[5.10,0/2] mm/truncate: fix issue in ext4_set_page_dirty()

Message

Roman Smirnov Jan. 11, 2024, 2:37 p.m. UTC

Syzkaller reports warning in ext4_set_page_dirty() in 5.10 stable 
releases. The problem can be fixed by the following patches 
which can be cleanly applied to the 5.10 branch.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Link: https://syzkaller.appspot.com/bug?extid=02f21431b65c214aa1d6

Matthew Wilcox (Oracle) (2):
  mm/truncate: Inline invalidate_complete_page() into its one caller
  mm/truncate: Replace page_mapped() call in invalidate_inode_page()

 kernel/futex/core.c |  2 +-
 mm/truncate.c       | 34 +++++++---------------------------
 2 files changed, 8 insertions(+), 28 deletions(-)

Comments

Matthew Wilcox Jan. 11, 2024, 3:31 p.m. UTC | #1

On Thu, Jan 11, 2024 at 02:37:45PM +0000, Roman Smirnov wrote:
> Syzkaller reports warning in ext4_set_page_dirty() in 5.10 stable 
> releases. The problem can be fixed by the following patches 
> which can be cleanly applied to the 5.10 branch.

I do not understand the crash, and I do not understand why this patch
would fix it.  Can you explain either?

> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
> 
> Link: https://syzkaller.appspot.com/bug?extid=02f21431b65c214aa1d6
> 
> Matthew Wilcox (Oracle) (2):
>   mm/truncate: Inline invalidate_complete_page() into its one caller
>   mm/truncate: Replace page_mapped() call in invalidate_inode_page()
> 
>  kernel/futex/core.c |  2 +-
>  mm/truncate.c       | 34 +++++++---------------------------
>  2 files changed, 8 insertions(+), 28 deletions(-)
> 
> -- 
> 2.34.1
>

Roman Smirnov Jan. 12, 2024, 1:40 p.m. UTC | #2

On Thu, 11 Jan 2024 15:31:12 +0000, Matthew Wilcox wrote:

> I do not understand the crash, and I do not understand why this patch
> would fix it.  Can you explain either?

The WARNING appears in the following location:
https://elixir.bootlin.com/linux/v5.10.205/source/fs/ext4/inode.c#L3693

Reverse bisection pointed at the 2nd patch as a fix, but after 
backporting this patch to 5.10 branch I still hit the WARNING.
I noticed that there was some missing code compared to the original
patch:

if (folio_has_private(folio) && !filemap_release_folio(folio, 0))
         return 0;

Then I found a patch with this code before using folio, applied it,
and tests showed the WARNING disappeared. I also used the linux test
project to make sure nothing was broken. I'll try to dig a little
deeper and explain the crash.

Thanks for the reply.