Commit c4a09fda authored Feb 04, 2024 by Ryusuke Konishi Committed by Greg Kroah-Hartman Feb 23, 2024

nilfs2: fix potential bug in end_buffer_async_write

commit 5bc09b397cbf1221f8a8aacb1152650c9195b02b upstream.

According to a syzbot report, end_buffer_async_write(), which handles the
completion of block device writes, may detect abnormal condition of the
buffer async_write flag and cause a BUG_ON failure when using nilfs2.

Nilfs2 itself does not use end_buffer_async_write(). But, the async_write
flag is now used as a marker by commit 7f42ec39 ("nilfs2: fix issue
with race condition of competition between segments for dirty blocks") as
a means of resolving double list insertion of dirty blocks in
nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the
resulting crash.

This modification is safe as long as it is used for file data and b-tree
node blocks where the page caches are independent. However, it was
irrelevant and redundant to also introduce async_write for segment summary
and super root blocks that share buffers with the backing device. This
led to the possibility that the BUG_ON check in end_buffer_async_write
would fail as described above, if independent writebacks of the backing
device occurred in parallel.

The use of async_write for segment summary buffers has already been
removed in a previous change.

Fix this issue by removing the manipulation of the async_write flag for
the remaining super root block buffer.

Link: https://lkml.kernel.org/r/20240203161645.4992-1-konishi.ryusuke@gmail.com

Fixes: 7f42ec39 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: <syzbot+5c04210f7c7f897c1e7f@syzkaller.appspotmail.com>
Closes: https://lkml.kernel.org/r/00000000000019a97c05fd42f8c8@google.com

Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 3cd13987

fs/nilfs2/segment.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -1702,7 +1702,6 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)

		list_for_each_entry(bh, &segbuf->sb_payload_buffers,
		b_assoc_buffers) {
		set_buffer_async_write(bh);
		if (bh == segbuf->sb_super_root) {
		if (bh->b_page != bd_page) {
		lock_page(bd_page);
		@@ -1713,6 +1712,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
		}
		break;
		}
		set_buffer_async_write(bh);
		if (bh->b_page != fs_page) {
		nilfs_begin_page_io(fs_page);
		fs_page = bh->b_page;
		@@ -1798,7 +1798,6 @@ static void nilfs_abort_logs(struct list_head *logs, int err)

		list_for_each_entry(bh, &segbuf->sb_payload_buffers,
		b_assoc_buffers) {
		clear_buffer_async_write(bh);
		if (bh == segbuf->sb_super_root) {
		clear_buffer_uptodate(bh);
		if (bh->b_page != bd_page) {
		@@ -1807,6 +1806,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
		}
		break;
		}
		clear_buffer_async_write(bh);
		if (bh->b_page != fs_page) {
		nilfs_end_page_io(fs_page, err);
		fs_page = bh->b_page;
		@@ -1894,8 +1894,9 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
		BIT(BH_Delay) \| BIT(BH_NILFS_Volatile) \|
		BIT(BH_NILFS_Redirected));

		set_mask_bits(&bh->b_state, clear_bits, set_bits);
		if (bh == segbuf->sb_super_root) {
		set_buffer_uptodate(bh);
		clear_buffer_dirty(bh);
		if (bh->b_page != bd_page) {
		end_page_writeback(bd_page);
		bd_page = bh->b_page;
		@@ -1903,6 +1904,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
		update_sr = true;
		break;
		}
		set_mask_bits(&bh->b_state, clear_bits, set_bits);
		if (bh->b_page != fs_page) {
		nilfs_end_page_io(fs_page, 0);
		fs_page = bh->b_page;