On Mon, May 19, 2025 at 07:42:46AM -0300, Thadeu Lima de Souza Cascardo wrote:
inline data handling has a race between writing and writing to a memory map.
When ext4_page_mkwrite is called, it calls ext4_convert_inline_data, which destroys the inline data, but if block allocation fails, restores the inline data. In that process, we could have:
CPU1 CPU2 destroy_inline_data write_begin (does not see inline data) restory_inline_data write_end (sees inline data)
The conversion inside ext4_page_mkwrite was introduced at commit 7b4cc9787fe3 ("ext4: evict inline data when writing to memory map"). This fixes a documented bug in the commit message, which suggests some alternatives fixes.
Your fix just reverts commit 7b4cc9787fe3, and removes the BUG_ON. While this is great for shutting up the syzbot report, but it causes file writes to an inline data file via a mmap to never get written back to the storage device. So you are replacing BUG_ON that can get triggered on a race condition in case of a failed block allocation, with silent data corruption. This is not an improvement.
Thanks for trying to address this, but I'm not going to accept your proposed fix.
- Ted