Forwarded: [PATCH] ext4: fix race condition in ext4_write_end() with inline data conversion

[syzbot <syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] ext4: fix race condition in ext4_write_end() with inline data conversion
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci

A race condition exists between ext4_write_end() checking for inline data
and the inline-to-block conversion path clearing the inline flags.

Thread A (write completion):
  - Checks ext4_has_inline_data(inode) = TRUE (no lock held)
  - Checks EXT4_STATE_MAY_INLINE_DATA = TRUE (no lock held)

Thread B (conversion via mmap/readahead):
  - Acquires i_data_sem write lock
  - Clears EXT4_INODE_INLINE_DATA flag
  - Clears EXT4_STATE_MAY_INLINE_DATA state
  - Releases i_data_sem

Thread A (resumes):
  - Calls ext4_write_inline_data_end()
  - BUG_ON(!ext4_has_inline_data(inode)) fails
  - Kernel crashes

The fix is to acquire i_data_sem read lock in ext4_write_end() around
the inline data check and handler, serializing against the conversion
path which holds the write lock.

Reported-by: syzbot+293a57918b36cfae3d48@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=293a57918b36cfae3d48
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 fs/ext4/inode.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ce99807c5f5b..9a5347907685 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1450,11 +1450,17 @@ static int ext4_write_end(const struct kiocb *iocb,
 
 	trace_ext4_write_end(inode, pos, len, copied);
 
+	down_read(&EXT4_I(inode)->i_data_sem);
+	/* Serialize against inline data conversion (see ext4_convert_inline_data_nolock) */
 	if (ext4_has_inline_data(inode) &&
-	    ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))
-		return ext4_write_inline_data_end(inode, pos, len, copied,
+	    ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) {
+		ret = ext4_write_inline_data_end(inode, pos, len, copied,
 						  folio);
+		up_read(&EXT4_I(inode)->i_data_sem);
+		return ret;
+	}
 
+	up_read(&EXT4_I(inode)->i_data_sem);
 	copied = block_write_end(pos, len, copied, folio);
 	/*
 	 * it's important to update i_size while still holding folio lock:
-- 
2.43.0