From 705a3fd3bac167f1dabe3d3bba46cd484c5528dd Mon Sep 17 00:00:00 2001 From: Zhang Yi Date: Tue, 14 Jul 2026 16:00:38 +0800 Subject: [PATCH] ext4: check return value of ext4_get_block() in ext4_load_tail_bh() ext4_load_tail_bh() ignores the return value of ext4_get_block(), so an I/O or allocation failure is silently discarded. buffer_mapped(bh) stays false and the function returns NULL, which callers such as ext4_block_do_zero_range() treat as "nothing to do" and return success. This can mask real failures during zero-range, truncate, or punch-hole operations, potentially exposing stale data if the block was not actually a hole and needed zeroing. So propagate the error to the callers. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260714080044.4038124-4-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o --- fs/ext4/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 94913a75930f..67d8bec55fb7 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -4080,7 +4080,9 @@ static struct buffer_head *ext4_load_tail_bh(struct inode *inode, loff_t from) } if (!buffer_mapped(bh)) { BUFFER_TRACE(bh, "unmapped"); - ext4_get_block(inode, iblock, bh, 0); + err = ext4_get_block(inode, iblock, bh, 0); + if (err < 0) + goto unlock; /* unmapped? It's a hole - nothing to do */ if (!buffer_mapped(bh)) { BUFFER_TRACE(bh, "still unmapped");