCH v2 2/2] drm/i915: Fix incorrect error handling in shmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250822030651.28099-2-chentaotao@didiglobal.com>
Date: Fri, 22 Aug 2025 03:07:04 +0000
From: 陈涛涛 Taotao Chen <chentaotao@...iglobal.com>
To: "jani.nikula@...ux.intel.com" <jani.nikula@...ux.intel.com>,
	"joonas.lahtinen@...ux.intel.com" <joonas.lahtinen@...ux.intel.com>,
	"rodrigo.vivi@...el.com" <rodrigo.vivi@...el.com>, "tursulin@...ulin.net"
	<tursulin@...ulin.net>, "andi.shyti@...ux.intel.com"
	<andi.shyti@...ux.intel.com>
CC: "airlied@...il.com" <airlied@...il.com>, "daniel@...ll.ch"
	<daniel@...ll.ch>, "intel-gfx@...ts.freedesktop.org"
	<intel-gfx@...ts.freedesktop.org>, "dri-devel@...ts.freedesktop.org"
	<dri-devel@...ts.freedesktop.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "chentao325@...com" <chentao325@...com>,
	陈涛涛 Taotao Chen <chentaotao@...iglobal.com>
Subject: [PATCH v2 2/2] drm/i915: Fix incorrect error handling in
 shmem_pwrite()

From: Taotao Chen <chentaotao@...iglobal.com>

shmem_pwrite() currently checks for short writes before negative error
codes, which can overwrite real errors (e.g., -EFBIG) with -EIO.
Reorder the checks to return negative errors first, then handle short
writes.

Signed-off-by: Taotao Chen <chentaotao@...iglobal.com>
Reviewed-by: Andi Shyti <andi.shyti@...ux.intel.com>
---
v2:
 - Drop Fixes tag
 - Add Reviewed-by from Andi
 - Add code comments (suggested by Rodrigo)

 drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
index b9dae15c1d16..26dda55a07ff 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
@@ -441,11 +441,20 @@ shmem_pwrite(struct drm_i915_gem_object *obj,
 	written = file->f_op->write_iter(&kiocb, &iter);
 	BUG_ON(written == -EIOCBQUEUED);
 
-	if (written != size)
-		return -EIO;
-
+	/*
+	 * First, check if write_iter returned a negative error.
+	 * If the write failed, return the real error code immediately.
+	 * This prevents it from being overwritten by the short write check below.
+	 */
 	if (written < 0)
 		return written;
+	/*
+	 * Check for a short write (written bytes != requested size).
+	 * Even if some data was written, return -EIO to indicate that the
+	 * write was not fully completed.
+	 */
+	if (written != size)
+		return -EIO;
 
 	return 0;
 }
-- 
2.34.1