* Forwarded: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
2026-09-17 5:53 [syzbot] [ntfs3?] WARNING in ntfs_evict_inode syzbot
@ 2026-09-20 9:11 ` syzbot
2026-09-20 9:28 ` syzbot
` (7 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-09-20 9:11 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
Author: adarshdas950@gmail.com
#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index bead01a953f3..5f833a75a829 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -7,6 +7,7 @@
#include <linux/fiemap.h>
#include <linux/fs.h>
+#include <linux/iomap.h>
#include <linux/minmax.h>
#include <linux/vmalloc.h>
@@ -1943,7 +1944,7 @@ int ni_read_folio_cmpr(struct ntfs_inode *ni,
struct folio *folio)
if (vbo >= i_size_read(&ni->vfs_inode)) {
folio_zero_range(folio, 0, folio_size(folio));
- folio_mark_uptodate(folio);
+ iomap_folio_mark_uptodate(folio);
err = 0;
goto out;
}
@@ -2521,7 +2522,8 @@ int ni_read_frame(struct ntfs_inode *ni, u64
frame_vbo, struct page **pages,
out:
for (i = 0; i < pages_per_frame; i++) {
pg = pages[i];
- SetPageUptodate(pg);
+ if (pg)
+ iomap_folio_mark_uptodate(page_folio(pg));
}
return err;
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
2026-09-17 5:53 [syzbot] [ntfs3?] WARNING in ntfs_evict_inode syzbot
2026-09-20 9:11 ` Forwarded: " syzbot
@ 2026-09-20 9:28 ` syzbot
2026-09-20 10:34 ` syzbot
` (6 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-09-20 9:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
Author: adarshdas950@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
index bead01a953f3..5f833a75a829 100644
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -7,6 +7,7 @@
#include <linux/fiemap.h>
#include <linux/fs.h>
+#include <linux/iomap.h>
#include <linux/minmax.h>
#include <linux/vmalloc.h>
@@ -1943,7 +1944,7 @@ int ni_read_folio_cmpr(struct ntfs_inode *ni, struct folio *folio)
if (vbo >= i_size_read(&ni->vfs_inode)) {
folio_zero_range(folio, 0, folio_size(folio));
- folio_mark_uptodate(folio);
+ iomap_folio_mark_uptodate(folio);
err = 0;
goto out;
}
@@ -2521,7 +2522,8 @@ int ni_read_frame(struct ntfs_inode *ni, u64 frame_vbo, struct page **pages,
out:
for (i = 0; i < pages_per_frame; i++) {
pg = pages[i];
- SetPageUptodate(pg);
+ if (pg)
+ iomap_folio_mark_uptodate(page_folio(pg));
}
return err;
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
2026-09-17 5:53 [syzbot] [ntfs3?] WARNING in ntfs_evict_inode syzbot
2026-09-20 9:11 ` Forwarded: " syzbot
2026-09-20 9:28 ` syzbot
@ 2026-09-20 10:34 ` syzbot
2026-09-20 11:01 ` syzbot
` (5 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-09-20 10:34 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
Author: adarshdas950@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 56b4f6469a28..a9b4e288ca20 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -842,7 +842,7 @@ static int ntfs_read_folio(struct file *file, struct folio *folio)
if (ni->i_valid <= vbo) {
folio_zero_range(folio, 0, folio_size(folio));
- folio_mark_uptodate(folio);
+ iomap_folio_mark_uptodate(folio);
folio_unlock(folio);
return 0;
}
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
2026-09-17 5:53 [syzbot] [ntfs3?] WARNING in ntfs_evict_inode syzbot
` (2 preceding siblings ...)
2026-09-20 10:34 ` syzbot
@ 2026-09-20 11:01 ` syzbot
2026-09-20 12:52 ` syzbot
` (4 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-09-20 11:01 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
Author: adarshdas950@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 518e5b794c06
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 56b4f6469a28..a9b4e288ca20 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -842,7 +842,7 @@ static int ntfs_read_folio(struct file *file, struct folio *folio)
if (ni->i_valid <= vbo) {
folio_zero_range(folio, 0, folio_size(folio));
- folio_mark_uptodate(folio);
+ iomap_folio_mark_uptodate(folio);
folio_unlock(folio);
return 0;
}
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
2026-09-17 5:53 [syzbot] [ntfs3?] WARNING in ntfs_evict_inode syzbot
` (3 preceding siblings ...)
2026-09-20 11:01 ` syzbot
@ 2026-09-20 12:52 ` syzbot
2026-09-21 14:04 ` syzbot
` (3 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-09-20 12:52 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
Author: adarshdas950@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 518e5b794c06
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 56b4f6469a28..a9b4e288ca20 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -842,7 +842,7 @@ static int ntfs_read_folio(struct file *file, struct folio *folio)
if (ni->i_valid <= vbo) {
folio_zero_range(folio, 0, folio_size(folio));
- folio_mark_uptodate(folio);
+ iomap_folio_mark_uptodate(folio);
folio_unlock(folio);
return 0;
}
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
2026-09-17 5:53 [syzbot] [ntfs3?] WARNING in ntfs_evict_inode syzbot
` (4 preceding siblings ...)
