| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/06/23 08:49 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": [
"EXT4_FS",
"EXT4_FS_POSIX_ACL",
"EXT4_FS_SECURITY"
],
"FocusSymbols": [
"ext4_ea_inode_work",
"ext4_put_ea_inode",
"ext4_xattr_delete_inode",
"ext4_xattr_inode_dec_ref_all",
"ext4_xattr_block_set",
"ext4_xattr_ibody_set",
"ext4_xattr_set_entry",
"ext4_xattr_inode_lookup_create",
"ext4_xattr_inode_create"
],
"Reasoning": "The patch introduces a deferred iput mechanism for ext4 EA (Extended Attribute) inodes to resolve lock ordering issues. It modifies how EA inodes are released by queuing them to a lockless list and processing them in a workqueue (`ext4_ea_inode_work`). This is a functional change to the core logic of ext4 xattr handling and should be fuzzed to ensure no use-after-free, memory leaks, or race conditions occur during EA inode eviction.",
"WorthFuzzing": true
} |
| 1/1 | 2026/06/23 08:49 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 1addeb066b7dca7c0034f33bba9de4dc998cd017\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Jun 23 08:49:49 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h\nindex b37c136ea3ab33..b9b0ada7774bb4 100644\n--- a/fs/ext4/ext4.h\n+++ b/fs/ext4/ext4.h\n@@ -1070,8 +1070,14 @@ struct ext4_inode_info {\n \t * between readers of EAs and writers of regular file data, so\n \t * instead we synchronize on xattr_sem when reading or changing\n \t * EAs.\n+\t *\n+\t * EA inodes (EXT4_EA_INODE_FL) do not use xattr_sem; they reuse\n+\t * the space for deferred iput linkage.\n \t */\n-\tstruct rw_semaphore xattr_sem;\n+\tunion {\n+\t\tstruct rw_semaphore xattr_sem;\n+\t\tstruct llist_node i_ea_iput_node;\n+\t};\n \n \t/*\n \t * Inodes with EXT4_STATE_ORPHAN_FILE use i_orphan_idx. Otherwise\n@@ -1770,6 +1776,11 @@ struct ext4_sb_info {\n \tstruct ext4_es_stats s_es_stats;\n \tstruct mb_cache *s_ea_block_cache;\n \tstruct mb_cache *s_ea_inode_cache;\n+\n+\t/* Deferred iput for EA inodes to avoid lock ordering issues */\n+\tstruct llist_head s_ea_inode_to_free;\n+\tstruct delayed_work s_ea_inode_work;\n+\n \tspinlock_t s_es_lock ____cacheline_aligned_in_smp;\n \n \t/* Journal triggers for checksum computation */\ndiff --git a/fs/ext4/inode.c b/fs/ext4/inode.c\nindex ce99807c5f5b2c..747c52c232cc03 100644\n--- a/fs/ext4/inode.c\n+++ b/fs/ext4/inode.c\n@@ -176,7 +176,6 @@ void ext4_evict_inode(struct inode *inode)\n \t * (xattr block freeing), bitmap, group descriptor (inode freeing)\n \t */\n \tint extra_credits = 6;\n-\tstruct ext4_xattr_inode_array *ea_inode_array = NULL;\n \tbool freeze_protected = false;\n \n \ttrace_ext4_evict_inode(inode);\n@@ -281,8 +280,7 @@ void ext4_evict_inode(struct inode *inode)\n \t}\n \n \t/* Remove xattr references. */\n-\terr = ext4_xattr_delete_inode(handle, inode, \u0026ea_inode_array,\n-\t\t\t\t extra_credits);\n+\terr = ext4_xattr_delete_inode(handle, inode, extra_credits);\n \tif (err) {\n \t\text4_warning(inode-\u003ei_sb, \"xattr delete (err %d)\", err);\n stop_handle:\n@@ -290,7 +288,6 @@ void ext4_evict_inode(struct inode *inode)\n \t\text4_orphan_del(NULL, inode);\n \t\tif (freeze_protected)\n \t\t\tsb_end_intwrite(inode-\u003ei_sb);\n-\t\text4_xattr_inode_array_free(ea_inode_array);\n \t\tgoto no_delete;\n \t}\n \n@@ -320,7 +317,6 @@ void ext4_evict_inode(struct inode *inode)\n \text4_journal_stop(handle);\n \tif (freeze_protected)\n \t\tsb_end_intwrite(inode-\u003ei_sb);\n-\text4_xattr_inode_array_free(ea_inode_array);\n \treturn;\n no_delete:\n \t/*\ndiff --git a/fs/ext4/super.c b/fs/ext4/super.c\nindex 245f67d10ded34..97f0e7c1b254f7 100644\n--- a/fs/ext4/super.c\n+++ b/fs/ext4/super.c\n@@ -1303,6 +1303,8 @@ static void ext4_put_super(struct super_block *sb)\n \t\t\t \u0026sb-\u003es_uuid);\n \n \text4_unregister_li_request(sb);\n+\t/* Drain deferred EA inode iputs while quota is still active. */\n+\text4_drain_ea_inode_work(sbi);\n \text4_quotas_off(sb, EXT4_MAXQUOTAS);\n \n \tdestroy_workqueue(sbi-\u003ersv_conversion_wq);\n@@ -1423,6 +1425,13 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)\n \tmemset(\u0026ei-\u003ei_dquot, 0, sizeof(ei-\u003ei_dquot));\n #endif\n \tei-\u003ejinode = NULL;\n+\t/*\n+\t * Reinitialize xattr_sem every allocation because EA inodes\n+\t * share this space with i_ea_iput_node (via union) which may\n+\t * have overwritten the semaphore when the slab object was\n+\t * previously used as an EA inode.\n+\t */\n+\tinit_rwsem(\u0026ei-\u003exattr_sem);\n \tINIT_LIST_HEAD(\u0026ei-\u003ei_rsv_conversion_list);\n \tspin_lock_init(\u0026ei-\u003ei_completed_io_lock);\n \tei-\u003ei_sync_tid = 0;\n@@ -1488,7 +1497,6 @@ static void init_once(void *foo)\n \tstruct ext4_inode_info *ei = foo;\n \n \tINIT_LIST_HEAD(\u0026ei-\u003ei_orphan);\n-\tinit_rwsem(\u0026ei-\u003exattr_sem);\n \tinit_rwsem(\u0026ei-\u003ei_data_sem);\n \tinode_init_once(\u0026ei-\u003evfs_inode);\n \text4_fc_init_inode(\u0026ei-\u003evfs_inode);\n@@ -5508,6 +5516,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)\n \t * The first inode we look at is the journal inode. Don't try\n \t * root first: it may be modified in the journal!\n \t */\n+\text4_init_ea_inode_work(sbi);\n+\n \tif (!test_opt(sb, NOLOAD) \u0026\u0026 ext4_has_feature_journal(sb)) {\n \t\terr = ext4_load_and_init_journal(sb, es, ctx);\n \t\tif (err)\n@@ -5747,6 +5757,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)\n \treturn 0;\n \n failed_mount9:\n+\t/* Drain deferred EA inode iputs before quota shutdown */\n+\text4_drain_ea_inode_work(sbi);\n \text4_quotas_off(sb, EXT4_MAXQUOTAS);\n failed_mount8: __maybe_unused\n \text4_release_orphan_info(sb);\n@@ -5767,6 +5779,8 @@ failed_mount8: __maybe_unused\n \tif (EXT4_SB(sb)-\u003ersv_conversion_wq)\n \t\tdestroy_workqueue(EXT4_SB(sb)-\u003ersv_conversion_wq);\n failed_mount_wq:\n+\t/* Drain deferred EA inode iputs before freeing structures */\n+\text4_drain_ea_inode_work(sbi);\n \text4_xattr_destroy_cache(sbi-\u003es_ea_inode_cache);\n \tsbi-\u003es_ea_inode_cache = NULL;\n \n@@ -5777,6 +5791,8 @@ failed_mount8: __maybe_unused\n \t\text4_journal_destroy(sbi, sbi-\u003es_journal);\n \t}\n failed_mount3a:\n+\t/* Drain deferred EA inode iputs from journal replay */\n+\text4_drain_ea_inode_work(sbi);\n \text4_es_unregister_shrinker(sbi);\n failed_mount3:\n \t/* flush s_sb_upd_work before sbi destroy */\ndiff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c\nindex 982a1f831e2282..7f334349bd4f7d 100644\n--- a/fs/ext4/xattr.c\n+++ b/fs/ext4/xattr.c\n@@ -114,10 +114,6 @@ const struct xattr_handler * const ext4_xattr_handlers[] = {\n #define EA_INODE_CACHE(inode)\t(((struct ext4_sb_info *) \\\n \t\t\t\tinode-\u003ei_sb-\u003es_fs_info)-\u003es_ea_inode_cache)\n \n-static int\n-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,\n-\t\t\tstruct inode *inode);\n-\n #ifdef CONFIG_LOCKDEP\n void ext4_xattr_inode_set_class(struct inode *ea_inode)\n {\n@@ -567,7 +563,7 @@ ext4_xattr_inode_get(struct inode *inode, struct ext4_xattr_entry *entry,\n \t\t\t\t\tea_inode-\u003ei_ino, true /* reusable */);\n \t}\n out:\n-\tiput(ea_inode);\n+\text4_put_ea_inode(inode-\u003ei_sb, ea_inode);\n \treturn err;\n }\n \n@@ -1104,10 +1100,10 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,\n \t\terr = ext4_xattr_inode_inc_ref(handle, ea_inode);\n \t\tif (err) {\n \t\t\text4_warning_inode(ea_inode, \"inc ref error %d\", err);\n-\t\t\tiput(ea_inode);\n+\t\t\text4_put_ea_inode(parent-\u003ei_sb, ea_inode);\n \t\t\tgoto cleanup;\n \t\t}\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(parent-\u003ei_sb, ea_inode);\n \t}\n \treturn 0;\n \n@@ -1133,7 +1129,7 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err)\n \t\t\text4_warning_inode(ea_inode, \"cleanup dec ref error %d\",\n \t\t\t\t\t err);\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(parent-\u003ei_sb, ea_inode);\n \t}\n \treturn saved_err;\n }\n@@ -1160,7 +1156,6 @@ static void\n ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\t\t struct buffer_head *bh,\n \t\t\t struct ext4_xattr_entry *first, bool block_csum,\n-\t\t\t struct ext4_xattr_inode_array **ea_inode_array,\n \t\t\t int extra_credits, bool skip_quota)\n {\n \tstruct inode *ea_inode;\n@@ -1197,14 +1192,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err)\n \t\t\tcontinue;\n \n-\t\terr = ext4_expand_inode_array(ea_inode_array, ea_inode);\n-\t\tif (err) {\n-\t\t\text4_warning_inode(ea_inode,\n-\t\t\t\t\t \"Expand inode array err=%d\", err);\n-\t\t\tiput(ea_inode);\n-\t\t\tcontinue;\n-\t\t}\n-\n \t\terr = ext4_journal_ensure_credits_fn(handle, credits, credits,\n \t\t\text4_free_metadata_revoke_credits(parent-\u003ei_sb, 1),\n \t\t\text4_xattr_restart_fn(handle, parent, bh, block_csum,\n@@ -1212,6 +1199,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err \u003c 0) {\n \t\t\text4_warning_inode(ea_inode, \"Ensure credits err=%d\",\n \t\t\t\t\t err);\n+\t\t\text4_put_ea_inode(parent-\u003ei_sb, ea_inode);\n \t\t\tcontinue;\n \t\t}\n \t\tif (err \u003e 0) {\n@@ -1221,6 +1209,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\t\t\text4_warning_inode(ea_inode,\n \t\t\t\t\t\t\"Re-get write access err=%d\",\n \t\t\t\t\t\terr);\n+\t\t\t\text4_put_ea_inode(parent-\u003ei_sb, ea_inode);\n \t\t\t\tcontinue;\n \t\t\t}\n \t\t}\n@@ -1229,6 +1218,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tif (err) {\n \t\t\text4_warning_inode(ea_inode, \"ea_inode dec ref err=%d\",\n \t\t\t\t\t err);\n+\t\t\text4_put_ea_inode(parent-\u003ei_sb, ea_inode);\n \t\t\tcontinue;\n \t\t}\n \n@@ -1245,6 +1235,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n \t\tentry-\u003ee_value_inum = 0;\n \t\tentry-\u003ee_value_size = 0;\n \n+\t\text4_put_ea_inode(parent-\u003ei_sb, ea_inode);\n \t\tdirty = true;\n \t}\n \n@@ -1271,7 +1262,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,\n static void\n ext4_xattr_release_block(handle_t *handle, struct inode *inode,\n \t\t\t struct buffer_head *bh,\n-\t\t\t struct ext4_xattr_inode_array **ea_inode_array,\n \t\t\t int extra_credits)\n {\n \tstruct mb_cache *ea_block_cache = EA_BLOCK_CACHE(inode);\n@@ -1313,7 +1303,6 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,\n \t\t\text4_xattr_inode_dec_ref_all(handle, inode, bh,\n \t\t\t\t\t\t BFIRST(bh),\n \t\t\t\t\t\t true /* block_csum */,\n-\t\t\t\t\t\t ea_inode_array,\n \t\t\t\t\t\t extra_credits,\n \t\t\t\t\t\t true /* skip_quota */);\n \t\text4_free_blocks(handle, inode, bh, 0, 1,\n@@ -1505,7 +1494,7 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,\n \t\t\tif (ext4_xattr_inode_dec_ref(handle, ea_inode))\n \t\t\t\text4_warning_inode(ea_inode,\n \t\t\t\t\t\"cleanup dec ref error %d\", err);\n-\t\t\tiput(ea_inode);\n+\t\t\text4_put_ea_inode(inode-\u003ei_sb, ea_inode);\n \t\t\treturn ERR_PTR(err);\n \t\t}\n \n@@ -1564,7 +1553,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,\n \t\t\tkvfree(ea_data);\n \t\t\treturn ea_inode;\n \t\t}\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(inode-\u003ei_sb, ea_inode);\n \tnext_entry:\n \t\tce = mb_cache_entry_find_next(ea_inode_cache, ce);\n \t}\n@@ -1615,7 +1604,7 @@ static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,\n \t\t\t\t ea_inode-\u003ei_ino, true /* reusable */);\n \treturn ea_inode;\n out_err:\n-\tiput(ea_inode);\n+\text4_put_ea_inode(inode-\u003ei_sb, ea_inode);\n \text4_xattr_inode_free_quota(inode, NULL, value_len);\n \treturn ERR_PTR(err);\n }\n@@ -1848,7 +1837,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,\n \n \tret = 0;\n out:\n-\tiput(old_ea_inode);\n+\text4_put_ea_inode(inode-\u003ei_sb, old_ea_inode);\n \treturn ret;\n }\n \n@@ -2010,7 +1999,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \t\t\t\told_ea_inode_quota = le32_to_cpu(\n \t\t\t\t\t\ts-\u003ehere-\u003ee_value_size);\n \t\t\t}\n-\t\t\tiput(tmp_inode);\n+\t\t\text4_put_ea_inode(inode-\u003ei_sb, tmp_inode);\n \n \t\t\ts-\u003ehere-\u003ee_value_inum = 0;\n \t\t\ts-\u003ehere-\u003ee_value_size = 0;\n@@ -2150,7 +2139,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \t\t\t\t\text4_warning_inode(ea_inode,\n \t\t\t\t\t\t\t \"dec ref error=%d\",\n \t\t\t\t\t\t\t error);\n-\t\t\t\tiput(ea_inode);\n+\t\t\t\text4_put_ea_inode(inode-\u003ei_sb, ea_inode);\n \t\t\t\tea_inode = NULL;\n \t\t\t}\n \n@@ -2182,12 +2171,8 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \n \t/* Drop the previous xattr block. */\n \tif (bs-\u003ebh \u0026\u0026 bs-\u003ebh != new_bh) {\n-\t\tstruct ext4_xattr_inode_array *ea_inode_array = NULL;\n-\n \t\text4_xattr_release_block(handle, inode, bs-\u003ebh,\n-\t\t\t\t\t \u0026ea_inode_array,\n \t\t\t\t\t 0 /* extra_credits */);\n-\t\text4_xattr_inode_array_free(ea_inode_array);\n \t}\n \terror = 0;\n \n@@ -2203,7 +2188,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,\n \t\t\text4_xattr_inode_free_quota(inode, ea_inode,\n \t\t\t\t\t\t i_size_read(ea_inode));\n \t\t}\n-\t\tiput(ea_inode);\n+\t\text4_put_ea_inode(inode-\u003ei_sb, ea_inode);\n \t}\n \tif (ce)\n \t\tmb_cache_entry_put(ea_block_cache, ce);\n@@ -2285,7 +2270,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,\n \n \t\t\text4_xattr_inode_free_quota(inode, ea_inode,\n \t\t\t\t\t\t i_size_read(ea_inode));\n-\t\t\tiput(ea_inode);\n+\t\t\text4_put_ea_inode(inode-\u003ei_sb, ea_inode);\n \t\t}\n \t\treturn error;\n \t}\n@@ -2297,7 +2282,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,\n \t\theader-\u003eh_magic = cpu_to_le32(0);\n \t\text4_clear_inode_state(inode, EXT4_STATE_XATTR);\n \t}\n-\tiput(ea_inode);\n+\text4_put_ea_inode(inode-\u003ei_sb, ea_inode);\n \treturn 0;\n }\n \n@@ -2863,46 +2848,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,\n \treturn error;\n }\n \n-#define EIA_INCR 16 /* must be 2^n */\n-#define EIA_MASK (EIA_INCR - 1)\n-\n-/* Add the large xattr @inode into @ea_inode_array for deferred iput().\n- * If @ea_inode_array is new or full it will be grown and the old\n- * contents copied over.\n- */\n-static int\n-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,\n-\t\t\tstruct inode *inode)\n-{\n-\tif (*ea_inode_array == NULL) {\n-\t\t/*\n-\t\t * Start with 15 inodes, so it fits into a power-of-two size.\n-\t\t */\n-\t\t(*ea_inode_array) = kmalloc_flex(**ea_inode_array, inodes,\n-\t\t\t\t\t\t EIA_MASK, GFP_NOFS);\n-\t\tif (*ea_inode_array == NULL)\n-\t\t\treturn -ENOMEM;\n-\t\t(*ea_inode_array)-\u003ecount = 0;\n-\t} else if (((*ea_inode_array)-\u003ecount \u0026 EIA_MASK) == EIA_MASK) {\n-\t\t/* expand the array once all 15 + n * 16 slots are full */\n-\t\tstruct ext4_xattr_inode_array *new_array = NULL;\n-\n-\t\tnew_array = kmalloc_flex(**ea_inode_array, inodes,\n-\t\t\t\t\t (*ea_inode_array)-\u003ecount + EIA_INCR,\n-\t\t\t\t\t GFP_NOFS);\n-\t\tif (new_array == NULL)\n-\t\t\treturn -ENOMEM;\n-\t\tmemcpy(new_array, *ea_inode_array,\n-\t\t struct_size(*ea_inode_array, inodes,\n-\t\t\t\t (*ea_inode_array)-\u003ecount));\n-\t\tkfree(*ea_inode_array);\n-\t\t*ea_inode_array = new_array;\n-\t}\n-\t(*ea_inode_array)-\u003ecount++;\n-\t(*ea_inode_array)-\u003einodes[(*ea_inode_array)-\u003ecount - 1] = inode;\n-\treturn 0;\n-}\n-\n /*\n * ext4_xattr_delete_inode()\n *\n@@ -2913,7 +2858,6 @@ ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,\n * references on xattr block and xattr inodes.\n */\n int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n-\t\t\t struct ext4_xattr_inode_array **ea_inode_array,\n \t\t\t int extra_credits)\n {\n \tstruct buffer_head *bh = NULL;\n@@ -2952,7 +2896,6 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n \t\t\text4_xattr_inode_dec_ref_all(handle, inode, iloc.bh,\n \t\t\t\t\t\t IFIRST(header),\n \t\t\t\t\t\t false /* block_csum */,\n-\t\t\t\t\t\t ea_inode_array,\n \t\t\t\t\t\t extra_credits,\n \t\t\t\t\t\t false /* skip_quota */);\n \t}\n@@ -2986,12 +2929,12 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n \t\t\t\t\tcontinue;\n \t\t\t\text4_xattr_inode_free_quota(inode, ea_inode,\n \t\t\t\t\t le32_to_cpu(entry-\u003ee_value_size));\n-\t\t\t\tiput(ea_inode);\n+\t\t\t\text4_put_ea_inode(inode-\u003ei_sb, ea_inode);\n \t\t\t}\n \n \t\t}\n \n-\t\text4_xattr_release_block(handle, inode, bh, ea_inode_array,\n+\t\text4_xattr_release_block(handle, inode, bh,\n \t\t\t\t\t extra_credits);\n \t\t/*\n \t\t * Update i_file_acl value in the same transaction that releases\n@@ -3013,16 +2956,59 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n \treturn error;\n }\n \n-void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *ea_inode_array)\n+/*\n+ * Worker function for deferred EA inode iput. Processes all inodes queued\n+ * on s_ea_inode_to_free in a context free of xattr_sem/jbd2 handle locks.\n+ */\n+static void ext4_ea_inode_work(struct work_struct *work)\n {\n-\tint idx;\n+\tstruct ext4_sb_info *sbi = container_of(to_delayed_work(work),\n+\t\t\t\t\t\tstruct ext4_sb_info,\n+\t\t\t\t\t\ts_ea_inode_work);\n+\tstruct llist_node *node = llist_del_all(\u0026sbi-\u003es_ea_inode_to_free);\n+\tstruct llist_node *next;\n \n-\tif (ea_inode_array == NULL)\n+\twhile (node) {\n+\t\tstruct ext4_inode_info *ei = container_of(node,\n+\t\t\t\t\tstruct ext4_inode_info, i_ea_iput_node);\n+\t\tnext = node-\u003enext;\n+\t\tiput(\u0026ei-\u003evfs_inode);\n+\t\tnode = next;\n+\t}\n+}\n+\n+/*\n+ * Release a VFS reference on an EA inode. Must be used instead of iput()\n+ * in any context where xattr_sem or a jbd2 handle is held.\n+ *\n+ * If this is not the last reference, drops it immediately via\n+ * iput_if_not_last() with no further action needed.\n+ *\n+ * If this is the last reference, the inode is linked onto a per-sb\n+ * llist via i_ea_iput_node (embedded in ext4_inode_info, sharing space\n+ * with the unused xattr_sem) and a delayed worker performs the final\n+ * iput() in a clean context.\n+ */\n+void ext4_put_ea_inode(struct super_block *sb, struct inode *inode)\n+{\n+\tif (!inode)\n+\t\treturn;\n+\tWARN_ON_ONCE(!(EXT4_I(inode)-\u003ei_flags \u0026 EXT4_EA_INODE_FL));\n+\tif (iput_if_not_last(inode))\n \t\treturn;\n+\tllist_add(\u0026EXT4_I(inode)-\u003ei_ea_iput_node,\n+\t\t \u0026EXT4_SB(sb)-\u003es_ea_inode_to_free);\n+\t/*\n+\t * Use a short delay to allow multiple EA inodes to accumulate,\n+\t * reducing workqueue wakeups when several are released together.