Re: [syzbot] [fs?] [mm?] kernel BUG in __filemap_add_folio

[shaurya <ssranevjti@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 83 bytes --]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[-- Attachment #2: 0001-mm-readahead-fix-race-between-page_cache_ra_order-an.patch --]
[-- Type: text/x-patch, Size: 3056 bytes --]

From ec7ea9a1f03f36672cf5acb23761cfef6b948f21 Mon Sep 17 00:00:00 2001
From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Date: Sun, 30 Nov 2025 20:27:25 +0530
Subject: [PATCH] mm/readahead: fix race between page_cache_ra_order and
 set_blocksize

page_cache_ra_order() reads mapping_min_folio_order() before acquiring
the invalidate_lock, creating a time-of-check-time-of-use (TOCTOU) race
with set_blocksize() which can change the mapping's min_folio_order
while holding the invalidate_lock exclusively.

If set_blocksize() increases the mapping's min_folio_order after
page_cache_ra_order() reads the old value but before it adds folios
to the page cache, the VM_BUG_ON check in __filemap_add_folio() will
trigger:

  VM_BUG_ON_FOLIO(folio_order(folio) < mapping_min_folio_order(mapping),
                  folio);

This can happen because the stale min_order is used to calculate
new_order and constrain the folio order, but filemap_add_folio()
re-reads the (now increased) min_folio_order from the mapping.

Fix this by moving the read of mapping_min_folio_order() and the
new_order calculation to after the invalidate_lock is acquired in
shared mode.

Reported-by: syzbot+4d3cc33ef7a77041efa6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug\?extid\=4d3cc33ef7a77041efa6
Fixes: 47dd67532303 ("block/bdev: lift block size restrictions to 64k")
Cc: stable@vger.kernel.org
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
---
 mm/readahead.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/mm/readahead.c b/mm/readahead.c
index 3a4b5d58eeb6..95718f87bd43 100644
--- a/mm/readahead.c
+++ b/mm/readahead.c
@@ -467,7 +467,7 @@ void page_cache_ra_order(struct readahead_control *ractl,
 	struct address_space *mapping = ractl->mapping;
 	pgoff_t start = readahead_index(ractl);
 	pgoff_t index = start;
-	unsigned int min_order = mapping_min_folio_order(mapping);
+	unsigned int min_order;
 	pgoff_t limit = (i_size_read(mapping->host) - 1) >> PAGE_SHIFT;
 	pgoff_t mark = index + ra->size - ra->async_size;
 	unsigned int nofs;
@@ -483,15 +483,22 @@ void page_cache_ra_order(struct readahead_control *ractl,
 
 	limit = min(limit, index + ra->size - 1);
 
+	/* See comment in page_cache_ra_unbounded() */
+	nofs = memalloc_nofs_save();
+	filemap_invalidate_lock_shared(mapping);
+
+	/*
+	 * Re-read min_order after acquiring the invalidate_lock to avoid a
+	 * race with set_blocksize() which can change the mapping's min_order
+	 * while holding the invalidate_lock exclusively.
+	 */
+	min_order = mapping_min_folio_order(mapping);
 	new_order = min(mapping_max_folio_order(mapping), new_order);
 	new_order = min_t(unsigned int, new_order, ilog2(ra->size));
 	new_order = max(new_order, min_order);
 
 	ra->order = new_order;
 
-	/* See comment in page_cache_ra_unbounded() */
-	nofs = memalloc_nofs_save();
-	filemap_invalidate_lock_shared(mapping);
 	/*
 	 * If the new_order is greater than min_order and index is
 	 * already aligned to new_order, then this will be noop as index
-- 
2.34.1