[BUG]:WARNING: fs/buffer.c:1093 at mark_buffer_dirty+0x385/0x410, CPU#1: syz.0.17/10814

[Xianying Wang]

Hi,

I am reporting a warning triggered by a syzkaller reproducer on Linux
7.2.0-rc3.

This appears to be a recurrence/regression of a bug that had already been
reported on an earlier kernel version, but it is reproducible again on
Linux 7.2.0-rc3.

The warning is hit in mark_buffer_dirty() while writing to a file on a
crafted BFS filesystem image. The direct caller is bfs_get_block() from
the BFS write path.

This looks like BFS may be marking a buffer dirty before the buffer is
uptodate, or without properly validating/initializing the metadata buffer
when handling a malformed BFS image.

Reproducer:

syz reproducer:
syz_mount_image$bfs(&(0x7f00000001c0),
&(0x7f0000000400)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06
\x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4,
&(0x7f0000000300)=ANY=[], 0x8, 0xad, &(0x7f0000000780)=...)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x101442, 0x0)
syz_clone(0x200, 0x0, 0x36, 0x0, 0x0, 0x0)
pwrite64(r0, &(0x7f0000000140)='2', 0xfdef, 0xfecc)


This can be reproduced on:
HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
kernel config: https://pastebin.com/raw/WuuR7g63
console output: https://pastebin.com/raw/ms5G7BFV

Let me know if you need more details or testing.
Best regards,
Xianying