lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 22 Nov 2023 18:11:12 +0100
From: Jan Kara <>
To: syzbot <>
Subject: Re: [syzbot] [ext4?] WARNING in ext4_dio_write_end_io

On Wed 22-11-23 07:10:31, syzbot wrote:
> syzbot found the following issue on:
> HEAD commit:    98b1cc82c4af Linux 6.7-rc2
> git tree:       upstream
> console+strace:
> kernel config:
> dashboard link:
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:
> C reproducer:
> Downloadable assets:
> disk image:
> vmlinux:
> kernel image:
> The issue was bisected to:
> commit 91562895f8030cb9a0470b1db49de79346a69f91
> Author: Jan Kara <>
> Date:   Fri Oct 13 12:13:50 2023 +0000
>     ext4: properly sync file size update after O_SYNC direct IO
> bisection log:
> final oops:
> console output:
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by:
> Fixes: 91562895f803 ("ext4: properly sync file size update after O_SYNC direct IO")
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 4481 at fs/ext4/file.c:391 ext4_dio_write_end_io+0x1db/0x220 fs/ext4/file.c:391

OK, so I could easily reproduce this which is good :). It took a bit longer
to actually debug what's going on. In the end I've confirmed this is a
false positive (the assertion isn't 100% reliable). What happens is that
the IO end completion races with expanding truncate (which is not
synchronized with DIO in any way) and the assertion sees a situation where
i_disksize was updated but i_size not yet. This is mostly harmless but we
better should complete the DIO only once we are sure truncate has updated
the i_size as well. I'll think how to best do this.

Jan Kara <>

Powered by blists - more mailing lists