The cached ei->i_inline_size can become stale between the initial size
check and when ext4_update_inline_data()/ext4_create_inline_data() use
it. Although ext4_get_max_inline_size() reads the correct value at the
time of the check, concurrent xattr operations can modify i_inline_size
before ext4_write_lock_xattr() is acquired.

This causes ext4_update_inline_data() and ext4_create_inline_data() to
work with stale capacity values, leading to a BUG_ON() crash in
ext4_write_inline_data():

  kernel BUG at fs/ext4/inline.c:1331!
  BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);

The race window:
1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)
2. Size check passes for 50-byte write
3. [Another thread adds xattr, i_inline_size changes to 40]
4. ext4_write_lock_xattr() acquires lock
5. ext4_update_inline_data() uses stale i_inline_size = 60
6. Attempts to write 50 bytes but only 40 bytes actually available
7. BUG_ON() triggers

Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock()
immediately after acquiring xattr_sem. This ensures ext4_update_inline_data()
and ext4_create_inline_data() work with current values that are protected
from concurrent modifications.

This is similar to commit a54c4613dac1 ("ext4: fix race writing to an
inline_data file while its xattrs are changing") which fixed i_inline_off
staleness. This patch addresses the related i_inline_size staleness issue.

Reported-by: syzbot+f3185be57d7e8dda32b8@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=f3185be57d7e8dda32b8
Cc: stable@kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
Changes in v2:
- Simplified to single-line fix (refresh i_inline_size after taking lock)
- The refresh protects ext4_update_inline_data()/ext4_create_inline_data()
  from using stale i_inline_size that may have changed between the initial
  size check and lock acquisition
- Follows same pattern as commit a54c4613dac1 for consistency
---
 fs/ext4/inline.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 1b094a4f3866..b48c7dbe76a2 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -418,7 +418,12 @@ static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode,
 		return -ENOSPC;
 
 	ext4_write_lock_xattr(inode, &no_expand);
-
+	/*
+	 * ei->i_inline_size may have changed since the initial check
+	 * if other xattrs were added. Recalculate to ensure
+	 * ext4_update_inline_data() validates against current capacity.
+	 */
+	(void) ext4_find_inline_data_nolock(inode);
 	if (ei->i_inline_off)
 		ret = ext4_update_inline_data(handle, inode, len);
 	else
-- 
2.43.0

On Mon, 20 Oct 2025 11:39:36 +0530, Deepanshu Kartikey wrote:
> The cached ei->i_inline_size can become stale between the initial size
> check and when ext4_update_inline_data()/ext4_create_inline_data() use
> it. Although ext4_get_max_inline_size() reads the correct value at the
> time of the check, concurrent xattr operations can modify i_inline_size
> before ext4_write_lock_xattr() is acquired.
> 
> This causes ext4_update_inline_data() and ext4_create_inline_data() to
> work with stale capacity values, leading to a BUG_ON() crash in
> ext4_write_inline_data():
> 
> [...]

Applied, thanks!

[1/1] ext4: refresh inline data size before write operations
      commit: 892e1cf17555735e9d021ab036c36bc7b58b0e3b

Best regards,
-- 
Theodore Ts'o <tytso@mit.edu>

Hi Theodore and ext4 maintainers,

I submitted this patch on October 20th to fix a race condition in
inline data handling that causes BUG_ON crashes:

https://lore.kernel.org/linux-ext4/20251020060936.474314-1-kartikey406@gmail.com/T/#u

I wanted to gently ping to see if there are any concerns or if any
changes are needed. I understand maintainers are busy and happy to
wait, just wanted to ensure the patch didn't get lost.
The patch addresses a similar issue to commit a54c4613dac1 by
refreshing i_inline_size after taking the xattr lock.

Thank you for your time!

Best regards,
Deepanshu Kartikey

Hi,

Following up on my patch from October 20th (pinged on Oct 30th):


Patch: https://lore.kernel.org/linux-ext4/20251020060936.474314-1-kartikey406@gmail.com/T/#u

Bug:  https://syzkaller.appspot.com/bug?extid=f3185be57d7e8dda32b8

This fixes a BUG_ON crash by refreshing i_inline_size after taking
xattr_sem, similar to commit a54c4613dac1.

Any feedback would be appreciated! Happy to make changes if needed.

Thanks,
Deepanshu Kartikey