On 2023/12/8 22:12, xingwei lee wrote:
Hello I saw you can't reproduce this bug and I reproduce it with repro.c and repro.txt I test the repro.c in the lastest HEAD: 5e3f5b81de80c98338bcb47c233aebefee5a4801 kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=6ae1a4ee971a7305 and the bug also existed.
Hello xingwei! Thanks for the reproducer! The problem is that the same range of physical blocks are freed in ext4_mb_release_inode_pa() and ext4_process_freed_data() successively. Thus in mb_free_blocks() bb_free is added twice, while bb_fragments is added only once, the second time exiting early due to checking for release of already freed blocks. So when fstrim marks all the blocks in the group as already used, bb_free not being 0 and bb_fragments being 0 triggers a divide-by-zero problem in mb_update_avg_fragment_size(). We should avoid freeing blocks in ext4_mb_release_inode_pa() that are about to be freed in ext4_process_freed_data(). I will send out a patch after doing some tests. Cheers! -- With Best Regards, Baokun Li .
