[syzbot] [exfat?] WARNING in fat_ent_write

[syzbot] [exfat?] WARNING in fat_ent_write

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    6a746cd265ae Add linux-next specific files for 20260819
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13cdee79580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4a1369648c551bbe
dashboard link: https://syzkaller.appspot.com/bug?extid=26461e903494e689c24f
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17760e79580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/32d71a199871/disk-6a746cd2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7bfb88f0043e/vmlinux-6a746cd2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4bc2ab35db01/bzImage-6a746cd2.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/500a74ccb5d4/mount_0.gz
  fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=17e3d679580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+26461e903494e689c24f@syzkaller.appspotmail.com

         and is ignored by this kernel. Remove the mand
         option from the mount to silence this warning.
=======================================================
Buffer I/O error on dev loop0, logical block 1, lost sync page write
------------[ cut here ]------------
!buffer_uptodate(bh)
WARNING: fs/buffer.c:991 at mark_buffer_dirty+0x299/0x410 fs/buffer.c:991, CPU#1: syz.0.17/5854
Modules linked in:
CPU: 1 UID: 0 PID: 5854 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:mark_buffer_dirty+0x299/0x410 fs/buffer.c:991
Code: 4c 89 f7 e8 09 0a d8 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 4f 40 68 ff eb 8c e8 48 40 68 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 3a 40 68 ff 90 0f 0b 90 e9 cf fd ff ff
RSP: 0018:ffffc9000345f2d0 EFLAGS: 00010293
RAX: ffffffff825f7f28 RBX: ffff8880714019a0 RCX: ffff8880317c5dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: dffffc0000000001 R08: ffff8880714019a7 R09: 1ffff1100e280334
R10: dffffc0000000000 R11: ffffed100e280335 R12: ffffffff8c288c60
R13: ffff888032a9c248 R14: dffffc0000000000 R15: ffff8880717c46a8
FS:  00007fc05a3146c0(0000) GS:ffff888124dda000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9293991000 CR3: 000000007992c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 mmb_mark_buffer_dirty+0x2c/0x1f0 fs/buffer.c:624
 fat_ent_write+0xb8/0x190 fs/fat/fatent.c:422
 fat_chain_add+0x409/0x8e0 fs/fat/misc.c:140
 fat_add_cluster fs/fat/inode.c:113 [inline]
 __fat_get_block fs/fat/inode.c:155 [inline]
 fat_get_block+0x768/0xae0 fs/fat/inode.c:190
 __block_write_begin_int+0x6c2/0x1900 fs/buffer.c:2030
 block_write_begin fs/buffer.c:2144 [inline]
 cont_write_begin+0x71b/0xac0 fs/buffer.c:2506
 fat_write_begin+0x7a/0x150 fs/fat/inode.c:230
 cont_expand_zero fs/buffer.c:2434 [inline]
 cont_write_begin+0x2d6/0xac0 fs/buffer.c:2496
 fat_write_begin+0x7a/0x150 fs/fat/inode.c:230
 generic_perform_write+0x2d5/0x8f0 mm/filemap.c:4374
 generic_file_write_iter+0xae/0x330 mm/filemap.c:4517
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x612/0xba0 fs/read_write.c:687
 ksys_pwrite64 fs/read_write.c:794 [inline]
 __do_sys_pwrite64 fs/read_write.c:802 [inline]
 __se_sys_pwrite64 fs/read_write.c:799 [inline]
 __x64_sys_pwrite64+0x196/0x220 fs/read_write.c:799
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc05939e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc05a314028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00007fc059625fa0 RCX: 00007fc05939e0d9
RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004
RBP: 00007fc059435024 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc059626038 R14: 00007fc059625fa0 R15: 00007fff03653f68
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: Please drop 64d9183203eeb in mm-nonmm-unstable ([syzbot] [exfat?] WARNING in fat_ent_write)

[OGAWA Hirofumi]

https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/commit/fs/fat/misc.c?h=mm-nonmm-unstable&id=64d9183203eebe33de6188b70a8c1e91f52885db (fat: restore original value when fat_ent_write failed)

This commit was missing to consider about the path of error by sync
write.  Since current bh write clears uptodate flag if got I/O error, so
this patch doesn't work for now with wait==true.

Please drop this patch at least until stop clearing the uptodate by bh
sync write and buffer is reusable after the error.

