4.19-stable patches

added patches:
	nilfs2-handle-inconsistent-state-in-nilfs_btnode_create_block.patch

diff --git a/queue-4.19/nilfs2-handle-inconsistent-state-in-nilfs_btnode_create_block.patch b/queue-4.19/nilfs2-handle-inconsistent-state-in-nilfs_btnode_create_block.patch
new file mode 100644 (file)
index 0000000..d0e3c19
--- /dev/null
+++ b/queue-4.19/nilfs2-handle-inconsistent-state-in-nilfs_btnode_create_block.patch
@@ -0,0 +1,97 @@
+From 4811f7af6090e8f5a398fbdd766f903ef6c0d787 Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Date: Thu, 25 Jul 2024 14:20:07 +0900
+Subject: nilfs2: handle inconsistent state in nilfs_btnode_create_block()
+
+From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+
+commit 4811f7af6090e8f5a398fbdd766f903ef6c0d787 upstream.
+
+Syzbot reported that a buffer state inconsistency was detected in
+nilfs_btnode_create_block(), triggering a kernel bug.
+
+It is not appropriate to treat this inconsistency as a bug; it can occur
+if the argument block address (the buffer index of the newly created
+block) is a virtual block number and has been reallocated due to
+corruption of the bitmap used to manage its allocation state.
+
+So, modify nilfs_btnode_create_block() and its callers to treat it as a
+possible filesystem error, rather than triggering a kernel bug.
+
+Link: https://lkml.kernel.org/r/20240725052007.4562-1-konishi.ryusuke@gmail.com
+Fixes: a60be987d45d ("nilfs2: B-tree node cache")
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Reported-by: syzbot+89cc4f2324ed37988b60@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=89cc4f2324ed37988b60
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nilfs2/btnode.c |   25 ++++++++++++++++++++-----
+ fs/nilfs2/btree.c  |    4 ++--
+ 2 files changed, 22 insertions(+), 7 deletions(-)
+
+--- a/fs/nilfs2/btnode.c
++++ b/fs/nilfs2/btnode.c
+@@ -51,12 +51,21 @@ nilfs_btnode_create_block(struct address
+ 
+       bh = nilfs_grab_buffer(inode, btnc, blocknr, BIT(BH_NILFS_Node));
+       if (unlikely(!bh))
+-              return NULL;
++              return ERR_PTR(-ENOMEM);
+ 
+       if (unlikely(buffer_mapped(bh) || buffer_uptodate(bh) ||
+                    buffer_dirty(bh))) {
+-              brelse(bh);
+-              BUG();
++              /*
++               * The block buffer at the specified new address was already
++               * in use.  This can happen if it is a virtual block number
++               * and has been reallocated due to corruption of the bitmap
++               * used to manage its allocation state (if not, the buffer
++               * clearing of an abandoned b-tree node is missing somewhere).
++               */
++              nilfs_error(inode->i_sb,
++                          "state inconsistency probably due to duplicate use of b-tree node block address %llu (ino=%lu)",
++                          (unsigned long long)blocknr, inode->i_ino);
++              goto failed;
+       }
+       memset(bh->b_data, 0, i_blocksize(inode));
+       bh->b_bdev = inode->i_sb->s_bdev;
+@@ -67,6 +76,12 @@ nilfs_btnode_create_block(struct address
+       unlock_page(bh->b_page);
+       put_page(bh->b_page);
+       return bh;
++
++failed:
++      unlock_page(bh->b_page);
++      put_page(bh->b_page);
++      brelse(bh);
++      return ERR_PTR(-EIO);
+ }
+ 
+ int nilfs_btnode_submit_block(struct address_space *btnc, __u64 blocknr,
+@@ -224,8 +239,8 @@ retry:
+       }
+ 
+       nbh = nilfs_btnode_create_block(btnc, newkey);
+-      if (!nbh)
+-              return -ENOMEM;
++      if (IS_ERR(nbh))
++              return PTR_ERR(nbh);
+ 
+       BUG_ON(nbh == obh);
+       ctxt->newbh = nbh;
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -63,8 +63,8 @@ static int nilfs_btree_get_new_block(con
+       struct buffer_head *bh;
+ 
+       bh = nilfs_btnode_create_block(btnc, ptr);
+-      if (!bh)
+-              return -ENOMEM;
++      if (IS_ERR(bh))
++              return PTR_ERR(bh);
+ 
+       set_buffer_nilfs_volatile(bh);
+       *bhp = bh;

diff --git a/queue-4.19/series b/queue-4.19/series
index ad17da706e75823f50f1fa944a00f648c03cfa2b..d427ba7a901aef9b8515fbcee18e4ab6bede94fc 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -91,3 +91,4 @@ watchdog-perf-properly-initialize-the-turbo-mode-timestamp-and-rearm-counter.pat
 platform-mips-cpu_hwmon-disable-driver-on-unsupported-hardware.patch
 rdma-iwcm-fix-a-use-after-free-related-to-destroying-cm-ids.patch
 selftests-sigaltstack-fix-ppc64-gcc-build.patch
+nilfs2-handle-inconsistent-state-in-nilfs_btnode_create_block.patch