From patchwork Sat May 13 10:24:28 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ryusuke Konishi X-Patchwork-Id: 93502 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp5687997vqo; Sat, 13 May 2023 03:35:09 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7TvJMlaY5UsvfFWm/4oIccWdS5TL/35SwAkwi40m3bB+K4B+bfn3Jr2rIzYZtgrI33dJJL X-Received: by 2002:a05:6a20:a122:b0:103:ef39:a832 with SMTP id q34-20020a056a20a12200b00103ef39a832mr11037241pzk.23.1683974108845; Sat, 13 May 2023 03:35:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1683974108; cv=none; d=google.com; s=arc-20160816; b=e6PXcOS7kyOKmdweWK9sTBOJK9sutlKkQ2HfsG3+/S5xpfxeYUpWJppwBnTwn6aCAt YqWCnOqeOREQla1r/SEo64K9y7Eo3EedL/xa2kwT+qWsL1jtsZecR09FbocVZqsM5Ev7 M4c9IyPG6hMNgEMRgGszov8yA+IiOmpdSo17ZnD4IfPfwuI8jb4V8eLiC3zMliBbwUcV RlMYBFvz45IJamHRVLHvc9MD3pr5rL3LSay03J46WOkL8ZVhrfUPNCI58odM+EjzylH8 IqOOY5u2dBaS5cuj8r+nedguXmfy/cPxS9J4EsbJs/y3cdqlHAxM+dqmTRI1GYVmV7Aj M7QA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=tdWliSyw9Vs0a4+Mx5Ea0mS03ZFAZO0XAn6m7qo+Pro=; b=Ehh9RqbHOue73Ynxxd7ITFb7mOUYOOh4/59UvS55YRVhlk9dRfVHMfcbmiSQqk4egH LoCJIRt5k6B7H85pX1Y/BnD7pKi8X/cPN+9U5iS9Vo9LaxSeGh+BObA//Tda2evzfzC6 K7+V+LgfLveHGJm16IBPVy8CFrQWDbBAf/X1Pa8o10X94Uo0rh+vjNpIR/mHfKC1XfQk fqtnoy+7g5b2Lko/7YMvgCk3a6uJ103myOLOhPDMCwSXlkNooWwtWx9PNNgnfUyv27T+ AaOuGBmw3fU8SVd/wlMNeR2gcQwvOWrz5YSGODy7tmni48iYo/DAVXk0k4oIktVv8O7O riXQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=TYUf0yci; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id x1-20020aa79561000000b0063b8ab7f91csi11981046pfq.365.2023.05.13.03.34.56; Sat, 13 May 2023 03:35:08 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20221208 header.b=TYUf0yci; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237331AbjEMKYS (ORCPT + 99 others); Sat, 13 May 2023 06:24:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60548 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229653AbjEMKYQ (ORCPT ); Sat, 13 May 2023 06:24:16 -0400 Received: from mail-pl1-x62d.google.com (mail-pl1-x62d.google.com [IPv6:2607:f8b0:4864:20::62d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DCD6A1BF3; Sat, 13 May 2023 03:24:15 -0700 (PDT) Received: by mail-pl1-x62d.google.com with SMTP id d9443c01a7336-1aaf706768cso83531185ad.0; Sat, 13 May 2023 03:24:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1683973455; x=1686565455; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=tdWliSyw9Vs0a4+Mx5Ea0mS03ZFAZO0XAn6m7qo+Pro=; b=TYUf0yciahwHAoINMlmasYHsNIj0mB0vwA8sRRG+HcY+oJopfvY6iqibdm5kAMp8xZ VAOmON3bpEOSXqaTShgAQEZ1330E/h/aJbAWTNo6qwReBwPbhMIBPBJp6hxxVm413onX zeQoRP6rUV7uzyU53vXr2GkhozaGfQ3aqBMfCwdfCubhDJis+A0ZiNjN8+Iv1gc7BabQ wSE1o0qu9P96h1khnyfGgq2sa2EWxfHlmm9sru/jczengeor+hZXj0Ddtl5kjiPYxNVa UMpgGBpOTi7S3UDhk7DLOm40xPPECl2+QAfOisqQ4tSTyAKRU0aeles6EApESs/xhbW+ S5Pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683973455; x=1686565455; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=tdWliSyw9Vs0a4+Mx5Ea0mS03ZFAZO0XAn6m7qo+Pro=; b=Nj0/2epLWOruUlJCkI6QUsEg6d4iLG9W4xXMnH+yXZEZHwd9LYmJ5d7u4ZGxiwliae