Configfs binary attributes buffer write data and submit the final buffer
on release.  The write path sets write_in_progress before it knows
whether the current write can be accepted.

If the first write fails before any data is copied, for example because
the write exceeds cb_max_size or the buffer allocation fails, release still
treats the file as having a pending binary write and calls the attribute
write callback with the current buffer state.  For ACPI configfs, an
oversized first write to the aml attribute can therefore fail with -EFBIG
and then oops on close when acpi_table_aml_write() is called with a NULL
buffer.

Only mark the binary attribute as having a write in progress after data
has actually been copied into the buffer.

Fixes: 03607ace807b ("configfs: implement binary attributes")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
---
 fs/configfs/file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index a48cece775a3..c55634931c05 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -249,7 +249,6 @@ static ssize_t configfs_bin_write_iter(struct kiocb *iocb,
 		len = -ETXTBSY;
 		goto out;
 	}
-	buffer->write_in_progress = true;
 
 	/* buffer grows? */
 	end_offset = iocb->ki_pos + iov_iter_count(from);
@@ -281,6 +280,8 @@ static ssize_t configfs_bin_write_iter(struct kiocb *iocb,
 
 	len = copy_from_iter(buffer->bin_buffer + iocb->ki_pos,
 			     buffer->bin_buffer_size - iocb->ki_pos, from);
+	if (len > 0)
+		buffer->write_in_progress = true;
 	iocb->ki_pos += len;
 out:
 	mutex_unlock(&buffer->mutex);
-- 
2.51.0

On Fri, Aug 21, 2026 at 03:33:41PM +0800, Yichong Chen wrote:
> Configfs binary attributes buffer write data and submit the final buffer
> on release.  The write path sets write_in_progress before it knows
> whether the current write can be accepted.
> 
> If the first write fails before any data is copied, for example because
> the write exceeds cb_max_size or the buffer allocation fails, release still
> treats the file as having a pending binary write and calls the attribute
> write callback with the current buffer state.  For ACPI configfs, an
> oversized first write to the aml attribute can therefore fail with -EFBIG
> and then oops on close when acpi_table_aml_write() is called with a NULL
> buffer.
> 
> Only mark the binary attribute as having a write in progress after data
> has actually been copied into the buffer.
> 
> Fixes: 03607ace807b ("configfs: implement binary attributes")
> Signed-off-by: Yichong Chen <chenyichong@uniontech.com>

Reviewed-by: Breno Leitao <leitao@debian.org>