\n+\t */\n+\tschedule_delayed_work(\u0026EXT4_SB(sb)-\u003es_ea_inode_work, 1);\n+}\n \n-\tfor (idx = 0; idx \u003c ea_inode_array-\u003ecount; ++idx)\n-\t\tiput(ea_inode_array-\u003einodes[idx]);\n-\tkfree(ea_inode_array);\n+void ext4_init_ea_inode_work(struct ext4_sb_info *sbi)\n+{\n+\tinit_llist_head(\u0026sbi-\u003es_ea_inode_to_free);\n+\tINIT_DELAYED_WORK(\u0026sbi-\u003es_ea_inode_work, ext4_ea_inode_work);\n }\n \n /*\ndiff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h\nindex 1fedf44d4fb65e..8214a31fe0018d 100644\n--- a/fs/ext4/xattr.h\n+++ b/fs/ext4/xattr.h\n@@ -131,11 +131,6 @@ struct ext4_xattr_ibody_find {\n \tstruct ext4_iloc iloc;\n };\n \n-struct ext4_xattr_inode_array {\n-\tunsigned int count;\n-\tstruct inode *inodes[] __counted_by(count);\n-};\n-\n extern const struct xattr_handler ext4_xattr_user_handler;\n extern const struct xattr_handler ext4_xattr_trusted_handler;\n extern const struct xattr_handler ext4_xattr_security_handler;\n@@ -187,9 +182,21 @@ extern int __ext4_xattr_set_credits(struct super_block *sb, struct inode *inode,\n \t\t\t\tbool is_create);\n \n extern int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,\n-\t\t\t\t struct ext4_xattr_inode_array **array,\n \t\t\t\t int extra_credits);\n-extern void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *array);\n+extern void ext4_init_ea_inode_work(struct ext4_sb_info *sbi);\n+extern void ext4_put_ea_inode(struct super_block *sb, struct inode *inode);\n+\n+/*\n+ * Drain all pending deferred EA inode iputs. Must be called before\n+ * freeing resources that eviction depends on (quota, block allocator).\n+ * Loops because worker iput may trigger eviction that re-queues.\n+ */\n+static inline void ext4_drain_ea_inode_work(struct ext4_sb_info *sbi)\n+{\n+\twhile (flush_delayed_work(\u0026sbi-\u003es_ea_inode_work) ||\n+\t !llist_empty(\u0026sbi-\u003es_ea_inode_to_free))\n+\t\t;\n+}\n \n extern int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,\n \t\t\t struct ext4_inode *raw_inode, handle_t *handle);\ndiff --git a/include/linux/fs.h b/include/linux/fs.h\nindex 6da44573ce4508..4916a9d543470d 100644\n--- a/include/linux/fs.h\n+++ b/include/linux/fs.h\n@@ -2418,6 +2418,19 @@ static inline void super_set_sysfs_name_generic(struct super_block *sb, const ch\n extern void ihold(struct inode * inode);\n extern void iput(struct inode *);\n void iput_not_last(struct inode *);\n+\n+/**\n+ * iput_if_not_last - drop an inode reference only if it is not the last one\n+ * @inode: inode to put\n+ *\n+ * Returns true if the reference was dropped, false if this was the last\n+ * reference and the caller must arrange for final iput() in a safe context.\n+ */\n+static inline bool iput_if_not_last(struct inode *inode)\n+{\n+\treturn atomic_add_unless(\u0026inode-\u003ei_count, -1, 1);\n+}\n+\n int inode_update_time(struct inode *inode, enum fs_update_time type,\n \t\tunsigned int flags);\n int generic_update_time(struct inode *inode, enum fs_update_time type,\n"
} |
| 2/1 | 2026/06/23 08:49 | agent | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: {
"EnableConfigs": [
"EXT4_FS",
"EXT4_FS_POSIX_ACL",
"EXT4_FS_SECURITY"
],
"FocusSymbols": [
"ext4_ea_inode_work",
"ext4_put_ea_inode",
"ext4_xattr_delete_inode",
"ext4_xattr_inode_dec_ref_all",
"ext4_xattr_block_set",
"ext4_xattr_ibody_set",
"ext4_xattr_set_entry",
"ext4_xattr_inode_lookup_create",
"ext4_xattr_inode_create"
],
"Reasoning": "The patch introduces a deferred iput mechanism for ext4 EA (Extended Attribute) inodes to resolve lock ordering issues. It modifies how EA inodes are released by queuing them to a lockless list and processing them in a workqueue (`ext4_ea_inode_work`). This is a functional change to the core logic of ext4 xattr handling and should be fuzzed to ensure no use-after-free, memory leaks, or race conditions occur during EA inode eviction.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 1addeb066b7dca7c0034f33bba9de4dc998cd017
Author: syz-cluster <triage@syzkaller.com>
Date: Tue Jun 23 08:49:49 2026 +0000
syz-cluster: applied patch under review
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index b37c136ea3ab33..b9b0ada7774bb4 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1070,8 +1070,14 @@ struct ext4_inode_info {
* between readers of EAs and writers of regular file data, so
* instead we synchronize on xattr_sem when reading or changing
* EAs.
+ *
+ * EA inodes (EXT4_EA_INODE_FL) do not use xattr_sem; they reuse
+ * the space for deferred iput linkage.
*/
- struct rw_semaphore xattr_sem;
+ union {
+ struct rw_semaphore xattr_sem;
+ struct llist_node i_ea_iput_node;
+ };
/*
* Inodes with EXT4_STATE_ORPHAN_FILE use i_orphan_idx. Otherwise
@@ -1770,6 +1776,11 @@ struct ext4_sb_info {
struct ext4_es_stats s_es_stats;
struct mb_cache *s_ea_block_cache;
struct mb_cache *s_ea_inode_cache;
+
+ /* Deferred iput for EA inodes to avoid lock ordering issues */
+ struct llist_head s_ea_inode_to_free;
+ struct delayed_work s_ea_inode_work;
+
spinlock_t s_es_lock ____cacheline_aligned_in_smp;
/* Journal triggers for checksum computation */
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index ce99807c5f5b2c..747c52c232cc03 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -176,7 +176,6 @@ void ext4_evict_inode(struct inode *inode)
* (xattr block freeing), bitmap, group descriptor (inode freeing)
*/
int extra_credits = 6;
- struct ext4_xattr_inode_array *ea_inode_array = NULL;
bool freeze_protected = false;
trace_ext4_evict_inode(inode);
@@ -281,8 +280,7 @@ void ext4_evict_inode(struct inode *inode)
}
/* Remove xattr references. */
- err = ext4_xattr_delete_inode(handle, inode, &ea_inode_array,
- extra_credits);
+ err = ext4_xattr_delete_inode(handle, inode, extra_credits);
if (err) {
ext4_warning(inode->i_sb, "xattr delete (err %d)", err);
stop_handle:
@@ -290,7 +288,6 @@ void ext4_evict_inode(struct inode *inode)
ext4_orphan_del(NULL, inode);
if (freeze_protected)
sb_end_intwrite(inode->i_sb);
- ext4_xattr_inode_array_free(ea_inode_array);
goto no_delete;
}
@@ -320,7 +317,6 @@ void ext4_evict_inode(struct inode *inode)
ext4_journal_stop(handle);
if (freeze_protected)
sb_end_intwrite(inode->i_sb);
- ext4_xattr_inode_array_free(ea_inode_array);
return;
no_delete:
/*
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 245f67d10ded34..97f0e7c1b254f7 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1303,6 +1303,8 @@ static void ext4_put_super(struct super_block *sb)
&sb->s_uuid);
ext4_unregister_li_request(sb);
+ /* Drain deferred EA inode iputs while quota is still active. */
+ ext4_drain_ea_inode_work(sbi);
ext4_quotas_off(sb, EXT4_MAXQUOTAS);
destroy_workqueue(sbi->rsv_conversion_wq);
@@ -1423,6 +1425,13 @@ static struct inode *ext4_alloc_inode(struct super_block *sb)
memset(&ei->i_dquot, 0, sizeof(ei->i_dquot));
#endif
ei->jinode = NULL;
+ /*
+ * Reinitialize xattr_sem every allocation because EA inodes
+ * share this space with i_ea_iput_node (via union) which may
+ * have overwritten the semaphore when the slab object was
+ * previously used as an EA inode.
