* Forwarded: [PATCH] ext4: fix race condition in ext4_write_end() with inline data conversion
2026-07-16 7:50 [syzbot] [ext4?] kernel BUG in ext4_write_inline_data_end (3) syzbot
@ 2026-07-17 0:08 ` syzbot
2026-07-17 9:15 ` Forwarded: [PATCH] ext4: fix race in ext4_write_inline_data_end() by making it defensive syzbot
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-07-17 0:08 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: fix race condition in ext4_write_end() with inline data conversion
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
A race condition exists between ext4_write_end() checking for inline data
and the inline-to-block conversion path clearing the inline flags.
Thread A (write completion):
- Checks ext4_has_inline_data(inode) = TRUE (no lock held)
- Checks EXT4_STATE_MAY_INLINE_DATA = TRUE (no lock held)
Thread B (conversion via mmap/readahead):
- Acquires i_data_sem write lock
- Clears EXT4_INODE_INLINE_DATA flag
- Clears EXT4_STATE_MAY_INLINE_DATA state
- Releases i_data_sem
Thread A (resumes):
- Calls ext4_write_inline_data_end()
- BUG_ON(!ext4_has_inline_data(inode)) fails
- Kernel crashes
The fix is to acquire i_data_sem read lock in ext4_write_end() around
the inline data check and handler, serializing against the conversion
path which holds the write lock.
Reported-by: syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=293a57918b36cfae3d48
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inode.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ce99807c5f5b..9a5347907685 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1450,11 +1450,17 @@ static int ext4_write_end(const struct kiocb *iocb,
trace_ext4_write_end(inode, pos, len, copied);
+ down_read(&EXT4_I(inode)->i_data_sem);
+ /* Serialize against inline data conversion (see ext4_convert_inline_data_nolock) */
if (ext4_has_inline_data(inode) &&
- ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))
- return ext4_write_inline_data_end(inode, pos, len, copied,
+ ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) {
+ ret = ext4_write_inline_data_end(inode, pos, len, copied,
folio);
+ up_read(&EXT4_I(inode)->i_data_sem);
+ return ret;
+ }
+ up_read(&EXT4_I(inode)->i_data_sem);
copied = block_write_end(pos, len, copied, folio);
/*
* it's important to update i_size while still holding folio lock:
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Forwarded: [PATCH] ext4: fix race in ext4_write_inline_data_end() by making it defensive
2026-07-16 7:50 [syzbot] [ext4?] kernel BUG in ext4_write_inline_data_end (3) syzbot
2026-07-17 0:08 ` Forwarded: [PATCH] ext4: fix race condition in ext4_write_end() with inline data conversion syzbot
@ 2026-07-17 9:15 ` syzbot
2026-07-17 10:53 ` Forwarded: [PATCH] ext4: make ext4_write_inline_data_end() handle file conversion gracefully syzbot
2026-07-17 13:41 ` Forwarded: [PATCH] ext4: handle inline-to-block file conversion race with error return syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-07-17 9:15 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: fix race in ext4_write_inline_data_end() by making it defensive
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
Replace BUG_ON(!ext4_has_inline_data(inode)) with a defensive check in
ext4_write_inline_data_end(). This handles the race condition where a file
can be converted from inline to block storage by concurrent paths while a
write completion is in flight.
Multiple inline-to-block conversion paths exist and use different locking
mechanisms (ext4_convert_inline_data_nolock uses i_data_sem, while
ext4_convert_inline_data_to_extent and ext4_da_convert_inline_data_to_extent
use xattr_sem). A write that began on an inline file can reach completion
after the file has been converted to blocks by one of these paths.
Instead of crashing with BUG_ON, gracefully fall back to block_write_end()
when the file has already been converted. The data is already in blocks at
this point, so the fallback is correct.
Reported-by: syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=293a57918b36cfae3d48
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inline.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 8045e4ff270c..0a5404fe5bc5 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -812,7 +812,10 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
goto out;
}
ext4_write_lock_xattr(inode, &no_expand);
- BUG_ON(!ext4_has_inline_data(inode));
+ /* File may have been converted to block storage by concurrent path */
+ if (!ext4_has_inline_data(inode)) {
+ return block_write_end(pos, len, copied, folio);
+ }
/*
* ei->i_inline_off may have changed since
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Forwarded: [PATCH] ext4: make ext4_write_inline_data_end() handle file conversion gracefully
2026-07-16 7:50 [syzbot] [ext4?] kernel BUG in ext4_write_inline_data_end (3) syzbot
2026-07-17 0:08 ` Forwarded: [PATCH] ext4: fix race condition in ext4_write_end() with inline data conversion syzbot
2026-07-17 9:15 ` Forwarded: [PATCH] ext4: fix race in ext4_write_inline_data_end() by making it defensive syzbot
@ 2026-07-17 10:53 ` syzbot
2026-07-17 13:41 ` Forwarded: [PATCH] ext4: handle inline-to-block file conversion race with error return syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-07-17 10:53 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: make ext4_write_inline_data_end() handle file conversion gracefully
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
Replace BUG_ON(!ext4_has_inline_data(inode)) with a defensive check in
ext4_write_inline_data_end(). A file can be converted from inline to block
storage by concurrent paths while a write completion is in flight.
When this race occurs, the write completion handler should gracefully fall
back to block_write_end() instead of crashing. The data in the folio can
still be written to block storage via the fallback path.
This handles all inline-to-block conversion races regardless of which lock
protects the conversion (i_data_sem, xattr_sem, etc.).
Reported-by: syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=293a57918b36cfae3d48
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inline.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 8045e4ff270c..04b9cd01fd7b 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -812,7 +812,11 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
goto out;
}
ext4_write_lock_xattr(inode, &no_expand);
- BUG_ON(!ext4_has_inline_data(inode));
+ /* File may have been converted to block storage by concurrent path */
+ if (!ext4_has_inline_data(inode)) {
+ ext4_write_unlock_xattr(inode, &no_expand);
+ return block_write_end(pos, len, copied, folio);
+ }
/*
* ei->i_inline_off may have changed since
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Forwarded: [PATCH] ext4: handle inline-to-block file conversion race with error return
2026-07-16 7:50 [syzbot] [ext4?] kernel BUG in ext4_write_inline_data_end (3) syzbot
` (2 preceding siblings ...)
2026-07-17 10:53 ` Forwarded: [PATCH] ext4: make ext4_write_inline_data_end() handle file conversion gracefully syzbot
@ 2026-07-17 13:41 ` syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-07-17 13:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] ext4: handle inline-to-block file conversion race with error return
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
Replace fatal BUG_ON(!ext4_has_inline_data(inode)) with a defensive check
that returns -EIO when a file has been converted from inline to block
storage during write completion.
A file can transition from inline to block storage via concurrent paths
(mmap, readahead, truncate) while a write completion is in flight. If this
occurs, the write is in an inconsistent state and should not silently
succeed. Returning -EIO signals the error to the caller, allowing proper
retry and preventing silent data corruption.
Reported-by: syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=293a57918b36cfae3d48
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/ext4/inline.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 8045e4ff270c..887a153924af 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -812,7 +812,11 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
goto out;
}
ext4_write_lock_xattr(inode, &no_expand);
- BUG_ON(!ext4_has_inline_data(inode));
+ /* File may have been converted to block storage by concurrent path */
+ if (!ext4_has_inline_data(inode)) {
+ ext4_write_unlock_xattr(inode, &no_expand);
+ return -EIO;
+ }
/*
* ei->i_inline_off may have changed since
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread