Root Cause Analysis

1. Relevant Functions, Structs, and Files

• Files:
  • fs/ext4/truncate.h: Defines ext4_truncate_failed_write().
  • fs/ext4/inode.c: Defines ext4_journalled_write_end(), ext4_journalled_invalidate_folio(), __ext4_journalled_invalidate_folio(), and ext4_wait_for_tail_page_commit().
  • fs/jbd2/transaction.c: Defines jbd2_journal_invalidate_folio() and journal_unmap_buffer().
  • mm/truncate.c: Implements truncate_inode_pages_range(), truncate_inode_partial_folio(), and folio_invalidate().
• Structures and Fields:
  • struct folio: Folio straddling EOF / inode->i_size.
  • struct buffer_head & struct journal_head: Buffer and journal metadata heads attached to the folio.
  • journal_t: JBD2 journal (journal->j_committing_transaction, journal->j_running_transaction).
  • transaction_t: Current committing transaction (jh->b_transaction == journal->j_committing_transaction).
  • struct address_space_operations: ext4_journalled_aops.invalidate_folio.

2. Triggering Mechanism and Invariant Violation

1. Triggering Sequence:

   • A file on an ext4 filesystem configured in data=journal mode (ext4_should_journal_data(inode) == true) with a sub-page block size (blocksize < PAGE_SIZE, e.g., 1KB blocks with 4KB pages) undergoes an extending buffered write (pwritev -> generic_perform_write()).
   • ext4_write_begin() instantiates and allocates new disk blocks beyond the existing inode->i_size.
   • The user-space copy operation then experiences a fault or short copy (copied < len, e.g., page fault at CR2 = 0x20000000d000).
   • Execution reaches ext4_journalled_write_end() (fs/ext4/inode.c):
     • The journalled buffers are zeroed and marked dirty via write_end_fn() -> ext4_dirty_journalled_data().
     • The inode size is updated to pos + copied via ext4_update_inode_size(), leaving inode->i_size unaligned with the page boundary (straddling the folio).
     • The inode is added to the orphan list (ext4_orphan_add()), and the transaction handle is stopped via ext4_journal_stop(handle).
     • Because blocks were allocated past the new inode->i_size (pos + len > inode->i_size), ext4_journalled_write_end() calls ext4_truncate_failed_write(inode) to clean up unwritten blocks.

2. The Invariant Violation:

   • In JBD2, when invalidating a partial folio (partial_page == (offset || length < folio_size(folio))), any buffer_head undergoing commit (jh->b_transaction == journal->j_committing_transaction) cannot be discarded or unmapped immediately because its contents are actively being written to the journal.
   • journal_unmap_buffer() (fs/jbd2/transaction.c:2406-2415) explicitly enforces this rule:

     if (partial_page) {
         ...
         return -EBUSY;
     }
     

     Callers invalidating partial folios in data=journal mode must wait for the committing transaction to complete and then retry.
   • Because VFS a_ops->invalidate_folio() returns void, the page cache truncation code (truncate_inode_partial_folio()) cannot handle or retry -EBUSY.
   • In the standard truncate path (ext4_truncate_down(), fs/ext4/inode.c:6974), ext4 explicitly satisfies this requirement before calling truncate_pagecache():

     if (ext4_should_journal_data(inode))
         ext4_wait_for_tail_page_commit(inode);
     

   • However, ext4_truncate_failed_write() (fs/ext4/truncate.h:12-24) lacks this check:

     static inline void ext4_truncate_failed_write(struct inode *inode)
     {
         struct address_space *mapping = inode->i_mapping;
     
         filemap_invalidate_lock(mapping);
         truncate_inode_pages(mapping, inode->i_size);
         ext4_truncate(inode);
         filemap_invalidate_unlock(mapping);
     }
     

     It directly calls truncate_inode_pages(mapping, inode->i_size) without calling ext4_wait_for_tail_page_commit(inode).

3. Manifestation:

   • truncate_inode_pages() calls truncate_inode_partial_folio(), which calls folio_invalidate(folio, offset, length), invoking ext4_journalled_invalidate_folio().
   • __ext4_journalled_invalidate_folio() calls jbd2_journal_invalidate_folio().
   • Because the buffer is still tied to journal->j_committing_transaction and partial_page is true, journal_unmap_buffer() returns -EBUSY (RBX = 0xfffffff0).
   • ext4_journalled_invalidate_folio() checks the return code and encounters -EBUSY < 0, triggering the warning at line 3561:

     WARN_ON(__ext4_journalled_invalidate_folio(folio, offset, length) < 0);