+ */
+ init_rwsem(&ei->xattr_sem);
INIT_LIST_HEAD(&ei->i_rsv_conversion_list);
spin_lock_init(&ei->i_completed_io_lock);
ei->i_sync_tid = 0;
@@ -1488,7 +1497,6 @@ static void init_once(void *foo)
struct ext4_inode_info *ei = foo;
INIT_LIST_HEAD(&ei->i_orphan);
- init_rwsem(&ei->xattr_sem);
init_rwsem(&ei->i_data_sem);
inode_init_once(&ei->vfs_inode);
ext4_fc_init_inode(&ei->vfs_inode);
@@ -5508,6 +5516,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
* The first inode we look at is the journal inode. Don't try
* root first: it may be modified in the journal!
*/
+ ext4_init_ea_inode_work(sbi);
+
if (!test_opt(sb, NOLOAD) && ext4_has_feature_journal(sb)) {
err = ext4_load_and_init_journal(sb, es, ctx);
if (err)
@@ -5747,6 +5757,8 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb)
return 0;
failed_mount9:
+ /* Drain deferred EA inode iputs before quota shutdown */
+ ext4_drain_ea_inode_work(sbi);
ext4_quotas_off(sb, EXT4_MAXQUOTAS);
failed_mount8: __maybe_unused
ext4_release_orphan_info(sb);
@@ -5767,6 +5779,8 @@ failed_mount8: __maybe_unused
if (EXT4_SB(sb)->rsv_conversion_wq)
destroy_workqueue(EXT4_SB(sb)->rsv_conversion_wq);
failed_mount_wq:
+ /* Drain deferred EA inode iputs before freeing structures */
+ ext4_drain_ea_inode_work(sbi);
ext4_xattr_destroy_cache(sbi->s_ea_inode_cache);
sbi->s_ea_inode_cache = NULL;
@@ -5777,6 +5791,8 @@ failed_mount8: __maybe_unused
ext4_journal_destroy(sbi, sbi->s_journal);
}
failed_mount3a:
+ /* Drain deferred EA inode iputs from journal replay */
+ ext4_drain_ea_inode_work(sbi);
ext4_es_unregister_shrinker(sbi);
failed_mount3:
/* flush s_sb_upd_work before sbi destroy */
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 982a1f831e2282..7f334349bd4f7d 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -114,10 +114,6 @@ const struct xattr_handler * const ext4_xattr_handlers[] = {
#define EA_INODE_CACHE(inode) (((struct ext4_sb_info *) \
inode->i_sb->s_fs_info)->s_ea_inode_cache)
-static int
-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
- struct inode *inode);
-
#ifdef CONFIG_LOCKDEP
void ext4_xattr_inode_set_class(struct inode *ea_inode)
{
@@ -567,7 +563,7 @@ ext4_xattr_inode_get(struct inode *inode, struct ext4_xattr_entry *entry,
ea_inode->i_ino, true /* reusable */);
}
out:
- iput(ea_inode);
+ ext4_put_ea_inode(inode->i_sb, ea_inode);
return err;
}
@@ -1104,10 +1100,10 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,
err = ext4_xattr_inode_inc_ref(handle, ea_inode);
if (err) {
ext4_warning_inode(ea_inode, "inc ref error %d", err);
- iput(ea_inode);
+ ext4_put_ea_inode(parent->i_sb, ea_inode);
goto cleanup;
}
- iput(ea_inode);
+ ext4_put_ea_inode(parent->i_sb, ea_inode);
}
return 0;
@@ -1133,7 +1129,7 @@ static int ext4_xattr_inode_inc_ref_all(handle_t *handle, struct inode *parent,
if (err)
ext4_warning_inode(ea_inode, "cleanup dec ref error %d",
err);
- iput(ea_inode);
+ ext4_put_ea_inode(parent->i_sb, ea_inode);
}
return saved_err;
}
@@ -1160,7 +1156,6 @@ static void
ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
struct buffer_head *bh,
struct ext4_xattr_entry *first, bool block_csum,
- struct ext4_xattr_inode_array **ea_inode_array,
int extra_credits, bool skip_quota)
{
struct inode *ea_inode;
@@ -1197,14 +1192,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
if (err)
continue;
- err = ext4_expand_inode_array(ea_inode_array, ea_inode);
- if (err) {
- ext4_warning_inode(ea_inode,
- "Expand inode array err=%d", err);
- iput(ea_inode);
- continue;
- }
-
err = ext4_journal_ensure_credits_fn(handle, credits, credits,
ext4_free_metadata_revoke_credits(parent->i_sb, 1),
ext4_xattr_restart_fn(handle, parent, bh, block_csum,
@@ -1212,6 +1199,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
if (err < 0) {
ext4_warning_inode(ea_inode, "Ensure credits err=%d",
err);
+ ext4_put_ea_inode(parent->i_sb, ea_inode);
continue;
}
if (err > 0) {
@@ -1221,6 +1209,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
ext4_warning_inode(ea_inode,
"Re-get write access err=%d",
err);
+ ext4_put_ea_inode(parent->i_sb, ea_inode);
continue;
}
}
@@ -1229,6 +1218,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
if (err) {
ext4_warning_inode(ea_inode, "ea_inode dec ref err=%d",
err);
+ ext4_put_ea_inode(parent->i_sb, ea_inode);
continue;
}
@@ -1245,6 +1235,7 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
entry->e_value_inum = 0;
entry->e_value_size = 0;
+ ext4_put_ea_inode(parent->i_sb, ea_inode);
dirty = true;
}
@@ -1271,7 +1262,6 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent,
static void
ext4_xattr_release_block(handle_t *handle, struct inode *inode,
struct buffer_head *bh,
- struct ext4_xattr_inode_array **ea_inode_array,
int extra_credits)
{
struct mb_cache *ea_block_cache = EA_BLOCK_CACHE(inode);
@@ -1313,7 +1303,6 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
ext4_xattr_inode_dec_ref_all(handle, inode, bh,
BFIRST(bh),
true /* block_csum */,
- ea_inode_array,
extra_credits,
true /* skip_quota */);
ext4_free_blocks(handle, inode, bh, 0, 1,
@@ -1505,7 +1494,7 @@ static struct inode *ext4_xattr_inode_create(handle_t *handle,
if (ext4_xattr_inode_dec_ref(handle, ea_inode))
ext4_warning_inode(ea_inode,
"cleanup dec ref error %d", err);
- iput(ea_inode);
+ ext4_put_ea_inode(inode->i_sb, ea_inode);
return ERR_PTR(err);
}
@@ -1564,7 +1553,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
kvfree(ea_data);
return ea_inode;
}
- iput(ea_inode);
+ ext4_put_ea_inode(inode->i_sb, ea_inode);
next_entry:
ce = mb_cache_entry_find_next(ea_inode_cache, ce);
}
@@ -1615,7 +1604,7 @@ static struct inode *ext4_xattr_inode_lookup_create(handle_t *handle,
ea_inode->i_ino, true /* reusable */);
return ea_inode;
out_err:
- iput(ea_inode);
+ ext4_put_ea_inode(inode->i_sb, ea_inode);
