When a buffered write fails partially (e.g., due to a user page fault) on an ext4 filesystem mounted in data=journal mode with blocksize < PAGE_SIZE, ext4_journalled_write_end() invokes ext4_truncate_failed_write() to discard newly allocated blocks beyond inode->i_size. If the updated inode->i_size straddles a folio whose buffers are currently being committed to the journal, truncate_inode_pages() attempts to partially invalidate that folio via ext4_journalled_invalidate_folio(). Because JBD2 cannot unmap buffers belonging to a committing transaction on a partial folio, journal_unmap_buffer() returns -EBUSY, triggering the WARN_ON() in ext4_journalled_invalidate_folio(). Unlike the standard truncate path in ext4_truncate_down(), ext4_truncate_failed_write() does not wait for the committing transaction on the tail page to finish before truncating the page cache. Export ext4_wait_for_tail_page_commit() and call it in ext4_truncate_failed_write() when data=journal is enabled before acquiring filemap_invalidate_lock() and calling truncate_inode_pages(). Fixes: 53e872681fed ("ext4: fix deadlock in journal_unmap_buffer()") Reported-by: syzbot+f111db4cb2acd44eb2f4@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=f111db4cb2acd44eb2f4 Signed-off-by: Chandradhar Kumar --- fs/ext4/ext4.h | 1 + fs/ext4/inode.c | 2 +- fs/ext4/truncate.h | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h index bf0325ecbec7..cc714d7b292c 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -3215,6 +3215,7 @@ int ext4_get_fc_inode_loc(struct super_block *sb, unsigned long ino, extern int ext4_inode_attach_jinode(struct inode *inode); extern int ext4_can_truncate(struct inode *inode); extern int ext4_truncate(struct inode *); +extern void ext4_wait_for_tail_page_commit(struct inode *inode); extern int ext4_break_layouts(struct inode *); extern int ext4_truncate_page_cache_block_range(struct inode *inode, loff_t start, loff_t end); diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index e3129353d4ed..366345981438 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -6819,7 +6819,7 @@ int ext4_sync_inode_metadata(struct inode *inode, struct writeback_control *wbc) * buffers that are attached to a folio straddling i_size and are undergoing * commit. In that case we have to wait for commit to finish and try again. */ -static void ext4_wait_for_tail_page_commit(struct inode *inode) +void ext4_wait_for_tail_page_commit(struct inode *inode) { unsigned offset; journal_t *journal = EXT4_SB(inode->i_sb)->s_journal; diff --git a/fs/ext4/truncate.h b/fs/ext4/truncate.h index ce84aa2786c7..19ed4673284c 100644 --- a/fs/ext4/truncate.h +++ b/fs/ext4/truncate.h @@ -17,6 +17,9 @@ static inline void ext4_truncate_failed_write(struct inode *inode) * We don't need to call ext4_break_layouts() because the blocks we * are truncating were never visible to userspace. */ + if (ext4_should_journal_data(inode)) + ext4_wait_for_tail_page_commit(inode); + filemap_invalidate_lock(mapping); truncate_inode_pages(mapping, inode->i_size); ext4_truncate(inode); -- 2.56.0