Received-SPF: pass (google.com: domain of linux-kernel+bounces-18459-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Hillf Danton <hdanton@sina.com>
To: syzbot <syzbot+a43d4f48b8397d0e41a9@syzkaller.appspotmail.com>
Cc: linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [ext4?] INFO: task hung in ext4_quota_write
Date: Sat,  6 Jan 2024 10:48:07 +0800
Message-Id: <20240106024807.3011-1-hdanton@sina.com>
In-Reply-To: <000000000000c8a56a060de13553@google.com>
References: <000000000000c8a56a060de13553@google.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

On Mon, 01 Jan 2024 04:06:21 -0800
> HEAD commit:    f5837722ffec Merge tag 'mm-hotfixes-stable-2023-12-27-15-0..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13177855e80000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  master

--- x/include/linux/sched.h
+++ y/include/linux/sched.h
@@ -1544,6 +1544,7 @@ struct task_struct {
 	struct user_event_mm		*user_event_mm;
 #endif
 
+	unsigned long	bfl;
 	/*
 	 * New fields for task_struct should be added above here, so that
 	 * they are included in the randomized portion of task_struct.
--- x/include/linux/buffer_head.h
+++ y/include/linux/buffer_head.h
@@ -78,6 +78,7 @@ struct buffer_head {
 	spinlock_t b_uptodate_lock;	/* Used by the first bh in a page, to
 					 * serialise IO completion of other
 					 * buffers in the page */
+	struct task_struct *lko;
 };
 
 /*
@@ -402,6 +403,9 @@ static inline void lock_buffer(struct bu
 	might_sleep();
 	if (!trylock_buffer(bh))
 		__lock_buffer(bh);
+	bh->lko = current;
+	get_task_struct(bh->lko);
+	bh->lko->bfl = (unsigned long) bh;
 }
 
 static inline void bh_readahead(struct buffer_head *bh, blk_opf_t op_flags)
--- x/fs/ext4/super.c
+++ y/fs/ext4/super.c
@@ -7248,6 +7248,7 @@ static ssize_t ext4_quota_write(struct s
 		brelse(bh);
 		return err;
 	}
+	BUG_ON(current->bfl == (unsigned long) bh);
 	lock_buffer(bh);
 	memcpy(bh->b_data+offset, data, len);
 	flush_dcache_page(bh->b_page);
--- x/fs/buffer.c
+++ y/fs/buffer.c
@@ -77,6 +77,11 @@ void unlock_buffer(struct buffer_head *b
 	clear_bit_unlock(BH_Lock, &bh->b_state);
 	smp_mb__after_atomic();
 	wake_up_bit(&bh->b_state, BH_Lock);
+	if (!bh->lko)
+		return;
+	bh->lko->bfl = 0;
+	put_task_struct(bh->lko);
+	bh->lko = NULL;
 }
 EXPORT_SYMBOL(unlock_buffer);
 
--