ext4_xattr_inode_free_quota(inode, NULL, value_len);
return ERR_PTR(err);
}
@@ -1848,7 +1837,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i,
ret = 0;
out:
- iput(old_ea_inode);
+ ext4_put_ea_inode(inode->i_sb, old_ea_inode);
return ret;
}
@@ -2010,7 +1999,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
old_ea_inode_quota = le32_to_cpu(
s->here->e_value_size);
}
- iput(tmp_inode);
+ ext4_put_ea_inode(inode->i_sb, tmp_inode);
s->here->e_value_inum = 0;
s->here->e_value_size = 0;
@@ -2150,7 +2139,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
ext4_warning_inode(ea_inode,
"dec ref error=%d",
error);
- iput(ea_inode);
+ ext4_put_ea_inode(inode->i_sb, ea_inode);
ea_inode = NULL;
}
@@ -2182,12 +2171,8 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
/* Drop the previous xattr block. */
if (bs->bh && bs->bh != new_bh) {
- struct ext4_xattr_inode_array *ea_inode_array = NULL;
-
ext4_xattr_release_block(handle, inode, bs->bh,
- &ea_inode_array,
0 /* extra_credits */);
- ext4_xattr_inode_array_free(ea_inode_array);
}
error = 0;
@@ -2203,7 +2188,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
ext4_xattr_inode_free_quota(inode, ea_inode,
i_size_read(ea_inode));
}
- iput(ea_inode);
+ ext4_put_ea_inode(inode->i_sb, ea_inode);
}
if (ce)
mb_cache_entry_put(ea_block_cache, ce);
@@ -2285,7 +2270,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
ext4_xattr_inode_free_quota(inode, ea_inode,
i_size_read(ea_inode));
- iput(ea_inode);
+ ext4_put_ea_inode(inode->i_sb, ea_inode);
}
return error;
}
@@ -2297,7 +2282,7 @@ int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
header->h_magic = cpu_to_le32(0);
ext4_clear_inode_state(inode, EXT4_STATE_XATTR);
}
- iput(ea_inode);
+ ext4_put_ea_inode(inode->i_sb, ea_inode);
return 0;
}
@@ -2863,46 +2848,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
return error;
}
-#define EIA_INCR 16 /* must be 2^n */
-#define EIA_MASK (EIA_INCR - 1)
-
-/* Add the large xattr @inode into @ea_inode_array for deferred iput().
- * If @ea_inode_array is new or full it will be grown and the old
- * contents copied over.
- */
-static int
-ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
- struct inode *inode)
-{
- if (*ea_inode_array == NULL) {
- /*
- * Start with 15 inodes, so it fits into a power-of-two size.
- */
- (*ea_inode_array) = kmalloc_flex(**ea_inode_array, inodes,
- EIA_MASK, GFP_NOFS);
- if (*ea_inode_array == NULL)
- return -ENOMEM;
- (*ea_inode_array)->count = 0;
- } else if (((*ea_inode_array)->count & EIA_MASK) == EIA_MASK) {
- /* expand the array once all 15 + n * 16 slots are full */
- struct ext4_xattr_inode_array *new_array = NULL;
-
- new_array = kmalloc_flex(**ea_inode_array, inodes,
- (*ea_inode_array)->count + EIA_INCR,
- GFP_NOFS);
- if (new_array == NULL)
- return -ENOMEM;
- memcpy(new_array, *ea_inode_array,
- struct_size(*ea_inode_array, inodes,
- (*ea_inode_array)->count));
- kfree(*ea_inode_array);
- *ea_inode_array = new_array;
- }
- (*ea_inode_array)->count++;
- (*ea_inode_array)->inodes[(*ea_inode_array)->count - 1] = inode;
- return 0;
-}
-
/*
* ext4_xattr_delete_inode()
*
@@ -2913,7 +2858,6 @@ ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array,
* references on xattr block and xattr inodes.
*/
int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
- struct ext4_xattr_inode_array **ea_inode_array,
int extra_credits)
{
struct buffer_head *bh = NULL;
@@ -2952,7 +2896,6 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
ext4_xattr_inode_dec_ref_all(handle, inode, iloc.bh,
IFIRST(header),
false /* block_csum */,
- ea_inode_array,
extra_credits,
false /* skip_quota */);
}
@@ -2986,12 +2929,12 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
continue;
ext4_xattr_inode_free_quota(inode, ea_inode,
le32_to_cpu(entry->e_value_size));
- iput(ea_inode);
+ ext4_put_ea_inode(inode->i_sb, ea_inode);
}
}
- ext4_xattr_release_block(handle, inode, bh, ea_inode_array,
+ ext4_xattr_release_block(handle, inode, bh,
extra_credits);
/*
* Update i_file_acl value in the same transaction that releases
@@ -3013,16 +2956,59 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
return error;
}
-void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *ea_inode_array)
+/*
+ * Worker function for deferred EA inode iput. Processes all inodes queued
+ * on s_ea_inode_to_free in a context free of xattr_sem/jbd2 handle locks.
+ */
+static void ext4_ea_inode_work(struct work_struct *work)
{
- int idx;
+ struct ext4_sb_info *sbi = container_of(to_delayed_work(work),
+ struct ext4_sb_info,
+ s_ea_inode_work);
+ struct llist_node *node = llist_del_all(&sbi->s_ea_inode_to_free);
+ struct llist_node *next;
- if (ea_inode_array == NULL)
+ while (node) {
+ struct ext4_inode_info *ei = container_of(node,
+ struct ext4_inode_info, i_ea_iput_node);
+ next = node->next;
+ iput(&ei->vfs_inode);
+ node = next;
+ }
+}
+
+/*
+ * Release a VFS reference on an EA inode. Must be used instead of iput()
+ * in any context where xattr_sem or a jbd2 handle is held.
+ *
+ * If this is not the last reference, drops it immediately via
+ * iput_if_not_last() with no further action needed.
+ *
+ * If this is the last reference, the inode is linked onto a per-sb
+ * llist via i_ea_iput_node (embedded in ext4_inode_info, sharing space
+ * with the unused xattr_sem) and a delayed worker performs the final
+ * iput() in a clean context.
+ */
+void ext4_put_ea_inode(struct super_block *sb, struct inode *inode)
+{
+ if (!inode)
+ return;
+ WARN_ON_ONCE(!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL));
+ if (iput_if_not_last(inode))
return;
+ llist_add(&EXT4_I(inode)->i_ea_iput_node,
+ &EXT4_SB(sb)->s_ea_inode_to_free);
+ /*
+ * Use a short delay to allow multiple EA inodes to accumulate,
+ * reducing workqueue wakeups when several are released together.
