[PATCH 0/3] nilfs2 fixes on v6.19-rc1

[PATCH 0/3] nilfs2 fixes on v6.19-rc1

[Ryusuke Konishi]

Hi Viacheslav,

I'm submitting three nilfs2 fixes as a patch series (rather than a
pull request as previously mentioned), so please queue them in your
tree.

Two of the three involve kernel-doc issues in uapi header files. These
are suitable for the next cycle.

The remaining one, which I'm sure you've seen, fixes an issue recently
reported by syzbot involving the FITRIM ioctl, and is a slightly
higher priority.

If possible, I'd like you to submit this as a bugfix patch without
waiting for the next release cycle, but if you're limiting your pull
requests to merge windows, feel free to submit it together with ones
for v6.20-rc1 at your convenience.


Thanks,
Ryusuke Konishi


Edward Adam Davis (1):
  nilfs2: Fix potential block overflow that cause system hang

Randy Dunlap (1):
  nilfs2: convert nilfs_super_block to kernel-doc

Ryusuke Konishi (1):
  nilfs2: fix missing struct keywords in nilfs2_api.h kernel-doc

 fs/nilfs2/sufile.c                 |   4 +
 include/uapi/linux/nilfs2_api.h    |   4 +-
 include/uapi/linux/nilfs2_ondisk.h | 163 +++++++++++++++++------------
 3 files changed, 103 insertions(+), 68 deletions(-)

-- 
2.43.0

[PATCH 1/3] nilfs2: Fix potential block overflow that cause system hang

[Ryusuke Konishi]

From: Edward Adam Davis <eadavis@qq.com>

When a user executes the FITRIM command, an underflow can occur when
calculating nblocks if end_block is too small. Since nblocks is of
type sector_t, which is u64, a negative nblocks value will become a
very large positive integer. This ultimately leads to the block layer
function __blkdev_issue_discard() taking an excessively long time to
process the bio chain, and the ns_segctor_sem lock remains held for a
long period. This prevents other tasks from acquiring the ns_segctor_sem
lock, resulting in the hang reported by syzbot in [1].

If the ending block is too small, typically if it is smaller than 4KiB
range, depending on the usage of the segment 0, it may be possible to
attempt a discard request beyond the device size causing the hang.

Exiting successfully and assign the discarded size (0 in this case)
to range->len.

Although the start and len values in the user input range are too small,
a conservative strategy is adopted here to safely ignore them, which is
equivalent to a no-op; it will not perform any trimming and will not
throw an error.

[1]
task:segctord state:D stack:28968 pid:6093 tgid:6093  ppid:2 task_flags:0x200040 flags:0x00080000
Call Trace:
 rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272
 nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357
 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline]
 nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684

[ryusuke: corrected part of the commit message about the consequences]
Fixes: 82e11e857be3 ("nilfs2: add nilfs_sufile_trim_fs to trim clean segs")
Reported-by: syzbot+7eedce5eb281acd832f0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7eedce5eb281acd832f0
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: stable@vger.kernel.org
---
 fs/nilfs2/sufile.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
index 83f93337c01b..eceedca02697 100644
--- a/fs/nilfs2/sufile.c
+++ b/fs/nilfs2/sufile.c
@@ -1093,6 +1093,9 @@ int nilfs_sufile_trim_fs(struct inode *sufile, struct fstrim_range *range)
 	else
 		end_block = start_block + len - 1;
 
+	if (end_block < nilfs->ns_first_data_block)
+		goto out;
+
 	segnum = nilfs_get_segnum_of_block(nilfs, start_block);
 	segnum_end = nilfs_get_segnum_of_block(nilfs, end_block);
 
@@ -1191,6 +1194,7 @@ int nilfs_sufile_trim_fs(struct inode *sufile, struct fstrim_range *range)
 out_sem:
 	up_read(&NILFS_MDT(sufile)->mi_sem);
 
+out:
 	range->len = ndiscarded << nilfs->ns_blocksize_bits;
 	return ret;
 }
-- 
2.43.0

[PATCH 2/3] nilfs2: convert nilfs_super_block to kernel-doc

[Ryusuke Konishi]

From: Randy Dunlap <rdunlap@infradead.org>

Eliminate 40+ kernel-doc warnings in nilfs2_ondisk.h by converting
all of the struct member comments to kernel-doc comments.

Fix one misnamed struct member in nilfs_direct_node.

Object files before and after are the same size and content.

