minix: restore uptodate on bitmap buffers before redirtying them

The inode and zone bitmap buffers are read once at mount time and stay
pinned in sbi->s_imap[] and sbi->s_zmap[] until unmount. Their in-memory
contents are the authoritative copy of the allocation state.

If writeback of one of these buffers fails, the buffer write completion
handler marks a write I/O error and clears BH_Uptodate. The next bitmap
update then calls mark_buffer_dirty() on a buffer that is no longer
uptodate and trips:

  WARNING: fs/buffer.c:991 at mark_buffer_dirty+0x299/0x410
  ...
   minix_free_block fs/minix/bitmap.c
   free_data fs/minix/itree_common.c:272 [inline]
   truncate fs/minix/itree_common.c:321 [inline]
   V1_minix_truncate+0x310/0x10c0 fs/minix/itree_v1.c:61
   minix_evict_inode+0x1c9/0x260 fs/minix/inode.c:52
   evict+0x624/0xb50 fs/inode.c:822
   minix_mkdir+0xdc/0x120 fs/minix/namei.c:136

syzbot hits this by shrinking the loop device under a mounted minix
filesystem so that bitmap writeback fails, then letting a failed mkdir
evict the new inode and free its blocks.

Since the buffer data is still valid, do what ext2 and ext4 do for their
long-lived superblock buffers: clear the write I/O error and set the
buffer uptodate again before dirtying it, so the bitmap is written out
again on the next writeback. Do this under the buffer lock so it cannot
interleave with a write that is still in flight and about to fail. The
original failure has already been logged and recorded in the block
device mapping by mark_buffer_write_io_error(), so clearing the per-buffer
flag does not hide it.

Reported-by: syzbot+e353ad4408c4f9fac965@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e353ad4408c4f9fac965
Signed-off-by: Sanan Hasanov <sanan.hasanov@ucf.edu>
Link: https://patch.msgid.link/20261019013645.40834-1-sanan.hasanou@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

0 files changed, 0 insertions, 0 deletions