Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 19cce462 authored by Ryusuke Konishi's avatar Ryusuke Konishi Committed by Greg Kroah-Hartman
Browse files

nilfs2: handle inconsistent state in nilfs_btnode_create_block() 

commit 4811f7af6090e8f5a398fbdd766f903ef6c0d787 upstream.

Syzbot reported that a buffer state inconsistency was detected in
nilfs_btnode_create_block(), triggering a kernel bug.

It is not appropriate to treat this inconsistency as a bug; it can occur
if the argument block address (the buffer index of the newly created
block) is a virtual block number and has been reallocated due to
corruption of the bitmap used to manage its allocation state.

So, modify nilfs_btnode_create_block() and its callers to treat it as a
possible filesystem error, rather than triggering a kernel bug.

Link: https://lkml.kernel.org/r/20240725052007.4562-1-konishi.ryusuke@gmail.com


Fixes: a60be987 ("nilfs2: B-tree node cache")
Signed-off-by: default avatarRyusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: default avatar <syzbot+89cc4f2324ed37988b60@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=89cc4f2324ed37988b60


Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8010e074

fs/nilfs2/btnode.c

+20 −5
Original line number Original line Diff line number Diff line
@@ -51,12 +51,21 @@ nilfs_btnode_create_block(struct address_space *btnc, __u64 blocknr) 




	bh = nilfs_grab_buffer(inode, btnc, blocknr, BIT(BH_NILFS_Node));

	bh = nilfs_grab_buffer(inode, btnc, blocknr, BIT(BH_NILFS_Node));

	if (unlikely(!bh))

	if (unlikely(!bh))

		return NULL;

		return ERR_PTR(-ENOMEM);





	if (unlikely(buffer_mapped(bh) || buffer_uptodate(bh) ||

	if (unlikely(buffer_mapped(bh) || buffer_uptodate(bh) ||

		     buffer_dirty(bh))) {

		     buffer_dirty(bh))) {

		brelse(bh);

		/*

		BUG();

		 * The block buffer at the specified new address was already

		 * in use.  This can happen if it is a virtual block number

		 * and has been reallocated due to corruption of the bitmap

		 * used to manage its allocation state (if not, the buffer

		 * clearing of an abandoned b-tree node is missing somewhere).

		 */

		nilfs_error(inode->i_sb,

			    "state inconsistency probably due to duplicate use of b-tree node block address %llu (ino=%lu)",

			    (unsigned long long)blocknr, inode->i_ino);

		goto failed;

	}

	}

	memset(bh->b_data, 0, i_blocksize(inode));

	memset(bh->b_data, 0, i_blocksize(inode));

	bh->b_bdev = inode->i_sb->s_bdev;

	bh->b_bdev = inode->i_sb->s_bdev;
@@ -67,6 +76,12 @@ nilfs_btnode_create_block(struct address_space *btnc, __u64 blocknr) 
	unlock_page(bh->b_page);

	unlock_page(bh->b_page);

	put_page(bh->b_page);

	put_page(bh->b_page);

	return bh;

	return bh;



failed:

	unlock_page(bh->b_page);

	put_page(bh->b_page);

	brelse(bh);

	return ERR_PTR(-EIO);

}

}





int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,

int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
@@ -224,8 +239,8 @@ int nilfs_btnode_prepare_change_key(struct address_space *btnc, 
	}

	}





	nbh = nilfs_btnode_create_block(btnc, newkey);

	nbh = nilfs_btnode_create_block(btnc, newkey);

	if (!nbh)

	if (IS_ERR(nbh))

		return -ENOMEM;

		return PTR_ERR(nbh);





	BUG_ON(nbh == obh);

	BUG_ON(nbh == obh);

	ctxt->newbh = nbh;

	ctxt->newbh = nbh;

fs/nilfs2/btree.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -63,8 +63,8 @@ static int nilfs_btree_get_new_block(const struct nilfs_bmap *btree, 
	struct buffer_head *bh;

	struct buffer_head *bh;





	bh = nilfs_btnode_create_block(btnc, ptr);

	bh = nilfs_btnode_create_block(btnc, ptr);

	if (!bh)

	if (IS_ERR(bh))

		return -ENOMEM;

		return PTR_ERR(bh);





	set_buffer_nilfs_volatile(bh);

	set_buffer_nilfs_volatile(bh);

	*bhp = bh;

	*bhp = bh;