linux/fs/nilfs2
Ryusuke Konishi 5bc09b397c nilfs2: fix potential bug in end_buffer_async_write
According to a syzbot report, end_buffer_async_write(), which handles the
completion of block device writes, may detect abnormal condition of the
buffer async_write flag and cause a BUG_ON failure when using nilfs2.

Nilfs2 itself does not use end_buffer_async_write().  But, the async_write
flag is now used as a marker by commit 7f42ec3941 ("nilfs2: fix issue
with race condition of competition between segments for dirty blocks") as
a means of resolving double list insertion of dirty blocks in
nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the
resulting crash.

This modification is safe as long as it is used for file data and b-tree
node blocks where the page caches are independent.  However, it was
irrelevant and redundant to also introduce async_write for segment summary
and super root blocks that share buffers with the backing device.  This
led to the possibility that the BUG_ON check in end_buffer_async_write
would fail as described above, if independent writebacks of the backing
device occurred in parallel.

The use of async_write for segment summary buffers has already been
removed in a previous change.

Fix this issue by removing the manipulation of the async_write flag for
the remaining super root block buffer.

Link: https://lkml.kernel.org/r/20240203161645.4992-1-konishi.ryusuke@gmail.com
Fixes: 7f42ec3941 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+5c04210f7c7f897c1e7f@syzkaller.appspotmail.com
Closes: https://lkml.kernel.org/r/00000000000019a97c05fd42f8c8@google.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-02-07 21:20:37 -08:00
..
alloc.c nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse 2023-08-21 13:46:25 -07:00
alloc.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
bmap.c nilfs2: fix infinite loop in nilfs_mdt_get_block() 2023-05-06 10:10:07 -07:00
bmap.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
btnode.c nilfs2: convert nilfs_page_bug() to nilfs_folio_bug() 2023-12-10 17:21:48 -08:00
btnode.h fs/nilfs2: Use the enum req_op and blk_opf_t types 2022-07-14 12:14:33 -06:00
btree.c nilfs2: initialize "struct nilfs_binfo_dat"->bi_pad field 2023-04-05 18:06:23 -07:00
btree.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
cpfile.c nilfs2: cpfile: fix some kernel-doc warnings 2023-12-29 12:22:29 -08:00
cpfile.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
dat.c nilfs2: prevent WARNING in nilfs_dat_commit_end() 2023-02-02 22:50:10 -08:00
dat.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
dir.c nilfs2: convert nilfs_prepare_chunk() and nilfs_commit_chunk() to folios 2023-12-10 17:21:48 -08:00
direct.c nilfs2: initialize "struct nilfs_binfo_dat"->bi_pad field 2023-04-05 18:06:23 -07:00
direct.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
export.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
file.c nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() 2024-02-07 21:20:36 -08:00
gcinode.c nilfs2: convert nilfs_gccache_submit_read_data to use a folio 2023-12-10 17:21:29 -08:00
ifile.c nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
ifile.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
inode.c Quite a lot of kexec work this time around. Many singleton patches in 2024-01-09 11:46:20 -08:00
ioctl.c fs/nilfs2: use standard array-copy-function 2023-12-10 17:21:25 -08:00
Kconfig fs: add CONFIG_BUFFER_HEAD 2023-08-02 09:13:09 -06:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mdt.c nilfs2: convert nilfs_mdt_submit_block to use a folio 2023-12-10 17:21:29 -08:00
mdt.h nilfs2: fix lockdep warnings during disk space reclamation 2022-04-01 11:46:09 -07:00
namei.c misc cleanups (the part that hadn't been picked by individual fs trees) 2024-01-11 20:23:50 -08:00
nilfs.h nilfs2: convert nilfs_rename() to use folios 2023-12-10 17:21:47 -08:00
page.c nilfs2: convert nilfs_page_bug() to nilfs_folio_bug() 2023-12-10 17:21:48 -08:00
page.h nilfs2: convert nilfs_page_bug() to nilfs_folio_bug() 2023-12-10 17:21:48 -08:00
recovery.c nilfs2: fix data corruption in dsync block recovery for small block sizes 2024-02-07 21:20:34 -08:00
segbuf.c nilfs2: fix buffer corruption due to concurrent device reads 2023-06-19 13:19:33 -07:00
segbuf.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
segment.c nilfs2: fix potential bug in end_buffer_async_write 2024-02-07 21:20:37 -08:00
segment.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
sufile.c nilfs2: switch WARN_ONs to warning output in nilfs_sufile_do_free() 2023-12-20 15:02:58 -08:00
sufile.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
super.c nilfs2: simplify device handling 2023-11-18 14:59:24 +01:00
sysfs.c nilfs2: use default_groups in kobj_type 2021-12-29 10:53:48 +01:00
sysfs.h nilfs2: remove filenames from file comments 2021-11-09 10:02:52 -08:00
the_nilfs.c nilfs2: fix missing error check for sb_set_blocksize call 2023-12-06 16:12:48 -08:00
the_nilfs.h nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput 2023-08-04 13:03:43 -07:00