ext4: fix i_disksize exceeding i_size problem in paritally written case

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix i_disksize exceeding i_size problem in paritally written case

It is possible for i_disksize can exceed i_size, triggering a warning.

generic_perform_write

copied = iov_iter_copy_from_user_atomic(len) // copied < len

ext4_da_write_end

| ext4_update_i_disksize

| new_i_size = pos + copied;

| WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize

| generic_write_end

| copied = block_write_end(copied, len) // copied = 0

| if (unlikely(copied < len))

| if (!PageUptodate(page))

| copied = 0;

| if (pos + copied > inode->i_size) // return false

if (unlikely(copied == 0))

goto again;

if (unlikely(iov_iter_fault_in_readable(i, bytes))) {

status = -EFAULT;

break;

}

We get i_disksize greater than i_size here, which could trigger WARNING

check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio:

ext4_dio_write_iter

iomap_dio_rw

__iomap_dio_rw // return err, length is not aligned to 512

ext4_handle_inode_extension

WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops

WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319

CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2

RIP: 0010:ext4_file_write_iter+0xbc7

Call Trace:

vfs_write+0x3b1

ksys_write+0x77

do_syscall_64+0x39

Fix it by updating 'copied' value before updating i_disksize just like

ext4_write_inline_data_end() does.

A reproducer can be found in the buganizer link below.