)]}'
{
  "commit": "cb85f4d23f794e24127f3e562cb3b54b0803f456",
  "tree": "8a8bf16b434a1f9e78b91220ef8eca39cc31a47f",
  "parents": [
    "bbd55937de8f2754adc5792b0f8e5ff7d9c0420e"
  ],
  "author": {
    "name": "Eric Biggers",
    "email": "ebiggers@google.com",
    "time": "Wed Feb 19 10:30:47 2020 -0800"
  },
  "committer": {
    "name": "Theodore Ts\u0027o",
    "email": "tytso@mit.edu",
    "time": "Fri Feb 21 19:32:07 2020 -0500"
  },
  "message": "ext4: fix race between writepages and enabling EXT4_EXTENTS_FL\n\nIf EXT4_EXTENTS_FL is set on an inode while ext4_writepages() is running\non it, the following warning in ext4_add_complete_io() can be hit:\n\nWARNING: CPU: 1 PID: 0 at fs/ext4/page-io.c:234 ext4_put_io_end_defer+0xf0/0x120\n\nHere\u0027s a minimal reproducer (not 100% reliable) (root isn\u0027t required):\n\n        while true; do\n                sync\n        done \u0026\n        while true; do\n                rm -f file\n                touch file\n                chattr -e file\n                echo X \u003e\u003e file\n                chattr +e file\n        done\n\nThe problem is that in ext4_writepages(), ext4_should_dioread_nolock()\n(which only returns true on extent-based files) is checked once to set\nthe number of reserved journal credits, and also again later to select\nthe flags for ext4_map_blocks() and copy the reserved journal handle to\next4_io_end::handle.  But if EXT4_EXTENTS_FL is being concurrently set,\nthe first check can see dioread_nolock disabled while the later one can\nsee it enabled, causing the reserved handle to unexpectedly be NULL.\n\nSince changing EXT4_EXTENTS_FL is uncommon, and there may be other races\nrelated to doing so as well, fix this by synchronizing changing\nEXT4_EXTENTS_FL with ext4_writepages() via the existing\ns_writepages_rwsem (previously called s_journal_flag_rwsem).\n\nThis was originally reported by syzbot without a reproducer at\nhttps://syzkaller.appspot.com/bug?extid\u003d2202a584a00fffd19fbf,\nbut now that dioread_nolock is the default I also started seeing this\nwhen running syzkaller locally.\n\nLink: https://lore.kernel.org/r/20200219183047.47417-3-ebiggers@kernel.org\nReported-by: syzbot+2202a584a00fffd19fbf@syzkaller.appspotmail.com\nFixes: 6b523df4fb5a (\"ext4: use transaction reservation for extent conversion in ext4_end_io\")\nSigned-off-by: Eric Biggers \u003cebiggers@google.com\u003e\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\nReviewed-by: Jan Kara \u003cjack@suse.cz\u003e\nCc: stable@kernel.org\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "4b986ad42b9d8db9ea875e5d94cad9d606c23724",
      "old_mode": 33188,
      "old_path": "fs/ext4/ext4.h",
      "new_id": "61b37a052052b58b577ad617086dbbcdb90b48f3",
      "new_mode": 33188,
      "new_path": "fs/ext4/ext4.h"
    },
    {
      "type": "modify",
      "old_id": "89725fa425732e4933a95b60200b33f40158537d",
      "old_mode": 33188,
      "old_path": "fs/ext4/migrate.c",
      "new_id": "fb6520f37135509791c35b782ba14dfe328cfa49",
      "new_mode": 33188,
      "new_path": "fs/ext4/migrate.c"
    }
  ]
}