[PATCH] ext4: prevent inline data creation on extent-based inodes

[Yun Zhou]

ext4_prepare_inline_data() only checks EXT4_STATE_MAY_INLINE_DATA
before creating inline data.  However, after ext4_convert_inline_data()
converts an inode to use extents, a concurrent write can race and
re-create inline data via ext4_create_inline_data(), which re-sets
MAY_INLINE_DATA.  This leads to an inconsistent state where an
extent-based inode has inline data, causing BUG_ON in
ext4_do_writepages() when dirty mmap pages exist.

The race window is between ext4_convert_inline_data() clearing
MAY_INLINE_DATA and the concurrent write checking it:

  page_mkwrite:                     write:
    ext4_convert_inline_data()        ext4_da_write_begin()
      ext4_has_inline_data = false      MAY_INLINE_DATA set (from iget)
      clear MAY_INLINE_DATA             ext4_prepare_inline_data()
      return 0                            ext4_create_inline_data() success!
    block_page_mkwrite() success            re-sets MAY_INLINE_DATA!
    folio dirty, PTE writable
                                    writepages:
                                      ext4_has_inline_data = TRUE
                                      MAY_INLINE_DATA = TRUE
                                      dirty page exists
                                      -> BUG_ON!

Fix this by adding a check for EXT4_INODE_EXTENTS in
ext4_prepare_inline_data().  Once an inode has been converted to use
extents, it must never go back to inline data regardless of the
MAY_INLINE_DATA state.

Reported-by: syzbot+d1da16f03614058fdc48@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=d1da16f03614058fdc48
Fixes: 7b4cc9787fe3 ("ext4: evict inline data when writing to memory map")
Signed-off-by: Yun Zhou <yun.zhou@xxxxxxxxxxxxx>
---
An alternative (or complementary) approach would be to convert inline
data at mmap_prepare time (ext4_file_mmap_prepare) rather than at
page_mkwrite time.  This eliminates the race window entirely by
converting before the mapping is established, making both this fix
and commit 7b4cc9787fe3 unnecessary.

 fs/ext4/inline.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 26d9164d0609..f9af38620cc7 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -418,6 +418,13 @@ static int ext4_prepare_inline_data(handle_t *handle, struct inode *inode,
 		return -ENOSPC;
 
 	ext4_write_lock_xattr(inode, &no_expand);
+
+	/* Once converted to extents, never go back to inline data. */
+	if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) {
+		ext4_write_unlock_xattr(inode, &no_expand);
+		return -ENOSPC;
+	}
+
 	/*
 	 * ei->i_inline_size may have changed since the initial check
 	 * if other xattrs were added. Recalculate to ensure
-- 
2.43.0