kevin/linux
1
Fork 0
Code

nilfs2: handle inconsistent state in nilfs_btnode_create_block()

Browse Source 
Syzbot reported that a buffer state inconsistency was detected in
nilfs_btnode_create_block(), triggering a kernel bug.

It is not appropriate to treat this inconsistency as a bug; it can occur
if the argument block address (the buffer index of the newly created
block) is a virtual block number and has been reallocated due to
corruption of the bitmap used to manage its allocation state.

So, modify nilfs_btnode_create_block() and its callers to treat it as a
possible filesystem error, rather than triggering a kernel bug.

Link: https://lkml.kernel.org/r/20240725052007.4562-1-konishi.ryusuke@gmail.com
Fixes: a60be987d4 ("nilfs2: B-tree node cache")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+89cc4f2324ed37988b60@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=89cc4f2324ed37988b60
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
Ryusuke Konishi 2024-07-25 14:20:07 +09:00 committed by Andrew Morton
parent f556acc2fa
commit 4811f7af60
2 changed files with 22 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
fs/nilfs2/btnode.c
View File

@ -51,12 +51,21 @@ nilfs_btnode_create_block(struct address_space *btnc, __u64 blocknr)
bh = nilfs_grab_buffer(inode, btnc, blocknr, BIT(BH_NILFS_Node)); bh = nilfs_grab_buffer(inode, btnc, blocknr, BIT(BH_NILFS_Node));
if (unlikely(!bh)) if (unlikely(!bh))
return NULL; return ERR_PTR(-ENOMEM);
if (unlikely(buffer_mapped(bh) || buffer_uptodate(bh) || if (unlikely(buffer_mapped(bh) || buffer_uptodate(bh) ||
buffer_dirty(bh))) { buffer_dirty(bh))) {
brelse(bh); /*
BUG(); * The block buffer at the specified new address was already
* in use. This can happen if it is a virtual block number
* and has been reallocated due to corruption of the bitmap
* used to manage its allocation state (if not, the buffer
* clearing of an abandoned b-tree node is missing somewhere).
*/
nilfs_error(inode->i_sb,
"state inconsistency probably due to duplicate use of b-tree node block address %llu (ino=%lu)",
(unsigned long long)blocknr, inode->i_ino);
goto failed;
} }
memset(bh->b_data, 0, i_blocksize(inode)); memset(bh->b_data, 0, i_blocksize(inode));
bh->b_bdev = inode->i_sb->s_bdev; bh->b_bdev = inode->i_sb->s_bdev;
@ -67,6 +76,12 @@ nilfs_btnode_create_block(struct address_space *btnc, __u64 blocknr)
folio_unlock(bh->b_folio); folio_unlock(bh->b_folio);
folio_put(bh->b_folio); folio_put(bh->b_folio);
return bh; return bh;
failed:
folio_unlock(bh->b_folio);
folio_put(bh->b_folio);
brelse(bh);
return ERR_PTR(-EIO);
} }
int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr, int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
@ -217,8 +232,8 @@ retry:
} }
nbh = nilfs_btnode_create_block(btnc, newkey); nbh = nilfs_btnode_create_block(btnc, newkey);
if (!nbh) if (IS_ERR(nbh))
return -ENOMEM; return PTR_ERR(nbh);
BUG_ON(nbh == obh); BUG_ON(nbh == obh);
ctxt->newbh = nbh; ctxt->newbh = nbh;

4
fs/nilfs2/btree.c
View File

@ -63,8 +63,8 @@ static int nilfs_btree_get_new_block(const struct nilfs_bmap *btree,
struct buffer_head *bh; struct buffer_head *bh;
bh = nilfs_btnode_create_block(btnc, ptr); bh = nilfs_btnode_create_block(btnc, ptr);
if (!bh) if (IS_ERR(bh))
return -ENOMEM; return PTR_ERR(bh);
set_buffer_nilfs_volatile(bh); set_buffer_nilfs_volatile(bh);
*bhp = bh; *bhp = bh;