From c7034e0bcb087754317d058b1149bb53e0a13213 Mon Sep 17 00:00:00 2001 From: Namjae Jeon Date: Fri, 22 May 2026 10:00:00 +0900 Subject: [PATCH] exfat: serialize truncate against in-flight DIO exfat_setattr() did not call inode_dio_wait() before performing a size change, leaving a window where a concurrent in-flight DIO write could be operating on clusters that the truncate is about to free. Add inode_dio_wait() before the truncate_setsize()/exfat_truncate() sequence so that any in-flight DIO completes before cluster freeing begins. Signed-off-by: Namjae Jeon --- fs/exfat/file.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/exfat/file.c b/fs/exfat/file.c index c5ff2a97a465..5fc13378d35f 100644 --- a/fs/exfat/file.c +++ b/fs/exfat/file.c @@ -406,6 +406,12 @@ int exfat_setattr(struct mnt_idmap *idmap, struct dentry *dentry, exfat_truncate_inode_atime(inode); if (attr->ia_valid & ATTR_SIZE) { + /* + * Wait for any in-flight DIO to finish before truncating to + * prevent a concurrent DIO from writing to clusters that are + * about to be freed. + */ + inode_dio_wait(inode); down_write(&EXFAT_I(inode)->truncate_lock); truncate_setsize(inode, attr->ia_size);