On Mon, May 19, 2025 at 07:42:46AM -0300, Thadeu Lima de Souza Cascardo wrote:
> inline data handling has a race between writing and writing to a memory
> map.
>
> When ext4_page_mkwrite is called, it calls ext4_convert_inline_data, which
> destroys the inline data, but if block allocation fails, restores the
> inline data. In that process, we could have:
>
> CPU1 CPU2
> destroy_inline_data
> write_begin (does not see inline data)
> restory_inline_data
> write_end (sees inline data)
>
> The conversion inside ext4_page_mkwrite was introduced at commit
> 7b4cc9787fe3 ("ext4: evict inline data when writing to memory map"). This
> fixes a documented bug in the commit message, which suggests some
> alternatives fixes.
Your fix just reverts commit 7b4cc9787fe3, and removes the BUG_ON.
While this is great for shutting up the syzbot report, but it causes
file writes to an inline data file via a mmap to never get written
back to the storage device. So you are replacing BUG_ON that can get
triggered on a race condition in case of a failed block allocation,
with silent data corruption. This is not an improvement.
Thanks for trying to address this, but I'm not going to accept your
proposed fix.
- Ted
