I verified this bug and reviewed the patch submitted to linux-fsdevel by Kentaro Shiomi.
The root cause is clear: in fs/vboxsf/file.c, vboxsf_write_end() initialises 'nwritten = len' instead of 'copied'. When writing from un- faulted pages (like direct mmap or shared memory used by virtiofsd), copy_page_from_iter_atomic() copies 0 bytes. Because vboxsf_write_end() reports status = len back to VFS, generic_perform_write() thinks the data was written, never calls fault_in_iov_iter_readable(), and enters an endless loop filling the file with zeroes. I tested the patch logic against the Ubuntu kernel trees: 1. Resolute (7.0 / master): Uses the folio write_end signature. 2. Noble 24.04 LTS (6.8): Uses the page write_end signature. 3. Jammy 22.04 LTS (5.15): Same page write_end signature. The patch applies and builds cleanly with zero warnings. I updated the bug description above with the formal SRU justification and a minimal Python reproducer to help the kernel team track this for the next SRU cycle. I am also attaching the DEP-3 formatted patches for both Resolute and Noble. ** Patch added: "DEP-3 patch for Ubuntu 26.04 Resolute (Linux 7.0 / folio write_end)" https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167772/+attachment/6001322/+files/lp2167772_vboxsf_resolute_7.0.patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167772 Title: vboxsf: endless write loop and data corruption on short copy To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2167772/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
