Re: [PATCH v2] f2fs: evict: truncate page cache before clear_inode

[Chao Yu <chao@kernel.org>]

On 2/25/26 00:54, Taerang Kim wrote:
> syzbot reports a BUG_ON(inode->i_data.nrpages) in clear_inode() when
> mounting a corrupted f2fs image.
> 
> I agree with Dmitry's RFC that dropping page #0 in f2fs_truncate()
> can address this reproducer, since f2fs_convert_inline_inode() may
> grab page #0 via f2fs_grab_cache_folio() and leave it cached on the
> clear_out success path.

I suspect that we may miss some corner cases in f2fs_evict_inode() ->
f2fs_truncate(), can we figure out the root cause of this issue first
rather than just truncating all page cache before clear_inode()?
Otherwise, current fix may cover potential bug.

Thanks,

> 
> However, clear_inode() requires the inode mapping to be empty, and it is
> hard to guarantee that the page cache can only be populated from this
> truncate/inline-conversion path. Make f2fs_evict_inode() defensively
> truncate any remaining page cache before calling clear_inode(), so
> nrpages is guaranteed to be 0 regardless of how the cache was populated.
> 
> Link: https://lore.kernel.org/linux-f2fs-devel/20260206092958.578191-1-dmantipov@yandex.ru/
> Reported-by: syzbot+fc026e87558558f75c00@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=fc026e87558558f75c00
> Signed-off-by: Taerang Kim <kth5965@gmail.com>
> ---
> v2: rebase onto torvalds/master (fsverity_cleanup_inode() not present);
>     fix patch context, no functional change.
> 
>  fs/f2fs/inode.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
> index e0f850b3f0c3..e7942e6e312c 100644
> --- a/fs/f2fs/inode.c
> +++ b/fs/f2fs/inode.c
> @@ -1006,6 +1006,13 @@ void f2fs_evict_inode(struct inode *inode)
>  	}
>  out_clear:
>  	fscrypt_put_encryption_info(inode);
> +	/*
> +	 * Defensively truncate any remaining page cache, e.g.
> +	 * f2fs_convert_inline_inode() called from f2fs_truncate()
> +	 * may leave page #0 behind in the page cache when the
> +	 * inline conversion takes the clear_out success path.
> +	 */
> +	truncate_inode_pages_final(&inode->i_data);
>  	clear_inode(inode);
>  }
>