[PATCH] ext4: wait for tail page commit in ext4_truncate_failed_write()

[Chandradhar Kumar <chandradhar.2003@gmail.com>]

When a buffered write fails partially (e.g., due to a user page fault)
on an ext4 filesystem mounted in data=journal mode with blocksize <
PAGE_SIZE, ext4_journalled_write_end() invokes ext4_truncate_failed_write()
to discard newly allocated blocks beyond inode->i_size.

If the updated inode->i_size straddles a folio whose buffers are currently
being committed to the journal, truncate_inode_pages() attempts to
partially invalidate that folio via ext4_journalled_invalidate_folio().
Because JBD2 cannot unmap buffers belonging to a committing transaction
on a partial folio, journal_unmap_buffer() returns -EBUSY, triggering
the WARN_ON() in ext4_journalled_invalidate_folio().

Unlike the standard truncate path in ext4_truncate_down(),
ext4_truncate_failed_write() does not wait for the committing
transaction on the tail page to finish before truncating the page cache.
Export ext4_wait_for_tail_page_commit() and call it in
ext4_truncate_failed_write() when data=journal is enabled before
acquiring filemap_invalidate_lock() and calling truncate_inode_pages().

Fixes: 53e872681fed ("ext4: fix deadlock in journal_unmap_buffer()")
Reported-by: syzbot+f111db4cb2acd44eb2f4@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=f111db4cb2acd44eb2f4
Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>
---
 fs/ext4/ext4.h     | 1 +
 fs/ext4/inode.c    | 2 +-
 fs/ext4/truncate.h | 3 +++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index bf0325ecbec7..cc714d7b292c 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -3215,6 +3215,7 @@ int ext4_get_fc_inode_loc(struct super_block *sb, unsigned long ino,
 extern int ext4_inode_attach_jinode(struct inode *inode);
 extern int ext4_can_truncate(struct inode *inode);
 extern int ext4_truncate(struct inode *);
+extern void ext4_wait_for_tail_page_commit(struct inode *inode);
 extern int ext4_break_layouts(struct inode *);
 extern int ext4_truncate_page_cache_block_range(struct inode *inode,
 						loff_t start, loff_t end);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index e3129353d4ed..366345981438 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -6819,7 +6819,7 @@ int ext4_sync_inode_metadata(struct inode *inode, struct writeback_control *wbc)
  * buffers that are attached to a folio straddling i_size and are undergoing
  * commit. In that case we have to wait for commit to finish and try again.
  */
-static void ext4_wait_for_tail_page_commit(struct inode *inode)
+void ext4_wait_for_tail_page_commit(struct inode *inode)
 {
 	unsigned offset;
 	journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
diff --git a/fs/ext4/truncate.h b/fs/ext4/truncate.h
index ce84aa2786c7..19ed4673284c 100644
--- a/fs/ext4/truncate.h
+++ b/fs/ext4/truncate.h
@@ -17,6 +17,9 @@ static inline void ext4_truncate_failed_write(struct inode *inode)
 	 * We don't need to call ext4_break_layouts() because the blocks we
 	 * are truncating were never visible to userspace.
 	 */
+	if (ext4_should_journal_data(inode))
+		ext4_wait_for_tail_page_commit(inode);
+
 	filemap_invalidate_lock(mapping);
 	truncate_inode_pages(mapping, inode->i_size);
 	ext4_truncate(inode);
-- 
2.56.0