For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: fix race in ext4_write_inline_data_end() by making it defensive
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
Replace BUG_ON(!ext4_has_inline_data(inode)) with a defensive check in
ext4_write_inline_data_end(). This handles the race condition where a file
can be converted from inline to block storage by concurrent paths while a
write completion is in flight.
Multiple inline-to-block conversion paths exist and use different locking
mechanisms (ext4_convert_inline_data_nolock uses i_data_sem, while
ext4_convert_inline_data_to_extent and ext4_da_convert_inline_data_to_extent
use xattr_sem). A write that began on an inline file can reach completion
after the file has been converted to blocks by one of these paths.
Instead of crashing with BUG_ON, gracefully fall back to block_write_end()
when the file has already been converted. The data is already in blocks at
this point, so the fallback is correct.
Reported-by: syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=293a57918b36cfae3d48
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inline.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 8045e4ff270c..0a5404fe5bc5 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -812,7 +812,10 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
goto out;
}
ext4_write_lock_xattr(inode, &no_expand);
- BUG_ON(!ext4_has_inline_data(inode));
+ /* File may have been converted to block storage by concurrent path */
+ if (!ext4_has_inline_data(inode)) {
+ return block_write_end(pos, len, copied, folio);
+ }
/*
* ei->i_inline_off may have changed since
--
2.43.0