DsrH+VpGIm2KuAYmQM8bZIE13ihEebjWGbS+dq9TqymWtAqNNI/gA15YgSnY6yFkNz71 66GeClJNalZv4dEOzdp5+3yIRCH0LcjM9Wze+BRqTZs4V7CTDD52W7F9Yu/UJCIbo+Gr GGnUOuXaaBgMKya8VG2FI7LqfTN13G1pl9CPOPUXj6cMuT0zqRrwIQBEgk3uQMW+1NJD Ly1W7bK7KE+Qn9y+CptOkISbbD00D8ZOvrSSuTRy9VNGEzefsIm+90IPV9apqcdC6yOL 0AAw== X-Gm-Message-State: AC+VfDxAcaSBhnagE5f4neREiOvj/DVo0rTdLBd7arP3aXAGvMlMvPpv onwZ+P8OGoAIi6ozcKPTPoneLvloLEksAg== X-Received: by 2002:a17:903:2448:b0:1ac:3642:bff3 with SMTP id l8-20020a170903244800b001ac3642bff3mr35575521pls.38.1683973455158; Sat, 13 May 2023 03:24:15 -0700 (PDT) Received: from carrot.. (i220-108-176-245.s42.a014.ap.plala.or.jp. [220.108.176.245]) by smtp.gmail.com with ESMTPSA id d15-20020a170902cecf00b001a94a497b50sm9494784plg.20.2023.05.13.03.24.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 13 May 2023 03:24:13 -0700 (PDT) From: Ryusuke Konishi To: Andrew Morton Cc: linux-nilfs@vger.kernel.org, syzbot , syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org Subject: [PATCH] nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key() Date: Sat, 13 May 2023 19:24:28 +0900 Message-Id: <20230513102428.10223-1-konishi.ryusuke@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <000000000000d1d6c205ebc4d512@google.com> References: <000000000000d1d6c205ebc4d512@google.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765774835432907609?= X-GMAIL-MSGID: =?utf-8?q?1765774835432907609?= A syzbot fault injection test reported that nilfs_btnode_create_block, a helper function that allocates a new node block for b-trees, causes a kernel BUG for disk images where the file system block size is smaller than the page size. This was due to unexpected flags on the newly allocated buffer head, and it turned out to be because the buffer flags were not cleared by nilfs_btnode_abort_change_key() after an error occurred during a b-tree update operation and the buffer was later reused in that state. Fix this issue by using nilfs_btnode_delete() to abandon the unused preallocated buffer in nilfs_btnode_abort_change_key(). Signed-off-by: Ryusuke Konishi Reported-by: syzbot+b0a35a5c1f7e846d3b09@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/000000000000d1d6c205ebc4d512@google.com Tested-by: Ryusuke Konishi Cc: stable@vger.kernel.org --- fs/nilfs2/btnode.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c index e956f886a1a1..5710833ac1cc 100644 --- a/fs/nilfs2/btnode.c +++ b/fs/nilfs2/btnode.c @@ -285,6 +285,14 @@ void nilfs_btnode_abort_change_key(struct address_space *btnc, if (nbh == NULL) { /* blocksize == pagesize */ xa_erase_irq(&btnc->i_pages, newkey); unlock_page(ctxt->bh->b_page); - } else - brelse(nbh); + } else { + /* + * When canceling a buffer that a prepare operation has + * allocated to copy a node block to another location, use + * nilfs_btnode_delete() to initialize and release the buffer + * so that the buffer flags will not be in an inconsistent + * state when it is reallocated. + */ + nilfs_btnode_delete(nbh); + } }