Thanks.

syzbot <syzbot+26461e903494e689c24f@syzkaller.appspotmail.com> writes:

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    6a746cd265ae Add linux-next specific files for 20260819
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=13cdee79580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=4a1369648c551bbe
> dashboard link: https://syzkaller.appspot.com/bug?extid=26461e903494e689c24f
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17760e79580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/32d71a199871/disk-6a746cd2.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/7bfb88f0043e/vmlinux-6a746cd2.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/4bc2ab35db01/bzImage-6a746cd2.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/500a74ccb5d4/mount_0.gz
>   fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=17e3d679580000)
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+26461e903494e689c24f@syzkaller.appspotmail.com
>
>          and is ignored by this kernel. Remove the mand
>          option from the mount to silence this warning.
> =======================================================
> Buffer I/O error on dev loop0, logical block 1, lost sync page write
> ------------[ cut here ]------------
> !buffer_uptodate(bh)
> WARNING: fs/buffer.c:991 at mark_buffer_dirty+0x299/0x410 fs/buffer.c:991, CPU#1: syz.0.17/5854
> Modules linked in:
> CPU: 1 UID: 0 PID: 5854 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> RIP: 0010:mark_buffer_dirty+0x299/0x410 fs/buffer.c:991
> Code: 4c 89 f7 e8 09 0a d8 ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 74 52 fb ff e8 4f 40 68 ff eb 8c e8 48 40 68 ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 3a 40 68 ff 90 0f 0b 90 e9 cf fd ff ff
> RSP: 0018:ffffc9000345f2d0 EFLAGS: 00010293
> RAX: ffffffff825f7f28 RBX: ffff8880714019a0 RCX: ffff8880317c5dc0
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
> RBP: dffffc0000000001 R08: ffff8880714019a7 R09: 1ffff1100e280334
> R10: dffffc0000000000 R11: ffffed100e280335 R12: ffffffff8c288c60
> R13: ffff888032a9c248 R14: dffffc0000000000 R15: ffff8880717c46a8
> FS:  00007fc05a3146c0(0000) GS:ffff888124dda000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f9293991000 CR3: 000000007992c000 CR4: 00000000003526f0
> Call Trace:
>  <TASK>
>  mmb_mark_buffer_dirty+0x2c/0x1f0 fs/buffer.c:624
>  fat_ent_write+0xb8/0x190 fs/fat/fatent.c:422
>  fat_chain_add+0x409/0x8e0 fs/fat/misc.c:140
>  fat_add_cluster fs/fat/inode.c:113 [inline]
>  __fat_get_block fs/fat/inode.c:155 [inline]
>  fat_get_block+0x768/0xae0 fs/fat/inode.c:190
>  __block_write_begin_int+0x6c2/0x1900 fs/buffer.c:2030
>  block_write_begin fs/buffer.c:2144 [inline]
>  cont_write_begin+0x71b/0xac0 fs/buffer.c:2506
>  fat_write_begin+0x7a/0x150 fs/fat/inode.c:230
>  cont_expand_zero fs/buffer.c:2434 [inline]
>  cont_write_begin+0x2d6/0xac0 fs/buffer.c:2496
>  fat_write_begin+0x7a/0x150 fs/fat/inode.c:230
>  generic_perform_write+0x2d5/0x8f0 mm/filemap.c:4374
>  generic_file_write_iter+0xae/0x330 mm/filemap.c:4517
>  new_sync_write fs/read_write.c:595 [inline]
>  vfs_write+0x612/0xba0 fs/read_write.c:687
>  ksys_pwrite64 fs/read_write.c:794 [inline]
>  __do_sys_pwrite64 fs/read_write.c:802 [inline]
>  __se_sys_pwrite64 fs/read_write.c:799 [inline]
>  __x64_sys_pwrite64+0x196/0x220 fs/read_write.c:799
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fc05939e0d9
> Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fc05a314028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
> RAX: ffffffffffffffda RBX: 00007fc059625fa0 RCX: 00007fc05939e0d9
> RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004
> RBP: 00007fc059435024 R08: 0000000000000000 R09: 0000000000000000
> R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fc059626038 R14: 00007fc059625fa0 R15: 00007fff03653f68
>  </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup

-- 
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>

Re: Please drop 64d9183203eeb in mm-nonmm-unstable ([syzbot] [exfat?] WARNING in fat_ent_write)

[Andrew Morton]

On Mon, 24 Aug 2026 18:31:29 +0900 OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> wrote:

> https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/commit/fs/fat/misc.c?h=mm-nonmm-unstable&id=64d9183203eebe33de6188b70a8c1e91f52885db (fat: restore original value when fat_ent_write failed)
> 
> This commit was missing to consider about the path of error by sync
> write.  Since current bh write clears uptodate flag if got I/O error, so
> this patch doesn't work for now with wait==true.
> 
> Please drop this patch at least until stop clearing the uptodate by bh
> sync write and buffer is reusable after the error.

This is now in Linus's tree, as 64d9183203ee.  Please send along a fix,
with 

Fixes: 64d9183203ee ("fat: restore original value when fat_ent_write failed")

[PATCH] fat: Fix fat_ent_write() for reverting the value

[OGAWA Hirofumi]

commit 64d9183203ee ("fat: restore original value when fat_ent_write
failed") try to revert the fatent value to old value when got the
error on mirror FAT.

