From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1C759367F27 for ; Mon, 9 Mar 2026 07:44:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773042281; cv=none; b=DK4wwJ5sJG6sdGXvnVaskmHKXN7F8Fj6nVMkBN5d/gjjSWoyOAfe1iXEfAAvHBuclg7sM5ky9q1YODdKjQVHMVofZ1mvo0OIcNGoQpwN/VbRC6Phg1orVNVzEh0LNca4Uakg7RfU3ow1haVwtGAXv21bgp1zs6FWLZSN9Zlo8Aw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773042281; c=relaxed/simple; bh=ZegLcoI9M6oQ95oOXLJ0eKVaKiWl94Map1upXRf8d88=; h=Message-ID:Date:MIME-Version:Cc:Subject:To:References:From: In-Reply-To:Content-Type; b=pm6t3LliYL8g8c8mNh+WuaBxwWm7qAbxQjfcp110s/0NiuMcBrFhtL/O/7E7/nMO0LgQqjwlx6XP8kSBpa9M5dac74ziOJLgP5mxX32iC/hCPq7lvtXjWDKCcheIYe1VB2APiCKqJYpRA6m9tvwqPJ98WS8mYGw+rmear32b4uM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Tj/PwWIF; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Tj/PwWIF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 67401C4CEF7; Mon, 9 Mar 2026 07:44:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1773042280; bh=ZegLcoI9M6oQ95oOXLJ0eKVaKiWl94Map1upXRf8d88=; h=Date:Cc:Subject:To:References:From:In-Reply-To:From; b=Tj/PwWIFrPIcNo4/as8pzs3tmSqLSZxo9cUkYjbt5xgxUr5f43C3l53bYfzdSUZJ+ bkfgAOb/0Qfwv0Rd4YRSKhdSEB+F3qEod8QIkksiDmer3V0NTZU0qWopmoDHxk+ulM eoe/RgZT5rhlrcSQGONX8iV5tXxpTTQYOJVe8caKWazIqDjNTnYAqZ10ZzfE6REZHG VQvYBZYrl6PfV8zxGWcb2HACwOH3akhiz4uQ0Sa8qvw7Tr5D5vC1jSDTbQ8MZrTWT8 91KZ1R/NxqI/dIPfl9rGyraYGjYhPeWA18NDPouBHUIk0vQA+KP6ihUrsuCngafhOl z+MP1DM7jbCsQ== Message-ID: <9df7bc57-f0e1-4c7b-9ce1-0017eab62c2a@kernel.org> Date: Mon, 9 Mar 2026 15:44:34 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Cc: chao@kernel.org, linux-f2fs-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, syzbot+fc026e87558558f75c00@syzkaller.appspotmail.com Subject: Re: [PATCH v2] f2fs: evict: truncate page cache before clear_inode To: Taerang Kim , jaegeuk@kernel.org References: <20260224160654.448538-1-kth5965@gmail.com> <20260224165408.450957-1-kth5965@gmail.com> Content-Language: en-US From: Chao Yu In-Reply-To: <20260224165408.450957-1-kth5965@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 2/25/26 00:54, Taerang Kim wrote: > syzbot reports a BUG_ON(inode->i_data.nrpages) in clear_inode() when > mounting a corrupted f2fs image. > > I agree with Dmitry's RFC that dropping page #0 in f2fs_truncate() > can address this reproducer, since f2fs_convert_inline_inode() may > grab page #0 via f2fs_grab_cache_folio() and leave it cached on the > clear_out success path. I suspect that we may miss some corner cases in f2fs_evict_inode() -> f2fs_truncate(), can we figure out the root cause of this issue first rather than just truncating all page cache before clear_inode()? Otherwise, current fix may cover potential bug. Thanks, > > However, clear_inode() requires the inode mapping to be empty, and it is > hard to guarantee that the page cache can only be populated from this > truncate/inline-conversion path. Make f2fs_evict_inode() defensively > truncate any remaining page cache before calling clear_inode(), so > nrpages is guaranteed to be 0 regardless of how the cache was populated. > > Link: https://lore.kernel.org/linux-f2fs-devel/20260206092958.578191-1-dmantipov@yandex.ru/ > Reported-by: syzbot+fc026e87558558f75c00@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=fc026e87558558f75c00 > Signed-off-by: Taerang Kim > --- > v2: rebase onto torvalds/master (fsverity_cleanup_inode() not present); > fix patch context, no functional change. > > fs/f2fs/inode.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c > index e0f850b3f0c3..e7942e6e312c 100644 > --- a/fs/f2fs/inode.c > +++ b/fs/f2fs/inode.c > @@ -1006,6 +1006,13 @@ void f2fs_evict_inode(struct inode *inode) > } > out_clear: > fscrypt_put_encryption_info(inode); > + /* > + * Defensively truncate any remaining page cache, e.g. > + * f2fs_convert_inline_inode() called from f2fs_truncate() > + * may leave page #0 behind in the page cache when the > + * inline conversion takes the clear_out success path. > + */ > + truncate_inode_pages_final(&inode->i_data); > clear_inode(inode); > } >