When the data=journal mount option is used, the ext4_journalled_write_end() function incorrectly calls ext4_write_inline_data_end() without checking if the EXT4_STATE_MAY_INLINE_DATA flag is still set on the inode. If a previous attempt to convert the inline data to an extent failed (e.g. due to ENOSPC), the EXT4_STATE_MAY_INLINE_DATA flag is cleared, but the EXT4_INODE_INLINE_DATA flag remains set. In this scenario, the next call to ext4_write_begin() will not prepare the inline data xattr for writing, but ext4_journalled_write_end() will incorrectly attempt to write to it, triggering a BUG_ON(pos + len > EXT4_I(inode)->i_inline_size) in ext4_write_inline_data() since i_inline_size was not expanded. Additionally, a concurrent ext4_page_mkwrite() can execute ext4_convert_inline_data() between ext4_write_begin() and ext4_write_end() since it only takes xattr_sem. This concurrent path converts the inline data to an extent and clears both the EXT4_INODE_INLINE_DATA and EXT4_STATE_MAY_INLINE_DATA flags. Since the block buffers were not allocated in ext4_write_begin(), falling through to the block fallback path causes a NULL pointer dereference because folio_buffers(folio) is NULL. Fix this by ensuring that the write_end functions (including ext4_write_end() and ext4_da_do_write_end()) safely return 0 to trigger a VFS retry if they detect folio_buffers(folio) is NULL after falling through from the inline data check. Returning 0 signals generic_perform_write() to revert the write iterator and retry the entire write operation, which will then properly allocate block buffers. Reported-by: syzbot+0c89d865531d053abb2d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0c89d865531d053abb2d Fixes: 3fdcfb668fd7 ("ext4: add journalled write support for inline data") Signed-off-by: Aditya Prakash Srivastava --- v2: - Address TOCTOU race condition (reported by Sashiko AI review): A concurrent ext4_page_mkwrite() can execute ext4_convert_inline_data() which takes xattr_sem and converts the inline data to extents, clearing both EXT4_INODE_INLINE_DATA and EXT4_STATE_MAY_INLINE_DATA flags between ext4_write_begin() and write_end(). - Safely return 0 from write_end functions if folio_buffers(folio) is NULL to trigger a VFS retry. This prevents a NULL pointer dereference in ext4_journalled_zero_new_buffers() and ext4_walk_page_buffers(). - Add check for ext4_write_end() and ext4_da_do_write_end(). fs/ext4/inode.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index c2c2d6ac7f3d..d6c934b2ae31 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -1455,6 +1455,13 @@ static int ext4_write_end(const struct kiocb *iocb, return ext4_write_inline_data_end(inode, pos, len, copied, folio); + if (unlikely(!folio_buffers(folio))) { + folio_unlock(folio); + folio_put(folio); + ext4_journal_stop(handle); + return 0; + } + copied = block_write_end(pos, len, copied, folio); /* * it's important to update i_size while still holding folio lock: @@ -1560,10 +1567,18 @@ static int ext4_journalled_write_end(const struct kiocb *iocb, BUG_ON(!ext4_handle_valid(handle)); - if (ext4_has_inline_data(inode)) + if (ext4_has_inline_data(inode) && + ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) return ext4_write_inline_data_end(inode, pos, len, copied, folio); + if (unlikely(!folio_buffers(folio))) { + folio_unlock(folio); + folio_put(folio); + ext4_journal_stop(handle); + return 0; + } + if (unlikely(copied < len) && !folio_test_uptodate(folio)) { copied = 0; ext4_journalled_zero_new_buffers(handle, inode, folio, @@ -3231,7 +3246,7 @@ static int ext4_da_do_write_end(struct address_space *mapping, if (unlikely(!folio_buffers(folio))) { folio_unlock(folio); folio_put(folio); - return -EIO; + return 0; } /* * block_write_end() will mark the inode as dirty with I_DIRTY_PAGES -- 2.47.3