From: Hui Peng <benquike@gmail.com>
To: Theodore Ts'o <tytso@mit.edu>, Andreas Dilger <adilger.kernel@dilger.ca>
Cc: Jan Kara <jack@suse.cz>, Baokun Li <libaokun@linux.alibaba.com>,
linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] ext4: clear EXT4_STATE_MAY_INLINE_DATA in swap_inode_boot_loader()
Date: Sat, 19 Sep 2026 20:48:12 +0000 [thread overview]
Message-ID: <20260919204812.2814531-1-benquike@gmail.com> (raw)
swap_inode_boot_loader() (EXT4_IOC_SWAP_BOOT) checks
!ext4_has_inline_data(inode), but neither checks
ext4_has_inline_data(inode_bl) nor clears EXT4_STATE_MAY_INLINE_DATA on
inode and inode_bl after swapping their inode data.
When a newly created empty file (which has EXT4_STATE_MAY_INLINE_DATA
set in memory) is swapped with a non-empty EXT4_BOOT_LOADER_INO that
already has extent blocks, the target inode retains
EXT4_STATE_MAY_INLINE_DATA == 1 alongside extent blocks. A subsequent
ftruncate() + small pwrite() + fsync() dirties folio 0 while converting
the inode to inline data, hitting
BUG_ON(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) in
ext4_writepages().
Reject inline data on inode_bl and clear EXT4_STATE_MAY_INLINE_DATA on
both inodes in swap_inode_boot_loader().
Fixes: 67a11611e1a5 ("ext4: fix check of inode in swap_inode_boot_loader")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -397,7 +397,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) ||
IS_SWAPFILE(inode) || IS_ENCRYPTED(inode) ||
(EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL) ||
- ext4_has_inline_data(inode)) {
+ ext4_has_inline_data(inode) || ext4_has_inline_data(inode_bl)) {
err = -EINVAL;
goto journal_err_out;
}
@@ -461,6 +461,8 @@ static long swap_inode_boot_loader(struct super_block *sb,
size_bl = (qsize_t)(inode_bl->i_blocks) * (1 << 9) + inode_bl->i_bytes;
diff = size - size_bl;
swap_inode_data(inode, inode_bl);
+ ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA);
+ ext4_clear_inode_state(inode_bl, EXT4_STATE_MAY_INLINE_DATA);
inode_set_ctime_current(inode);
inode_set_ctime_current(inode_bl);
--
2.43.0
next reply other threads:[~2026-09-19 20:48 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-19 20:48 Hui Peng [this message]
2026-09-19 21:00 ` [PATCH] ext4: clear EXT4_STATE_MAY_INLINE_DATA in swap_inode_boot_loader() sashiko-bot
2026-09-24 16:02 ` Jan Kara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260919204812.2814531-1-benquike@gmail.com \
--to=benquike@gmail.com \
--cc=adilger.kernel@dilger.ca \
--cc=jack@suse.cz \
--cc=libaokun@linux.alibaba.com \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.