[PATCH] ext4: wait for tail page commit before truncating a failed write

[diasyzhangqing@gmail.com]

From: Qing Zhang <diasyzhang@tencent.com>

In data=journal mode, a failed extending write can leave buffers beyond
i_size attached to the committing transaction. When blocksize < PAGE_SIZE,
invalidating these buffers in the partial tail folio returns -EBUSY,
triggering a warning in ext4_journalled_invalidate_folio() and leaving
invalidation incomplete.

Call ext4_wait_for_tail_page_commit() before truncating the page cache
in ext4_truncate_failed_write(), as is already done when shrinking a file
via ext4_setattr(). The helper releases the folio lock before waiting
for the commit to finish, then retries invalidation.

Fixes: 53e872681fed ("ext4: fix deadlock in journal_unmap_buffer()")
Reported-by: syzbot+f111db4cb2acd44eb2f4@syzkaller.appspotmail.com
Closes: https://syzbot.appspot.com/bug?extid=f111db4cb2acd44eb2f4
Signed-off-by: Qing Zhang <diasyzhang@tencent.com>
---
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

 fs/ext4/ext4.h    | 1 +
 fs/ext4/inode.c   | 2 +-
 fs/ext4/truncate.h |  2 ++
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index f38fec3167fb..505ec38fa508 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -3214,6 +3214,7 @@ int ext4_get_fc_inode_loc(struct super_block *sb, unsigned int ino,
 extern int ext4_inode_attach_jinode(struct inode *inode);
 extern int ext4_can_truncate(struct inode *inode);
 extern int ext4_truncate(struct inode *);
+extern void ext4_wait_for_tail_page_commit(struct inode *inode);
 extern int ext4_break_layouts(struct inode *);
 extern int ext4_truncate_page_cache_block_range(struct inode *inode,
 						loff_t start, loff_t end);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 10cd85d4c721..f59c4a5b7561 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -6845,7 +6845,7 @@ int ext4_sync_inode_metadata(struct inode *inode, struct writeback_control *wbc)
  * buffers that are attached to a folio straddling i_size and are undergoing
  * commit. In that case we have to wait for commit to finish and try again.
  */
-static void ext4_wait_for_tail_page_commit(struct inode *inode)
+void ext4_wait_for_tail_page_commit(struct inode *inode)
 {
 	unsigned offset;
 	journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
diff --git a/fs/ext4/truncate.h b/fs/ext4/truncate.h
index ce84aa2786c7..c10e4ab4242e 100644
--- a/fs/ext4/truncate.h
+++ b/fs/ext4/truncate.h
@@ -17,6 +17,8 @@ static inline void ext4_truncate_failed_write(struct inode *inode)
 	 * We don't need to call ext4_break_layouts() because the blocks we
 	 * are truncating were never visible to userspace.
 	 */
 	filemap_invalidate_lock(mapping);
+	if (ext4_should_journal_data(inode))
+		ext4_wait_for_tail_page_commit(inode);
 	truncate_inode_pages(mapping, inode->i_size);
 	ext4_truncate(inode);
 	filemap_invalidate_unlock(mapping);
-- 
2.43.0