syzbot reports a BUG_ON(inode->i_data.nrpages) in clear_inode() when mounting a corrupted f2fs image.
I agree with Dmitry's RFC that dropping page #0 in f2fs_truncate() can address this reproducer, since f2fs_convert_inline_inode() may grab page #0 via f2fs_grab_cache_folio() and leave it cached on the clear_out success path. However, clear_inode() requires the inode mapping to be empty, and it is hard to guarantee that the page cache can only be populated from this truncate/inline-conversion path. Make f2fs_evict_inode() defensively truncate any remaining page cache before calling clear_inode(), so nrpages is guaranteed to be 0 regardless of how the cache was populated. Link: https://lore.kernel.org/linux-f2fs-devel/[email protected]/ Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=fc026e87558558f75c00 Signed-off-by: Taerang Kim <[email protected]> --- v2: rebase onto torvalds/master (fsverity_cleanup_inode() not present); fix patch context, no functional change. fs/f2fs/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c index e0f850b3f0c3..e7942e6e312c 100644 --- a/fs/f2fs/inode.c +++ b/fs/f2fs/inode.c @@ -1006,6 +1006,13 @@ void f2fs_evict_inode(struct inode *inode) } out_clear: fscrypt_put_encryption_info(inode); + /* + * Defensively truncate any remaining page cache, e.g. + * f2fs_convert_inline_inode() called from f2fs_truncate() + * may leave page #0 behind in the page cache when the + * inline conversion takes the clear_out success path. + */ + truncate_inode_pages_final(&inode->i_data); clear_inode(inode); } -- 2.43.0 _______________________________________________ Linux-f2fs-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