Examples of warnings:
Warning: include/uapi/linux/nilfs2_ondisk.h:202 struct member 's_rev_level'
 not described in 'nilfs_super_block'
Warning: include/uapi/linux/nilfs2_ondisk.h:202 struct member
 's_minor_rev_level' not described in 'nilfs_super_block'
Warning: include/uapi/linux/nilfs2_ondisk.h:202 struct member 's_magic'
 not described in 'nilfs_super_block'
Warning: include/uapi/linux/nilfs2_ondisk.h:202 struct member 's_bytes'
 not described in 'nilfs_super_block'
Warning: include/uapi/linux/nilfs2_ondisk.h:202 struct member 's_flags'
 not described in 'nilfs_super_block'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
---
 include/uapi/linux/nilfs2_ondisk.h | 163 +++++++++++++++++------------
 1 file changed, 97 insertions(+), 66 deletions(-)

diff --git a/include/uapi/linux/nilfs2_ondisk.h b/include/uapi/linux/nilfs2_ondisk.h
index 3196cc44a002..b3442b16ff6a 100644
--- a/include/uapi/linux/nilfs2_ondisk.h
+++ b/include/uapi/linux/nilfs2_ondisk.h
@@ -133,73 +133,104 @@ struct nilfs_super_root {
 
 /**
  * struct nilfs_super_block - structure of super block on disk
+ * @s_rev_level:		Revision level
+ * @s_minor_rev_level:		minor revision level
+ * @s_magic:			Magic signature
+ * @s_bytes:			Bytes count of CRC calculation for
+ *				  this structure.  s_reserved is excluded.
+ * @s_flags:			flags
+ * @s_crc_seed:			Seed value of CRC calculation
+ * @s_sum:			Check sum of super block
+ * @s_log_block_size:		Block size represented as follows:
+ *				  blocksize = 1 << (s_log_block_size + 10)
+ * @s_nsegments:		Number of segments in filesystem
+ * @s_dev_size:			block device size in bytes
+ * @s_first_data_block:		1st seg disk block number
+ * @s_blocks_per_segment:	number of blocks per full segment
+ * @s_r_segments_percentage:	Reserved segments percentage
+ * @s_last_cno:			Last checkpoint number
+ * @s_last_pseg:		disk block addr pseg written last
+ * @s_last_seq:			seq. number of seg written last
+ * @s_free_blocks_count:	Free blocks count
+ * @s_ctime:			Creation time (execution time of newfs)
+ * @s_mtime:			Mount time
+ * @s_wtime:			Write time
+ * @s_mnt_count:		Mount count
+ * @s_max_mnt_count:		Maximal mount count
+ * @s_state:			File system state
+ * @s_errors:			Behaviour when detecting errors
+ * @s_lastcheck:		time of last check
+ * @s_checkinterval:		max. time between checks
+ * @s_creator_os:		OS
+ * @s_def_resuid:		Default uid for reserved blocks
+ * @s_def_resgid:		Default gid for reserved blocks
+ * @s_first_ino:		First non-reserved inode
+ * @s_inode_size:		Size of an inode
+ * @s_dat_entry_size:		Size of a dat entry
+ * @s_checkpoint_size:		Size of a checkpoint
+ * @s_segment_usage_size:	Size of a segment usage
+ * @s_uuid:			128-bit uuid for volume
+ * @s_volume_name:		volume name
+ * @s_c_interval:		Commit interval of segment
+ * @s_c_block_max:		Threshold of data amount for the
+ *				  segment construction
+ * @s_feature_compat:		Compatible feature set
+ * @s_feature_compat_ro:	Read-only compatible feature set
+ * @s_feature_incompat:		Incompatible feature set
+ * @s_reserved:			padding to the end of the block
  */
 struct nilfs_super_block {
-/*00*/	__le32	s_rev_level;		/* Revision level */
-	__le16	s_minor_rev_level;	/* minor revision level */
-	__le16	s_magic;		/* Magic signature */
-
-	__le16  s_bytes;		/*
-					 * Bytes count of CRC calculation
-					 * for this structure. s_reserved
-					 * is excluded.
-					 */
-	__le16  s_flags;		/* flags */
-	__le32  s_crc_seed;		/* Seed value of CRC calculation */
-/*10*/	__le32	s_sum;			/* Check sum of super block */
-
-	__le32	s_log_block_size;	/*
-					 * Block size represented as follows
-					 * blocksize =
-					 *     1 << (s_log_block_size + 10)
-					 */
-	__le64  s_nsegments;		/* Number of segments in filesystem */
-/*20*/	__le64  s_dev_size;		/* block device size in bytes */
-	__le64	s_first_data_block;	/* 1st seg disk block number */
