task hung in exfat_write_inode

From: Lizhi Xu
Date: Thu Dec 21 2023 - 01:11:21 EST


#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f9ff5644bcc0

diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
index 56b870d9cc0d..2908eb82fe68 100644
--- a/fs/exfat/fatent.c
+++ b/fs/exfat/fatent.c
@@ -149,7 +149,7 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain
{
struct super_block *sb = inode->i_sb;
struct exfat_sb_info *sbi = EXFAT_SB(sb);
- int cur_cmap_i, next_cmap_i;
+ int cur_cmap_i, next_cmap_i, ei = 0;
unsigned int num_clusters = 0;
unsigned int clu;

@@ -176,8 +176,11 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain

if (p_chain->flags == ALLOC_NO_FAT_CHAIN) {
unsigned int last_cluster = p_chain->dir + p_chain->size - 1;
+ printk("b dir: %u, s: %u, nc: %u\n", p_chain->dir, p_chain->size, num_clusters);
do {
bool sync = false;
+ if (ei > 100)
+ break;

if (clu < last_cluster)
next_cmap_i =
@@ -192,12 +195,17 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain
exfat_clear_bitmap(inode, clu, (sync && IS_DIRSYNC(inode)));
clu++;
num_clusters++;
+ ei++;
} while (num_clusters < p_chain->size);
+ printk("e dir: %u, s: %u, nc: %u, e: %d\n", p_chain->dir, p_chain->size, num_clusters, ei);
} else {
+ printk("b2 dir: %u, s: %u, nc: %u\n", p_chain->dir, p_chain->size, num_clusters);
do {
bool sync = false;
unsigned int n_clu = clu;
int err = exfat_get_next_cluster(sb, &n_clu);
+ if (ei > 100)
+ break;

if (err || n_clu == EXFAT_EOF_CLUSTER)
sync = true;
@@ -213,10 +221,12 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain
exfat_clear_bitmap(inode, clu, (sync && IS_DIRSYNC(inode)));
clu = n_clu;
num_clusters++;
+ ei++;

if (err)
goto dec_used_clus;
} while (clu != EXFAT_EOF_CLUSTER);
+ printk("e2 dir: %u, s: %u, nc: %u, e: %d\n", p_chain->dir, p_chain->size, num_clusters, ei);
}

dec_used_clus:
@@ -229,8 +239,10 @@ int exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain)
int ret = 0;

mutex_lock(&EXFAT_SB(inode->i_sb)->bitmap_lock);
+ printk("i: %p, %s\n", inode, __func__);
ret = __exfat_free_cluster(inode, p_chain);
mutex_unlock(&EXFAT_SB(inode->i_sb)->bitmap_lock);
+ printk("r: %d, i: %p, %s\n", ret, inode, __func__);

return ret;
}