ext4_prepare_inline_data() only checks EXT4_STATE_MAY_INLINE_DATA before creating inline data. However, after ext4_convert_inline_data() converts an inode to use extents, a concurrent write can race and re-create inline data via ext4_create_inline_data(), which re-sets MAY_INLINE_DATA. This leads to an inconsistent state where an extent-based inode has inline data, causing BUG_ON in ext4_do_writepages() when dirty mmap pages exist. The race window is between ext4_convert_inline_data() clearing MAY_INLINE_DATA and the concurrent write checking it: page_mkwrite: write: ext4_convert_inline_data() ext4_da_write_begin() ext4_has_inline_data = false MAY_INLINE_DATA set (from iget) clear MAY_INLINE_DATA ext4_prepare_inline_data() return 0 ext4_create_inline_data() success! block_page_mkwrite() success re-sets MAY_INLINE_DATA! folio dirty, PTE writable writepages: ext4_has_inline_data = TRUE MAY_INLINE_DATA = TRUE dirty page exists -> BUG_ON! Fix this by adding a check for EXT4_INODE_EXTENTS in ext4_prepare_inline_data(). Once an inode has been converted to use extents, it must never go back to inline data regardless of the MAY_INLINE_DATA state. Reported-by: syzbot+d1da16f03614058fdc48@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d1da16f03614058fdc48 Fixes: 7b4cc9787fe3 ("ext4: evict inline data when writing to memory map") Signed-off-by: Yun Zhou --- An alternative (or complementary) approach would be to convert inline data at mmap_prepare time (ext4_file_mmap_prepare) rather than at page_mkwrite time. This eliminates the race window entirely by converting before the mapping is established, making both this fix and commit 7b4cc9787fe3 unnecessary. fs/ext4/inline.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index 26d9164d0609..f9af38620cc7 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -418,6 +418,13 @@ static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode, return -ENOSPC; ext4_write_lock_xattr(inode, &no_expand); + + /* Once converted to extents, never go back to inline data. */ + if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) { + ext4_write_unlock_xattr(inode, &no_expand); + return -ENOSPC; + } + /* * ei->i_inline_size may have changed since the initial check * if other xattrs were added. Recalculate to ensure -- 2.43.0