Re: [PATCH] nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

On Mon, 2026-07-20 at 23:16 +0900, Ryusuke Konishi wrote:
> Syzbot reported a kernel BUG triggered within
> nilfs_copy_dirty_pages(),
> which copies dirty DAT file folios/pages to its shadow page cache.=C2=A0
> The
> BUG occurs when a retrieved dirty folio/page unexpectedly loses its
> 'dirty' status.
>=20
> This issue arises because, since the commit referenced below, the
> 'dirty'
> flag of a folio/page can be cleared asynchronously after the
> filesystem
> detects metadata corruption and transitions to read-only mode.
>=20
> Resolve the issue by returning an -EROFS error if the filesystem has
> transitioned to read-only mode.=C2=A0 Also change the behavior to issue a
> kernel warning only once instead of triggering a kernel BUG when this
> unexpected 'dirty' state is detected while the filesystem is not in
> read-only mode.
>=20
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=3D8baf9a79a3ffc6271cb6
> Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread
> after remount in RO mode because of driver's internal error or
> metadata corruption")
> Signed-off-by: Ryusuke Konishi <[email protected]>
> ---
> Viacheslav, please apply this for the next cycle.
>=20
> This fixes an issue reported by syzbot where a kernel BUG could be
> triggered depending on timing after filesystem corruption is
> detected.
>=20
> Thanks,
> Ryusuke Konishi
>=20
> =C2=A0fs/nilfs2/page.c | 17 +++++++++++++++--
> =C2=A01 file changed, 15 insertions(+), 2 deletions(-)
>=20
> diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c
> index a9d8aa65416f..1d00bce21c37 100644
> --- a/fs/nilfs2/page.c
> +++ b/fs/nilfs2/page.c
> @@ -243,6 +243,7 @@ static void nilfs_copy_folio(struct folio *dst,
> struct folio *src,
> =C2=A0int nilfs_copy_dirty_pages(struct address_space *dmap,
> =C2=A0			=C2=A0=C2=A0 struct address_space *smap)
> =C2=A0{
> +	struct inode *smap_inode =3D smap->host;
> =C2=A0	struct folio_batch fbatch;
> =C2=A0	unsigned int i;
> =C2=A0	pgoff_t index =3D 0;
> @@ -258,8 +259,19 @@ int nilfs_copy_dirty_pages(struct address_space
> *dmap,
> =C2=A0		struct folio *folio =3D fbatch.folios[i], *dfolio;
> =C2=A0
> =C2=A0		folio_lock(folio);
> -		if (unlikely(!folio_test_dirty(folio)))
> -			NILFS_FOLIO_BUG(folio, "inconsistent dirty
> state");
> +		if (unlikely(!folio_test_dirty(folio))) {
> +			if (WARN_ONCE(!sb_rdonly(smap_inode->i_sb),
> +					"inconsistent dirty
> state\n"))
> +				goto unlock_folio;
> +
> +			/*
> +			 * If the filesystem has been forced to
> read-only
> +			 * due to metadata corruption.
> +			 */
> +			folio_unlock(folio);
> +			err =3D -EROFS;
> +			break;
> +		}
> =C2=A0
> =C2=A0		dfolio =3D filemap_grab_folio(dmap, folio->index);
> =C2=A0		if (IS_ERR(dfolio)) {
> @@ -277,6 +289,7 @@ int nilfs_copy_dirty_pages(struct address_space
> *dmap,
> =C2=A0
> =C2=A0		folio_unlock(dfolio);
> =C2=A0		folio_put(dfolio);
> +unlock_folio:
> =C2=A0		folio_unlock(folio);
> =C2=A0	}
> =C2=A0	folio_batch_release(&fbatch);

Applied.

Thanks,
Slava.