+ */
+ schedule_delayed_work(&EXT4_SB(sb)->s_ea_inode_work, 1);
+}
- for (idx = 0; idx < ea_inode_array->count; ++idx)
- iput(ea_inode_array->inodes[idx]);
- kfree(ea_inode_array);
+void ext4_init_ea_inode_work(struct ext4_sb_info *sbi)
+{
+ init_llist_head(&sbi->s_ea_inode_to_free);
+ INIT_DELAYED_WORK(&sbi->s_ea_inode_work, ext4_ea_inode_work);
}
/*
diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
index 1fedf44d4fb65e..8214a31fe0018d 100644
--- a/fs/ext4/xattr.h
+++ b/fs/ext4/xattr.h
@@ -131,11 +131,6 @@ struct ext4_xattr_ibody_find {
struct ext4_iloc iloc;
};
-struct ext4_xattr_inode_array {
- unsigned int count;
- struct inode *inodes[] __counted_by(count);
-};
-
extern const struct xattr_handler ext4_xattr_user_handler;
extern const struct xattr_handler ext4_xattr_trusted_handler;
extern const struct xattr_handler ext4_xattr_security_handler;
@@ -187,9 +182,21 @@ extern int __ext4_xattr_set_credits(struct super_block *sb, struct inode *inode,
bool is_create);
extern int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode,
- struct ext4_xattr_inode_array **array,
int extra_credits);
-extern void ext4_xattr_inode_array_free(struct ext4_xattr_inode_array *array);
+extern void ext4_init_ea_inode_work(struct ext4_sb_info *sbi);
+extern void ext4_put_ea_inode(struct super_block *sb, struct inode *inode);
+
+/*
+ * Drain all pending deferred EA inode iputs. Must be called before
+ * freeing resources that eviction depends on (quota, block allocator).
+ * Loops because worker iput may trigger eviction that re-queues.
+ */
+static inline void ext4_drain_ea_inode_work(struct ext4_sb_info *sbi)
+{
+ while (flush_delayed_work(&sbi->s_ea_inode_work) ||
+ !llist_empty(&sbi->s_ea_inode_to_free))
+ ;
+}
extern int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
struct ext4_inode *raw_inode, handle_t *handle);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 6da44573ce4508..4916a9d543470d 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2418,6 +2418,19 @@ static inline void super_set_sysfs_name_generic(struct super_block *sb, const ch
extern void ihold(struct inode * inode);
extern void iput(struct inode *);
void iput_not_last(struct inode *);
+
+/**
+ * iput_if_not_last - drop an inode reference only if it is not the last one
+ * @inode: inode to put
+ *
+ * Returns true if the reference was dropped, false if this was the last
+ * reference and the caller must arrange for final iput() in a safe context.
+ */
+static inline bool iput_if_not_last(struct inode *inode)
+{
+ return atomic_add_unless(&inode->i_count, -1, 1);
+}
+
int inode_update_time(struct inode *inode, enum fs_update_time type,
unsigned int flags);
int generic_update_time(struct inode *inode, enum fs_update_time type,
|
| 3/2 | 2026/06/23 08:49 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 9545 output: 32 thoughts: 321 Thoughts: **My Analysis of this ext4 Patch** Okay, so I've got a patch here that's making some pretty significant changes to the ext4 filesystem, specifically around Extended Attribute (EA) inodes. It looks like they're introducing a *deferred iput* mechanism for these EA inodes, which is interesting. This means they're aiming to improve performance or perhaps handle some locking contention issues related to EA inode management. The patch touches a good chunk of code, spanning header files like `ext4.h`, `xattr.h`, and `fs.h`, as well as implementation files like `inode.c`, `super.c`, and `xattr.c`. Looks like they're making a core refactor by replacing the old `ext4_xattr_inode_array` with a deferred workqueue (`s_ea_inode_work`) and a lockless list (`s_ea_inode_to_free`). This suggests a move towards asynchronous freeing of these EA inodes to avoid blocking operations. They've also added a new function, `iput_if_not_last`, and modified several existing functions like `ext4_xattr_delete_inode`, `ext4_put_ea_inode`, and `ext4_evict_inode` and `__ext4_fill_super`. This is a functional change – a core change to ext4's xattr handling. This definitely warrants a thorough fuzzing campaign. I need to make sure this doesn't introduce any new vulnerabilities, especially given the increased complexity of the asynchronous logic. Now, let's figure out the right kernel configurations to enable to build a fuzz target. Clearly, `CONFIG_EXT4_FS` is the big one. But are there any specific XATTR configurations that I need to be concerned about? I'll need to check the `fs/ext4/Kconfig` file to be certain I'm enabling all relevant configurations for EA inode fuzzing. |
| 4/2 | 2026/06/23 08:49 | tool | grepper |
0mArgs:{
"Expression": "config EXT4_FS",
"PathPrefix": "fs/ext4/Kconfig"
}Results: {
"Output": "fs/ext4/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/ext4/Kconfig:2:config EXT4_FS\nfs/ext4/Kconfig-3-\ttristate \"The Extended 4 (ext4) filesystem\"\n--\nfs/ext4/Kconfig=35=config EXT4_USE_FOR_EXT2\n--\nfs/ext4/Kconfig-45-\nfs/ext4/Kconfig:46:config EXT4_FS_POSIX_ACL\nfs/ext4/Kconfig-47-\tbool \"Ext4 POSIX Access Control Lists\"\n--\nfs/ext4/Kconfig-55-\nfs/ext4/Kconfig:56:config EXT4_FS_SECURITY\nfs/ext4/Kconfig-57-\tbool \"Ext4 Security Labels\"\n"
} |
| 5/2 | 2026/06/23 08:50 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10528 output: 30 thoughts: 12 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: **Initial Assessment: EXT4 Configuration Context** Right, let's just quickly confirm something before we dig too deep. My first instinct here is to make sure we aren't overlooking any existing EXT4 configurations or relevant context. We need to be absolutely certain we are fully aware of what's already in place, if anything, to avoid duplicating effort or introducing conflicts. We all know how easy it is to miss something in a complex environment, so it's best to start with a sanity check. Let's see if there are any other extant EXT4 setups we need to be aware of. |
| 6/2 | 2026/06/23 08:50 | tool | grepper |
0mArgs:{
"Expression": "config EXT4",
"PathPrefix": "fs/ext4/Kconfig"
}Results: {
"Output": "fs/ext4/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nfs/ext4/Kconfig:2:config EXT4_FS\nfs/ext4/Kconfig-3-\ttristate \"The Extended 4 (ext4) filesystem\"\n--\nfs/ext4/Kconfig-34-\nfs/ext4/Kconfig:35:config EXT4_USE_FOR_EXT2\nfs/ext4/Kconfig-36-\tbool \"Use ext4 for ext2 file systems\"\n--\nfs/ext4/Kconfig-45-\nfs/ext4/Kconfig:46:config EXT4_FS_POSIX_ACL\nfs/ext4/Kconfig-47-\tbool \"Ext4 POSIX Access Control Lists\"\n--\nfs/ext4/Kconfig-55-\nfs/ext4/Kconfig:56:config EXT4_FS_SECURITY\nfs/ext4/Kconfig-57-\tbool \"Ext4 Security Labels\"\n--\nfs/ext4/Kconfig-67-\nfs/ext4/Kconfig:68:config EXT4_DEBUG\nfs/ext4/Kconfig-69-\tbool \"Ext4 debugging support\"\n--\nfs/ext4/Kconfig-76-\nfs/ext4/Kconfig:77:config EXT4_KUNIT_TESTS\nfs/ext4/Kconfig-78-\ttristate \"KUnit tests for ext4\" if !KUNIT_ALL_TESTS\n"
} |