-/*30*/	__le32  s_blocks_per_segment;   /* number of blocks per full segment */
-	__le32	s_r_segments_percentage; /* Reserved segments percentage */
-
-	__le64  s_last_cno;		/* Last checkpoint number */
-/*40*/	__le64  s_last_pseg;		/* disk block addr pseg written last */
-	__le64  s_last_seq;             /* seq. number of seg written last */
-/*50*/	__le64	s_free_blocks_count;	/* Free blocks count */
-
-	__le64	s_ctime;		/*
-					 * Creation time (execution time of
-					 * newfs)
-					 */
-/*60*/	__le64	s_mtime;		/* Mount time */
-	__le64	s_wtime;		/* Write time */
-/*70*/	__le16	s_mnt_count;		/* Mount count */
-	__le16	s_max_mnt_count;	/* Maximal mount count */
-	__le16	s_state;		/* File system state */
-	__le16	s_errors;		/* Behaviour when detecting errors */
-	__le64	s_lastcheck;		/* time of last check */
-
-/*80*/	__le32	s_checkinterval;	/* max. time between checks */
-	__le32	s_creator_os;		/* OS */
-	__le16	s_def_resuid;		/* Default uid for reserved blocks */
-	__le16	s_def_resgid;		/* Default gid for reserved blocks */
-	__le32	s_first_ino;		/* First non-reserved inode */
-
-/*90*/	__le16  s_inode_size;		/* Size of an inode */
-	__le16  s_dat_entry_size;       /* Size of a dat entry */
-	__le16  s_checkpoint_size;      /* Size of a checkpoint */
-	__le16	s_segment_usage_size;	/* Size of a segment usage */
-
-/*98*/	__u8	s_uuid[16];		/* 128-bit uuid for volume */
-/*A8*/	char	s_volume_name[80]	/* volume name */
-			__kernel_nonstring;
-
-/*F8*/	__le32  s_c_interval;           /* Commit interval of segment */
-	__le32  s_c_block_max;          /*
-					 * Threshold of data amount for
-					 * the segment construction
-					 */
-/*100*/	__le64  s_feature_compat;	/* Compatible feature set */
-	__le64  s_feature_compat_ro;	/* Read-only compatible feature set */
-	__le64  s_feature_incompat;	/* Incompatible feature set */
-	__u32	s_reserved[186];	/* padding to the end of the block */
+/*00*/	__le32	s_rev_level;
+	__le16	s_minor_rev_level;
+	__le16	s_magic;
+
+	__le16  s_bytes;
+	__le16  s_flags;
+	__le32  s_crc_seed;
+/*10*/	__le32	s_sum;
+
+	__le32	s_log_block_size;
+	__le64  s_nsegments;
+/*20*/	__le64  s_dev_size;
+	__le64	s_first_data_block;
+/*30*/	__le32  s_blocks_per_segment;
+	__le32	s_r_segments_percentage;
+
+	__le64  s_last_cno;
+/*40*/	__le64  s_last_pseg;
+	__le64  s_last_seq;
+/*50*/	__le64	s_free_blocks_count;
+
+	__le64	s_ctime;
+/*60*/	__le64	s_mtime;
+	__le64	s_wtime;
+/*70*/	__le16	s_mnt_count;
+	__le16	s_max_mnt_count;
+	__le16	s_state;
+	__le16	s_errors;
+	__le64	s_lastcheck;
+
+/*80*/	__le32	s_checkinterval;
+	__le32	s_creator_os;
+	__le16	s_def_resuid;
+	__le16	s_def_resgid;
+	__le32	s_first_ino;
+
+/*90*/	__le16  s_inode_size;
+	__le16  s_dat_entry_size;
+	__le16  s_checkpoint_size;
+	__le16	s_segment_usage_size;
+
+/*98*/	__u8	s_uuid[16];
+/*A8*/	char	s_volume_name[80]	__kernel_nonstring;
+
+/*F8*/	__le32  s_c_interval;
+	__le32  s_c_block_max;
+
+/*100*/	__le64  s_feature_compat;
+	__le64  s_feature_compat_ro;
+	__le64  s_feature_incompat;
+	__u32	s_reserved[186];
 };
 
 /*
@@ -449,7 +480,7 @@ struct nilfs_btree_node {
 /**
  * struct nilfs_direct_node - header of built-in bmap array
  * @dn_flags: flags
- * @dn_pad: padding
+ * @pad: padding
  */
 struct nilfs_direct_node {
 	__u8 dn_flags;
-- 
2.43.0

[PATCH 3/3] nilfs2: fix missing struct keywords in nilfs2_api.h kernel-doc

[Ryusuke Konishi]

Eliminate the following kernel-doc warnings in nilfs2_api.h:

Warning: include/uapi/linux/nilfs2_api.h:65 cannot understand function
 prototype: 'struct nilfs_suinfo'
Warning: include/uapi/linux/nilfs2_api.h:101 cannot understand function
 prototype: 'struct nilfs_suinfo_update'

This ensures that the documentation for nilfs_suinfo and
nilfs_suinfo_update is correctly parsed and generated by adding the
missing 'struct' keyword to their kernel-doc comments.

Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
---
 include/uapi/linux/nilfs2_api.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/uapi/linux/nilfs2_api.h b/include/uapi/linux/nilfs2_api.h
index 8b9b89104f3d..d1b6fcde2fb8 100644
--- a/include/uapi/linux/nilfs2_api.h
+++ b/include/uapi/linux/nilfs2_api.h
@@ -58,7 +58,7 @@ NILFS_CPINFO_FNS(INVALID, invalid)
 NILFS_CPINFO_FNS(MINOR, minor)
 
 /**
- * nilfs_suinfo - segment usage information
+ * struct nilfs_suinfo - segment usage information
  * @sui_lastmod: timestamp of last modification
  * @sui_nblocks: number of written blocks in segment
  * @sui_flags: segment usage flags
@@ -93,7 +93,7 @@ static inline int nilfs_suinfo_clean(const struct nilfs_suinfo *si)
 }
 
 /**
- * nilfs_suinfo_update - segment usage information update
+ * struct nilfs_suinfo_update - segment usage information update
  * @sup_segnum: segment number
  * @sup_flags: flags for which fields are active in sup_sui
  * @sup_reserved: reserved necessary for alignment
-- 
2.43.0

Re: [PATCH 0/3] nilfs2 fixes on v6.19-rc1

[Viacheslav Dubeyko]

Hi Ryusuke,

On Sat, 2025-12-20 at 03:04 +0900, Ryusuke Konishi wrote:
> Hi Viacheslav,
> 
> I'm submitting three nilfs2 fixes as a patch series (rather than a
> pull request as previously mentioned), so please queue them in your
> tree.
> 
> Two of the three involve kernel-doc issues in uapi header files.
> These
> are suitable for the next cycle.
> 
> The remaining one, which I'm sure you've seen, fixes an issue
> recently
> reported by syzbot involving the FITRIM ioctl, and is a slightly
> higher priority.
> 
> If possible, I'd like you to submit this as a bugfix patch without
> waiting for the next release cycle, but if you're limiting your pull
> requests to merge windows, feel free to submit it together with ones
> for v6.20-rc1 at your convenience.
> 

I've applied patches on the tree. Sorry, end of the year as usually
"unexpectedly" busy. :) I think that Christmas and New Year time is not
the best time to send pull request. Also, I am finishing of creating
the tickets for xfstests issues. So, I hope I could start to analyze
the issues soon. And, probably, we could have more fixes for the next
merge window.

Thanks,
Slava.

Re: [PATCH 0/3] nilfs2 fixes on v6.19-rc1

[Ryusuke Konishi]

On Tue, Dec 23, 2025 at 9:16 AM Viacheslav Dubeyko wrote:
>
> Hi Ryusuke,
>
> On Sat, 2025-12-20 at 03:04 +0900, Ryusuke Konishi wrote:
> > Hi Viacheslav,
> >
> > I'm submitting three nilfs2 fixes as a patch series (rather than a
> > pull request as previously mentioned), so please queue them in your
> > tree.
> >
> > Two of the three involve kernel-doc issues in uapi header files.
> > These
> > are suitable for the next cycle.
> >
> > The remaining one, which I'm sure you've seen, fixes an issue
> > recently
> > reported by syzbot involving the FITRIM ioctl, and is a slightly
> > higher priority.
> >
> > If possible, I'd like you to submit this as a bugfix patch without
> > waiting for the next release cycle, but if you're limiting your pull
> > requests to merge windows, feel free to submit it together with ones
> > for v6.20-rc1 at your convenience.
> >
>
> I've applied patches on the tree. Sorry, end of the year as usually
> "unexpectedly" busy. :) I think that Christmas and New Year time is not
> the best time to send pull request. Also, I am finishing of creating
> the tickets for xfstests issues. So, I hope I could start to analyze
> the issues soon. And, probably, we could have more fixes for the next
> merge window.
>
> Thanks,
> Slava.

Yes, that's fine.
It's the end of the year, so please proceed at your convenience.
If nothing else happens, I'd like to address some of the necessary
improvements to the NILFS utilities build and focus on  issues around
rename operations.

Thanks,
Ryusuke Konishi