From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794064535; b=QdPCs2/zK2KBu6GZqcnbitmBNNcGQsWEbrA0kwqy1Eb/NAr1LB19i1xX3UI1jDSjGd+Q bfCA1axRYv9qoBrujVfkg0hRUTHi4Mp27zxlwTTV5m0RzhR1rEz5QgDIN32zMA7KrKeqW MTI2O9EKXhCf3cpMjJ6YjD+4hAVbgMvRqBQvttj5jFo0vDlCLxc4pmfDEAme7LZk8hhSp bV8hcByM9JEUOozLOSxn9kW4IIkOGMcrNDCBtwEQFHQMlXug3kmTO9acs6C/R8a6xksVO XN1Df2PGyCulAFuHmgdp1EBnDNnaFvhec/uDhieYBa/8dVP1NkTCXkNafF4k14u840g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794064535; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=4Aw8bLVt5SHOwBX6GRP7+N6RI6siIT8n2u74a69W5a4=; b=Qc7o7TxQHwfdQxFZ0DW/3EQ2AAKX5lLEKYTWKqRmuXjl4HJqBM2ohjac8TY+w3bQ6/ol BaV7E6zCo6D9l/6i+/dGa3WuUYRDQ/YQo5KD3n1Ax6VVChzgyH+LwFlndFBKgNjlUzek6 FJvA5ir08uMe2mW0+a9wlIlNDO3KWPzliSB/yVBGeM2DZMqHA5ID78y4YAcPwWqpYwRbm xwNC2w8fIQFb++SXnpGcvcdr8FNBS0Ni3fexq1Bw6v+V/DapvK4kIhe1TwuZAAtJdBarU +kk6O2HG3Z/DG7hqJFQnHJervgyj0BJbLKeyUOoej0US+KYARtfkpLy+17XSv/1238Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=JaFRyCDx; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E366606B8A6; Sat, 7 Nov 2026 15:15:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=JaFRyCDx Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34C411F008A6; Sat, 7 Nov 2026 15:15:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794064535; bh=4Aw8bLVt5SHOwBX6GRP7+N6RI6siIT8n2u74a69W5a4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JaFRyCDxnbWBq9BK7Nyc25k4EWsrPMhgnPuC2zic5LEzuQajOrtWi7x2bfIc8s3qx DKKUv7W9ZUHpItZtFSZzFnvqYE1Aj5JIpy851mkLZSp+7OCDa5ayQXIgZmXe1bJX8F eJoA8b3ERXZKc0EChISiJzJo8VLDqm0ACbUfz7F4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable@kernel.org, syzbot+4b03894b6ec5753ddf24@syzkaller.appspotmail.com, Hemanth Selam , Jan Kara , Jun Nie , Theodore Tso , Sasha Levin Subject: [PATCH 7.3 0563/1257] ext4: skip extra isize expansion while unmounting Date: Sat, 7 Nov 2026 08:47:39 -0500 Message-ID: <20261107134954.917916844@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hemanth Selam [ Upstream commit 418adcde99032194416248168df810535a1a93f9 ] syzbot reports a WARN from ext4_xattr_inode_create() reached through the unmount path: EXT4-fs warning (device loop0): ext4_xattr_inode_create:1485: refuse to create EA inode when umounting WARNING: fs/ext4/xattr.c:1486 at ext4_xattr_inode_lookup_create ext4_xattr_block_set ext4_expand_extra_isize_ea __ext4_expand_extra_isize __ext4_mark_inode_dirty ext4_dirty_inode __mark_inode_dirty sync_lazytime iput dentry_kill shrink_dentry_list shrink_dcache_for_umount generic_shutdown_super kill_block_super ext4_kill_sb shrink_dcache_for_umount() clears s_root before generic_shutdown_super() clears SB_ACTIVE, so during the dcache shrink the last iput() of a lazytime inode still redirties it and reaches the isize expansion. The expansion can move xattrs out to a block, and creating the EA inode for them needs s_root, which ext4_xattr_inode_create() refuses without. ext4_try_to_expand_extra_isize() already declines to expand when the superblock is not active, but that test does not cover this window. Decline while s_root is gone as well. The expansion is best effort and __ext4_mark_inode_dirty() ignores its return value, so nothing else changes; the inode can be expanded on a later mount. Running the syzbot reproducer for 60 seconds produced 3583 splats before this change and none after it, with the same number of mount cycles. Cc: stable@kernel.org Reported-by: syzbot+4b03894b6ec5753ddf24@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4b03894b6ec5753ddf24 Fixes: f31173c19901 ("ext4: refuse to create ea block when umounted") Signed-off-by: Hemanth Selam Reviewed-by: Jan Kara Reviewed-by: Jun Nie Link: https://patch.msgid.link/20260824094512.2436628-1-hemanth.selam@gmail.com Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin --- fs/ext4/inode.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 206c6245c6192..fb0548b3355c5 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -6600,8 +6600,14 @@ static int ext4_try_to_expand_extra_isize(struct inode *inode, * When !SB_ACTIVE, iput triggers write_inode_now() which acquires * s_writepages_rwsem, causing a deadlock with the caller's active * jbd2 handle (lock order: s_writepages_rwsem -> jbd2_handle). + * + * Skip it while unmounting as well. shrink_dcache_for_umount() + * clears s_root before generic_shutdown_super() clears SB_ACTIVE, and + * the last iput() of a lazytime inode in that window redirties it and + * lands here. Moving xattrs out to a block then needs a new EA inode, + * which ext4_xattr_inode_create() refuses without s_root. */ - if (unlikely(!(inode->i_sb->s_flags & SB_ACTIVE))) + if (unlikely(!(inode->i_sb->s_flags & SB_ACTIVE) || !inode->i_sb->s_root)) return -EBUSY; /* -- 2.53.0