| 7/2 | 2026/06/23 08:50 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 11088 output: 31 thoughts: 89 Thoughts: **EA Inodes and Extended Attributes: A Quick Check** Okay, so this feature is all about Extended Attribute inodes, or EA inodes. My first thought is, are there any *specific* configurations for EA inodes themselves, or is it handled as part of the broader ext4 xattr implementation? I'm pretty sure it's the latter, but let's just make sure. It seems like `EXT4_FS` is probably sufficient for enabling it, though I should consider if `EXT4_FS_POSIX_ACL` and `EXT4_FS_SECURITY` might be necessary or beneficial to enable more robust xattr usage overall. To get a definitive answer, I should really dive into the source code. Let's head over to `fs/ext4/xattr.c` and take a look. That's the best place to confirm if there are any subtle configuration details that I might be overlooking. It will be a quick check, I am sure. |
| 8/2 | 2026/06/23 08:50 | tool | grepper |
0mArgs:{
"Expression": "CONFIG_",
"PathPrefix": "fs/ext4/xattr.c"
}Results: {
"Output": "fs/ext4/xattr.c=88=static const struct xattr_handler * const ext4_xattr_handler_map[] = {\nfs/ext4/xattr.c-89-\t[EXT4_XATTR_INDEX_USER]\t\t = \u0026ext4_xattr_user_handler,\nfs/ext4/xattr.c:90:#ifdef CONFIG_EXT4_FS_POSIX_ACL\nfs/ext4/xattr.c-91-\t[EXT4_XATTR_INDEX_POSIX_ACL_ACCESS] = \u0026nop_posix_acl_access,\n--\nfs/ext4/xattr.c-94-\t[EXT4_XATTR_INDEX_TRUSTED]\t = \u0026ext4_xattr_trusted_handler,\nfs/ext4/xattr.c:95:#ifdef CONFIG_EXT4_FS_SECURITY\nfs/ext4/xattr.c-96-\t[EXT4_XATTR_INDEX_SECURITY]\t = \u0026ext4_xattr_security_handler,\n--\nfs/ext4/xattr.c=101=const struct xattr_handler * const ext4_xattr_handlers[] = {\n--\nfs/ext4/xattr.c-103-\t\u0026ext4_xattr_trusted_handler,\nfs/ext4/xattr.c:104:#ifdef CONFIG_EXT4_FS_SECURITY\nfs/ext4/xattr.c-105-\t\u0026ext4_xattr_security_handler,\n--\nfs/ext4/xattr.c-116-\nfs/ext4/xattr.c:117:#ifdef CONFIG_LOCKDEP\nfs/ext4/xattr.c-118-void ext4_xattr_inode_set_class(struct inode *ea_inode)\n--\nfs/ext4/xattr.c-122-\tlockdep_set_subclass(\u0026ea_inode-\u003ei_rwsem, 1);\nfs/ext4/xattr.c:123:\t(void) ei;\t/* shut up clang warning if !CONFIG_LOCKDEP */\nfs/ext4/xattr.c-124-\tlockdep_set_subclass(\u0026ei-\u003ei_data_sem, I_DATA_SEM_EA);\n"
} |
| 9/2 | 2026/06/23 08:50 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 11973 output: 266 thoughts: 935 Thoughts: **Analyzing the Extended Attribute (EA) Inode Patch** Okay, so I'm looking at this patch and first things first: `EXT4_FS`, `EXT4_FS_POSIX_ACL`, and `EXT4_FS_SECURITY` all look good and relevant to what I expect. Now, let's drill down and identify the specific symbols this patch touches. I need to figure out which functions are *really* the focus here, the ones that embody the new logic, not just generic file system stuff. The patch modifies quite a few functions, but I'm primarily concerned with those directly related to the new deferred iput mechanism for EA inodes: `ext4_evict_inode`, `ext4_put_super`, `ext4_alloc_inode`, `__ext4_fill_super`, `ext4_xattr_inode_get`, `ext4_xattr_inode_inc_ref_all`, `ext4_xattr_inode_dec_ref_all`, `ext4_xattr_release_block`, `ext4_xattr_inode_create`, `ext4_xattr_inode_cache_find`, `ext4_xattr_inode_lookup_create`, `ext4_xattr_set_entry`, `ext4_xattr_block_set`, `ext4_xattr_ibody_set`, `ext4_expand_extra_isize_ea`, `ext4_xattr_delete_inode`, `ext4_ea_inode_work`, `ext4_put_ea_inode`, `ext4_init_ea_inode_work`, `ext4_drain_ea_inode_work`. I need to filter those to the core of the change. `ext4_ea_inode_work` is a strong contender because that's the worker function. `ext4_put_ea_inode` should also be important, as this is the new function to put the EA inodes. `ext4_xattr_delete_inode` might be interesting, particularly regarding what it does with any arrays. Plus, `ext4_xattr_block_set` and `ext4_xattr_ibody_set` look like the creation and modification points. Now, let's confirm the visibility of those focus functions. I see `ext4_ea_inode_work` is `static` in `fs/ext4/xattr.c`. So it's internal to that file. Then `ext4_put_ea_inode` is *not* static, so it is declared in `fs/ext4/xattr.h`, meaning it's externally visible. Good. Okay, let's nail down this list for fuzzing: * `ext4_ea_inode_work` * `ext4_put_ea_inode` * `ext4_xattr_delete_inode` * `ext4_xattr_inode_dec_ref_all` * `ext4_xattr_block_set` * `ext4_xattr_ibody_set` * `ext4_xattr_set_entry` * `ext4_xattr_inode_lookup_create` * `ext4_xattr_inode_create` Perfect! These are all very specific to ext4 xattr handling, particularly in regards to EA inodes. These are the key functions I expect to contain the core changes of the patch. Essentially, this patch is introducing a deferred iput mechanism for EA inodes. It's handling the release of these inodes by queuing them up to a lockless list, and then processing them in a workqueue (`ext4_ea_inode_work`). This changes how the ext4 xattr logic fundamentally works. That's a good place to be very careful. This is ripe for fuzzing. I need to make sure there are no use-after-free conditions, memory leaks, or race conditions stemming from this new EA inode eviction system. Time to call `set-results`. |
| 10/2 | 2026/06/23 08:50 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"EXT4_FS",
"EXT4_FS_POSIX_ACL",
"EXT4_FS_SECURITY"
],
"FocusSymbols": [
"ext4_ea_inode_work",
"ext4_put_ea_inode",
"ext4_xattr_delete_inode",
"ext4_xattr_inode_dec_ref_all",
"ext4_xattr_block_set",
"ext4_xattr_ibody_set",
"ext4_xattr_set_entry",
"ext4_xattr_inode_lookup_create",
"ext4_xattr_inode_create"
],
"Reasoning": "The patch introduces a deferred iput mechanism for ext4 EA (Extended Attribute) inodes to resolve lock ordering issues. It modifies how EA inodes are released by queuing them to a lockless list and processing them in a workqueue (`ext4_ea_inode_work`). This is a functional change to the core logic of ext4 xattr handling and should be fuzzed to ensure no use-after-free, memory leaks, or race conditions occur during EA inode eviction.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"EXT4_FS",
"EXT4_FS_POSIX_ACL",
"EXT4_FS_SECURITY"
],
"FocusSymbols": [
"ext4_ea_inode_work",
"ext4_put_ea_inode",
"ext4_xattr_delete_inode",
"ext4_xattr_inode_dec_ref_all",
"ext4_xattr_block_set",
"ext4_xattr_ibody_set",
"ext4_xattr_set_entry",
"ext4_xattr_inode_lookup_create",
"ext4_xattr_inode_create"
],
"Reasoning": "The patch introduces a deferred iput mechanism for ext4 EA (Extended Attribute) inodes to resolve lock ordering issues. It modifies how EA inodes are released by queuing them to a lockless list and processing them in a workqueue (`ext4_ea_inode_work`). This is a functional change to the core logic of ext4 xattr handling and should be fuzzed to ensure no use-after-free, memory leaks, or race conditions occur during EA inode eviction.",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|