nilfs2: handle inconsistent state in nilfs_btnode_create_block()

Syzbot reported that a buffer state inconsistency was detected in
nilfs_btnode_create_block(), triggering a kernel bug.

It is not appropriate to treat this inconsistency as a bug; it can occur
if the argument block address (the buffer index of the newly created
block) is a virtual block number and has been reallocated due to
corruption of the bitmap used to manage its allocation state.

So, modify nilfs_btnode_create_block() and its callers to treat it as a
possible filesystem error, rather than triggering a kernel bug.

Link: https://lkml.kernel.org/r/20240725052007.4562-1-konishi.ryusuke@gmail.com
Fixes: a60be987d45d ("nilfs2: B-tree node cache")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+89cc4f2324ed37988b60@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=89cc4f2324ed37988b60
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c
index 0131d83b912de1fedcaa0e1df49f6f404ee5a6ab..c034080c334b98d623540a3616ecc92fc40ecf2b 100644 (file)
--- a/fs/nilfs2/btnode.c
+++ b/fs/nilfs2/btnode.c
@@ -51,12 +51,21 @@ nilfs_btnode_create_block(struct address_space *btnc, __u64 blocknr)
 
        bh = nilfs_grab_buffer(inode, btnc, blocknr, BIT(BH_NILFS_Node));
        if (unlikely(!bh))
-               return NULL;
+               return ERR_PTR(-ENOMEM);
 
        if (unlikely(buffer_mapped(bh) || buffer_uptodate(bh) ||
                     buffer_dirty(bh))) {
-               brelse(bh);
-               BUG();
+               /*
+                * The block buffer at the specified new address was already
+                * in use.  This can happen if it is a virtual block number
+                * and has been reallocated due to corruption of the bitmap
+                * used to manage its allocation state (if not, the buffer
+                * clearing of an abandoned b-tree node is missing somewhere).
+                */
+               nilfs_error(inode->i_sb,
+                           "state inconsistency probably due to duplicate use of b-tree node block address %llu (ino=%lu)",
+                           (unsigned long long)blocknr, inode->i_ino);
+               goto failed;
        }
        memset(bh->b_data, 0, i_blocksize(inode));
        bh->b_bdev = inode->i_sb->s_bdev;
@@ -67,6 +76,12 @@ nilfs_btnode_create_block(struct address_space *btnc, __u64 blocknr)
        folio_unlock(bh->b_folio);
        folio_put(bh->b_folio);
        return bh;
+
+failed:
+       folio_unlock(bh->b_folio);
+       folio_put(bh->b_folio);
+       brelse(bh);
+       return ERR_PTR(-EIO);
 }
 
 int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
@@ -217,8 +232,8 @@ retry:
        }
 
        nbh = nilfs_btnode_create_block(btnc, newkey);
-       if (!nbh)
-               return -ENOMEM;
+       if (IS_ERR(nbh))
+               return PTR_ERR(nbh);
 
        BUG_ON(nbh == obh);
        ctxt->newbh = nbh;

diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index a139970e48041dbf4f7ee20e3e411e57f22505cc..862bdf23120e8abba21813ab9f0e5ca393399cab 100644 (file)
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -63,8 +63,8 @@ static int nilfs_btree_get_new_block(const struct nilfs_bmap *btree,
        struct buffer_head *bh;
 
        bh = nilfs_btnode_create_block(btnc, ptr);
-       if (!bh)
-               return -ENOMEM;
+       if (IS_ERR(bh))
+               return PTR_ERR(bh);
 
        set_buffer_nilfs_volatile(bh);
        *bhp = bh;