2026-09-20 12:52 ` syzbot
@ 2026-09-21 14:04 ` syzbot
2026-09-21 14:28 ` Forwarded: [PATCH] debug: log uptodate states for iomap bug syzbot
` (2 subsequent siblings)
8 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-09-21 14:04 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [ntfs3?] WARNING in ntfs_evict_inode
Author: adarshdas950@gmail.com
#syz test
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 56b4f6469a28..a9b4e288ca20 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -842,7 +842,7 @@ static int ntfs_read_folio(struct file *file, struct folio *folio)
if (ni->i_valid <= vbo) {
folio_zero_range(folio, 0, folio_size(folio));
- folio_mark_uptodate(folio);
+ iomap_folio_mark_uptodate(folio);
folio_unlock(folio);
return 0;
}
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: [PATCH] debug: log uptodate states for iomap bug
2026-09-17 5:53 [syzbot] [ntfs3?] WARNING in ntfs_evict_inode syzbot
` (5 preceding siblings ...)
2026-09-21 14:04 ` syzbot
@ 2026-09-21 14:28 ` syzbot
2026-09-21 17:24 ` [PATCH] ntfs3: sync uptodate with iomap folio state in read_folio Adarsh Das
2026-09-21 18:03 ` Forwarded: [PATCH] debug: log uptodate states for iomap bug syzbot
8 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-09-21 14:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] debug: log uptodate states for iomap bug
Author: nsvatoslav515@gmail.com
---
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 238650ef6c7c
fs/iomap/buffered-io.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
index 0a5ebfda90f1..37596bae664d 100644
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -291,8 +291,13 @@ static void ifs_free(struct folio *folio)
return;
WARN_ON_ONCE(ifs->read_bytes_pending != 0);
WARN_ON_ONCE(atomic_read(&ifs->write_bytes_pending));
- WARN_ON_ONCE(ifs_is_fully_uptodate(folio, ifs) !=
- folio_test_uptodate(folio));
+
+ bool ifs_up = ifs_is_fully_uptodate(folio, ifs);
+ bool folio_up = folio_test_uptodate(folio);
+
+ if (WARN_ON_ONCE(ifs_up != folio_up))
+ pr_err("IOMAP DEBUG: ifs_up=%d, folio_up=%d\n", ifs_up, folio_up);
+
kfree(ifs);
}
--
2.47.3
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH] ntfs3: sync uptodate with iomap folio state in read_folio
2026-09-17 5:53 [syzbot] [ntfs3?] WARNING in ntfs_evict_inode syzbot
` (6 preceding siblings ...)
2026-09-21 14:28 ` Forwarded: [PATCH] debug: log uptodate states for iomap bug syzbot
@ 2026-09-21 17:24 ` Adarsh Das
2026-09-21 18:03 ` Forwarded: [PATCH] debug: log uptodate states for iomap bug syzbot
8 siblings, 0 replies; 10+ messages in thread
From: Adarsh Das @ 2026-09-21 17:24 UTC (permalink / raw)
To: almaz.alexandrovich
Cc: ntfs3, linux-kernel, syzkaller-bugs, syzbot+3db654d91b471c4d7a7d,
Adarsh Das
ntfs3 registers iomap page-cache helpers for its regular files. When
the filesystem block size is smaller than the folio size, folios are
backed by iomap_folio_state with a per-block uptodate bitmap in addition
to PG_uptodate.
The i_valid <= vbo early exit in ntfs_read_folio() zeroes folios past
valid data and marks them uptodate with folio_mark_uptodate(), updating
only the folio flag. That leaves the iomap bitmap out of sync and
ifs_free() WARNs during evict when the folio is torn down.
Use iomap_folio_mark_uptodate() to update both the folio uptodate state
and the iomap uptodate bitmap.
Reported-by: syzbot+3db654d91b471c4d7a7d@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/6aab8055.71f81b7d.278072.0016.GAE@google.com/
Tested-by: syzbot+3db654d91b471c4d7a7d@syzkaller.appspotmail.com
Assisted-by: LLM
Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
---
fs/ntfs3/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
index 56b4f6469a28..a9b4e288ca20 100644
--- a/fs/ntfs3/inode.c
+++ b/fs/ntfs3/inode.c
@@ -842,7 +842,7 @@ static int ntfs_read_folio(struct file *file, struct folio *folio)
if (ni->i_valid <= vbo) {
folio_zero_range(folio, 0, folio_size(folio));
- folio_mark_uptodate(folio);
+ iomap_folio_mark_uptodate(folio);
folio_unlock(folio);
return 0;
}
--
2.55.0
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: [PATCH] debug: log uptodate states for iomap bug
2026-09-17 5:53 [syzbot] [ntfs3?] WARNING in ntfs_evict_inode syzbot
` (7 preceding siblings ...)
2026-09-21 17:24 ` [PATCH] ntfs3: sync uptodate with iomap folio state in read_folio Adarsh Das
@ 2026-09-21 18:03 ` syzbot
8 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-09-21 18:03 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] debug: log uptodate states for iomap bug
Author: nsvatoslav515@gmail.com
Signed-off-by: Svyatoslav Nikolenko <nsvatoslav515@gmail.com>
---
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 238650ef6c7c
fs/iomap/buffered-io.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
index 0a5ebfda90f1..37596bae664d 100644
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -291,8 +291,13 @@ static void ifs_free(struct folio *folio)
return;
WARN_ON_ONCE(ifs->read_bytes_pending != 0);
WARN_ON_ONCE(atomic_read(&ifs->write_bytes_pending));
- WARN_ON_ONCE(ifs_is_fully_uptodate(folio, ifs) !=
- folio_test_uptodate(folio));
+
+ bool ifs_up = ifs_is_fully_uptodate(folio, ifs);
+ bool folio_up = folio_test_uptodate(folio);
+
+ if (WARN_ON_ONCE(ifs_up != folio_up))
+ pr_err("IOMAP DEBUG: ifs_up=%d, folio_up=%d\n", ifs_up, folio_up);
+
kfree(ifs);
}
--
2.47.3
^ permalink raw reply [flat|nested] 10+ messages in thread