linux-kernel - Re: [PATCH v2 2/2] drm/i915: Fix incorrect error handling in shmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CALC8CXcSywKnQop1Xipcq1Lbtmpu94tc9Eq=ORjCzNCjkSTPVQ@mail.gmail.com>
Date: Thu, 2 Oct 2025 12:24:30 -0400
From: ChaosEsque Team <chaosesqueteam@...il.com>
To: 陈涛涛 Taotao Chen <chentaotao@...iglobal.com>
Cc: "jani.nikula@...ux.intel.com" <jani.nikula@...ux.intel.com>, 
	"joonas.lahtinen@...ux.intel.com" <joonas.lahtinen@...ux.intel.com>, 
	"rodrigo.vivi@...el.com" <rodrigo.vivi@...el.com>, "tursulin@...ulin.net" <tursulin@...ulin.net>, 
	"andi.shyti@...ux.intel.com" <andi.shyti@...ux.intel.com>, "airlied@...il.com" <airlied@...il.com>, 
	"daniel@...ll.ch" <daniel@...ll.ch>, 
	"intel-gfx@...ts.freedesktop.org" <intel-gfx@...ts.freedesktop.org>, 
	"dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "chentao325@...com" <chentao325@...com>
Subject: Re: [PATCH v2 2/2] drm/i915: Fix incorrect error handling in shmem_pwrite()

Going to hit us with a katana, Taotao?

On Thu, Aug 21, 2025 at 11:11 PM 陈涛涛 Taotao Chen
<chentaotao@...iglobal.com> wrote:
>
> From: Taotao Chen <chentaotao@...iglobal.com>
>
> shmem_pwrite() currently checks for short writes before negative error
> codes, which can overwrite real errors (e.g., -EFBIG) with -EIO.
> Reorder the checks to return negative errors first, then handle short
> writes.
>
> Signed-off-by: Taotao Chen <chentaotao@...iglobal.com>
> Reviewed-by: Andi Shyti <andi.shyti@...ux.intel.com>
> ---
> v2:
>  - Drop Fixes tag
>  - Add Reviewed-by from Andi
>  - Add code comments (suggested by Rodrigo)
>
>  drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 15 ++++++++++++---
>  1 file changed, 12 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
> index b9dae15c1d16..26dda55a07ff 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
> @@ -441,11 +441,20 @@ shmem_pwrite(struct drm_i915_gem_object *obj,
>         written = file->f_op->write_iter(&kiocb, &iter);
>         BUG_ON(written == -EIOCBQUEUED);
>
> -       if (written != size)
> -               return -EIO;
> -
> +       /*
> +        * First, check if write_iter returned a negative error.
> +        * If the write failed, return the real error code immediately.
> +        * This prevents it from being overwritten by the short write check below.
> +        */
>         if (written < 0)
>                 return written;
> +       /*
> +        * Check for a short write (written bytes != requested size).
> +        * Even if some data was written, return -EIO to indicate that the
> +        * write was not fully completed.
> +        */
> +       if (written != size)
> +               return -EIO;
>
>         return 0;
>  }
> --
> 2.34.1