However it didn't work if the error is when writing the fatent bh. In
that case, the bh is cleared the uptodate flag, so reuse bh is
invalid.

So this fix it by reverting the fatent only if got the error on mirror
FAT.

Fixes: 64d9183203ee ("fat: restore original value when fat_ent_write failed")
Reported-by: syzbot+e64c6472a3d96a75172a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e64c6472a3d96a75172a
Reported-by: syzbot+26461e903494e689c24f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=26461e903494e689c24f
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
---
 fs/fat/fat.h    |    2 +-
 fs/fat/fatent.c |   21 ++++++++++++++++++---
 fs/fat/file.c   |    3 ++-
 fs/fat/misc.c   |    6 ++----
 4 files changed, 23 insertions(+), 9 deletions(-)

diff --git a/fs/fat/fat.h b/fs/fat/fat.h
index 6133841..fbd207c 100644
--- a/fs/fat/fat.h	2026-08-25 04:18:02.783584853 +0900
+++ b/fs/fat/fat.h	2026-08-25 04:41:16.699018559 +0900
@@ -392,7 +392,7 @@ extern void fat_ent_access_init(struct s
 extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent,
 			int entry);
 extern int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
-			 int new, int wait);
+			 int new, int old, int wait);
 extern int fat_alloc_clusters(struct inode *inode, int *cluster,
 			      int nr_cluster);
 extern int fat_free_clusters(struct inode *inode, int cluster);
diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
index f0801d9..df23fc8 100644
--- a/fs/fat/fatent.c	2026-08-25 04:18:02.783584853 +0900
+++ b/fs/fat/fatent.c	2026-08-25 20:53:03.682868977 +0900
@@ -413,7 +413,7 @@ error:
 }
 
 int fat_ent_write(struct inode *inode, struct fat_entry *fatent,
-		  int new, int wait)
+		  int new, int old, int wait)
 {
 	struct super_block *sb = inode->i_sb;
 	const struct fatent_operations *ops = MSDOS_SB(sb)->fatent_ops;
@@ -422,10 +422,25 @@ int fat_ent_write(struct inode *inode, s
 	ops->ent_put(fatent, new);
 	if (wait) {
 		err = fat_sync_bhs(fatent->bhs, fatent->nr_bhs);
-		if (err)
+		if (err) {
+			/*
+			 * bhs are not uptodate after I/O error. So we
+			 * can't simply re-dirty to revert. And it
+			 * would not have value to write again on I/O
+			 * error.
+			 */
 			return err;
+		}
 	}
-	return fat_mirror_bhs(sb, fatent->bhs, fatent->nr_bhs);
+
+	err = fat_mirror_bhs(sb, fatent->bhs, fatent->nr_bhs);
+	if (err) {
+		/* Try to revert if got the error on mirror FAT */
+		ops->ent_put(fatent, old);
+		if (wait)
+			fat_sync_bhs(fatent->bhs, fatent->nr_bhs);
+	}
+	return err;
 }
 
 static inline int fat_ent_next(struct msdos_sb_info *sbi,
diff --git a/fs/fat/file.c b/fs/fat/file.c
index 1c835ca..6c475c5 100644
--- a/fs/fat/file.c	2026-08-25 04:18:02.783584853 +0900
+++ b/fs/fat/file.c	2026-08-25 04:36:54.305256547 +0900
@@ -363,7 +363,8 @@ static int fat_free(struct inode *inode,
 				     __func__, MSDOS_I(inode)->i_pos);
 			ret = -EIO;
 		} else if (ret > 0) {
-			err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, wait);
+			err = fat_ent_write(inode, &fatent, FAT_ENT_EOF, ret,
+					    wait);
 			if (err)
 				ret = err;
 		}
diff --git a/fs/fat/misc.c b/fs/fat/misc.c
index e79762c..c442967 100644
--- a/fs/fat/misc.c	2026-08-25 04:18:02.784584849 +0900
+++ b/fs/fat/misc.c	2026-08-25 04:33:40.124172801 +0900
@@ -133,11 +133,9 @@ int fat_chain_add(struct inode *inode, i
 		ret = fat_ent_read(inode, &fatent, last);
 		if (ret >= 0) {
 			int wait = inode_needs_sync(inode);
-			int old = ret;
 
-			ret = fat_ent_write(inode, &fatent, new_dclus, wait);
-			if (ret < 0)
-				fat_ent_write(inode, &fatent, old, wait);
+			ret = fat_ent_write(inode, &fatent, new_dclus, ret,
+					    wait);
 			fatent_brelse(&fatent);
 		}
 		if (ret < 0)
_
-- 
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>