On 2/25/26 00:54, Taerang Kim wrote: > syzbot reports a BUG_ON(inode->i_data.nrpages) in clear_inode() when > mounting a corrupted f2fs image. > > I agree with Dmitry's RFC that dropping page #0 in f2fs_truncate() > can address this reproducer, since f2fs_convert_inline_inode() may > grab page #0 via f2fs_grab_cache_folio() and leave it cached on the > clear_out success path.
I suspect that we may miss some corner cases in f2fs_evict_inode() -> f2fs_truncate(), can we figure out the root cause of this issue first rather than just truncating all page cache before clear_inode()? Otherwise, current fix may cover potential bug. Thanks, > > However, clear_inode() requires the inode mapping to be empty, and it is > hard to guarantee that the page cache can only be populated from this > truncate/inline-conversion path. Make f2fs_evict_inode() defensively > truncate any remaining page cache before calling clear_inode(), so > nrpages is guaranteed to be 0 regardless of how the cache was populated. > > Link: > https://lore.kernel.org/linux-f2fs-devel/[email protected]/ > Reported-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=fc026e87558558f75c00 > Signed-off-by: Taerang Kim <[email protected]> > --- > v2: rebase onto torvalds/master (fsverity_cleanup_inode() not present); > fix patch context, no functional change. > > fs/f2fs/inode.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c > index e0f850b3f0c3..e7942e6e312c 100644 > --- a/fs/f2fs/inode.c > +++ b/fs/f2fs/inode.c > @@ -1006,6 +1006,13 @@ void f2fs_evict_inode(struct inode *inode) > } > out_clear: > fscrypt_put_encryption_info(inode); > + /* > + * Defensively truncate any remaining page cache, e.g. > + * f2fs_convert_inline_inode() called from f2fs_truncate() > + * may leave page #0 behind in the page cache when the > + * inline conversion takes the clear_out success path. > + */ > + truncate_inode_pages_final(&inode->i_data); > clear_inode(inode); > } > _______________________________________________ Linux-f2fs-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
