[BUG] bfs: WARNING in mark_buffer_dirty when extending a file

[BUG] bfs: WARNING in mark_buffer_dirty when extending a file

[CJ]

Hi,


I am reporting an issue triggered by a syzkaller reproducer on Linux
7.3.0-rc2. The issue is reproducible with HEAD commit
df2908090cda368b01ff43709f51890076c56157.


The reproducer mounts a crafted bfs image and then makes the kernel write
into a file on that filesystem. The writer is not a userspace write: the
call path shows __kernel_write() reached from __dump_emit()/writenote(),
i.e. the ELF core-dump note writer, so a process dumping core onto the
crafted filesystem is what reaches bfs_get_block().


Extending the file makes bfs_get_block() decide that the whole file has to
be moved to the next free block. The buffer head it ends up with was never
read from disk, so it is not uptodate, and mark_buffer_dirty() reports that
through WARN_ON_ONCE(!buffer_uptodate(bh)) at fs/buffer.c:991. The call path
is bfs_get_block() -> __block_write_begin_int() -> block_write_begin() ->
bfs_write_begin() -> generic_perform_write().


This looks like the block-move path in bfs_get_block() computing a physical
block whose buffer is not backed by anything read from the device, and then
marking it dirty anyway. The same call path was reported earlier against
linux-6.1, where the same function failed with a null-pointer dereference
inside bfs_move_blocks() at fs/bfs/file.c:125; the caller path there was
identical, so the underlying computation appears unchanged even though the
observable symptom now is the uptodate assertion rather than a fault. I have
not traced which value in the move path is wrong.


This failure was reported earlier against the linux-6.1 longterm series at
https://syzkaller.appspot.com/bug?extid=3b7bfa480e59af94f896, and the
reproducer below is the one from that report. It still reproduces on the
tested mainline kernel.


Reproducer:


syz reproducer:  https://pastebin.com/raw/Kcp02qdq
console output:  https://pastebin.com/raw/G717PGNZ
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=4a782518325cb082


Kernel:


HEAD commit: df2908090cda368b01ff43709f51890076c56157
git tree: mainline
kernel version: 7.3.0-rc2
tested tag: v7.3-rc2 (annotated tag object 5e036ce12de91c6fd674dad33b169c6150be2a7a)


Let me know if you need more details or testing.


Best regards,
Changjian Liu