During directory rename operations with synchronous directory updates enabled, vfat_update_dotdot_de() writes the ".." directory entry via sync_dirty_buffer(). If this write fails due to an I/O error, the block layer clears the BH_Uptodate flag. When rename enters its error rollback path, it calls vfat_update_dotdot_de() again with the same buffer head, which calls mmb_mark_buffer_dirty() and triggers a "!buffer_uptodate(bh)" warning in mark_buffer_dirty(). Fix this by locking the buffer head in vfat_update_dotdot_de() and checking buffer_uptodate() before modifying the entry. If the buffer is not uptodate, unlock it and return -EIO, preventing mmb_mark_buffer_dirty() from being called on a non-uptodate buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: Gemini:gemini-3.8-flash syzbot Reported-by: syzbot+b0aebd03565f5774f7f8@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b0aebd03565f5774f7f8 Link: https://syzkaller.appspot.com/ai_job?id=27914cea-b3da-4f37-a39a-cc2d26c706b7 To: "OGAWA Hirofumi" To: To: "Linus Torvalds" --- v2: - Lock the buffer head and return -EIO if it is not uptodate instead of calling set_buffer_uptodate(). - Update the patch subject to reflect buffer validation. - Shorten the commit description and remove the stack trace. v1: https://lore.kernel.org/all/012d4ac1-83f3-48af-8781-00fbbc4adc93@mail.kernel.org/T/ --- diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c index da3e89c0b..1e7fd4003 100644 --- a/fs/fat/namei_vfat.c +++ b/fs/fat/namei_vfat.c @@ -913,8 +913,14 @@ static int vfat_update_dotdot_de(struct inode *dir, struct inode *inode, struct buffer_head *dotdot_bh, struct msdos_dir_entry *dotdot_de) { + lock_buffer(dotdot_bh); + if (!buffer_uptodate(dotdot_bh)) { + unlock_buffer(dotdot_bh); + return -EIO; + } fat_set_start(dotdot_de, MSDOS_I(dir)->i_logstart); mmb_mark_buffer_dirty(dotdot_bh, &MSDOS_I(inode)->i_metadata_bhs); + unlock_buffer(dotdot_bh); if (IS_DIRSYNC(dir)) return sync_dirty_buffer(dotdot_bh); return 0; base-commit: 93f51579e7df248780214094418f205253383cc5 -- This is an AI-generated patch subject to moderation. Reply with '#syz upstream' to Sign-off the patch as a human author and send it to the upstream kernel mailing lists. Reply with '#syz reject' to reject it ('#syz unreject' to undo). See https://goo.gle/syzbot-ai-patches for information about AI-generated patches. You can comment on the patch as usual, syzbot will try to address the comments and send a new version of the patch if necessary. syzbot engineers can be reached at syzkaller@googlegroups.com.