From: Deepanshu Kartikey <kartikey406@gmail.com>
To: konishi.ryusuke@gmail.com, slava@dubeyko.com
Cc: akpm@linux-foundation.org, sato.koji@lab.ntt.co.jp,
linux-nilfs@vger.kernel.org, linux-kernel@vger.kernel.org,
Deepanshu Kartikey <kartikey406@gmail.com>,
syzbot+98a040252119df0506f8@syzkaller.appspotmail.com,
Deepanshu Kartikey <Kartikey406@gmail.com>
Subject: [PATCH] nilfs2: fix missing continue after -ENOENT in nilfs_ioctl_mark_blocks_dirty()
Date: Thu, 19 Mar 2026 14:49:30 +0530 [thread overview]
Message-ID: <20260319091930.1088735-1-kartikey406@gmail.com> (raw)
nilfs_ioctl_mark_blocks_dirty() calls nilfs_bmap_lookup_at_level() to
get the current block number of each block descriptor. When the lookup
returns -ENOENT, meaning the block does not exist, it sets bd_blocknr
to 0 and continues processing.
However, if bd_oblocknr is also 0, the subsequent check:
if (bdescs[i].bd_blocknr != bdescs[i].bd_oblocknr)
continue;
will not skip the block, and nilfs_bmap_mark() will be called on a
non-existent block. This causes nilfs_btree_do_lookup() to return
-ENOENT, triggering the WARN_ON(ret == -ENOENT).
Fix this by adding a continue statement after setting bd_blocknr to 0
when the lookup returns -ENOENT, so that dead blocks are always skipped
regardless of the value of bd_oblocknr.
Fixes: 7942b919f732 ("nilfs2: ioctl operations")
Reported-by: syzbot+98a040252119df0506f8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=98a040252119df0506f8
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
fs/nilfs2/ioctl.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index e17b8da66491..1615a314f557 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -745,6 +745,7 @@ static int nilfs_ioctl_mark_blocks_dirty(struct the_nilfs *nilfs,
if (ret != -ENOENT)
return ret;
bdescs[i].bd_blocknr = 0;
+ continue;
}
if (bdescs[i].bd_blocknr != bdescs[i].bd_oblocknr)
/* skip dead block */
--
2.43.0
next reply other threads:[~2026-03-19 9:19 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-19 9:19 Deepanshu Kartikey [this message]
2026-03-20 17:32 ` Ryusuke Konishi
2026-03-25 8:35 ` Junjie Cao
2026-03-30 9:40 ` Deepanshu Kartikey
2026-03-30 10:00 ` Ryusuke Konishi
2026-03-30 18:09 ` Ryusuke Konishi
2026-03-31 0:47 ` Deepanshu Kartikey
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260319091930.1088735-1-kartikey406@gmail.com \
--to=kartikey406@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=konishi.ryusuke@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nilfs@vger.kernel.org \
--cc=sato.koji@lab.ntt.co.jp \
--cc=slava@dubeyko.com \
--cc=syzbot+98a040252119df0506f8@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®