From: syzbot <syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4)
Date: Wed, 25 Mar 2026 01:30:01 -0700 [thread overview]
Message-ID: <69c39d09.050a0220.abc16.0011.GAE@google.com> (raw)
In-Reply-To: <tencent_2DCE347A566EF02C896D3C94B4EB96ECF60A@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in gfs2_invalidate_folio
RBP: 00007ffc7d4253b0 R08: 00007ffc7d4263b0 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc7d426440
R13: 00007f8d07e32050 R14: 0000000000025091 R15: 00007ffc7d426480
</TASK>
gfs2: fsid=syz:syz.0: gfs2_evict_inode: -5
==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in gfs2_discard fs/gfs2/aops.c:590 [inline]
BUG: KASAN: slab-use-after-free in gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
Read of size 8 at addr ffff88807e71e8d8 by task syz-executor/6427
CPU: 0 UID: 0 PID: 6427 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
list_empty include/linux/list.h:381 [inline]
gfs2_discard fs/gfs2/aops.c:590 [inline]
gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
folio_invalidate mm/truncate.c:140 [inline]
truncate_cleanup_folio+0xcb/0x190 mm/truncate.c:160
truncate_inode_pages_range+0x2ce/0xe30 mm/truncate.c:404
gfs2_evict_inode+0x9da/0x12d0 fs/gfs2/super.c:1476
evict+0x61e/0xb10 fs/inode.c:846
gfs2_put_super+0x355/0x890 fs/gfs2/super.c:619
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8d07d9d9d7
Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffc7d4252f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f8d07e32050 RCX: 00007f8d07d9d9d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc7d4253b0
RBP: 00007ffc7d4253b0 R08: 00007ffc7d4263b0 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc7d426440
R13: 00007f8d07e32050 R14: 0000000000025091 R15: 00007ffc7d426480
</TASK>
Allocated by task 6427:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4905
gfs2_alloc_bufdata fs/gfs2/trans.c:176 [inline]
gfs2_trans_add_data+0x1e8/0x610 fs/gfs2/trans.c:215
gfs2_unstuffer_folio fs/gfs2/bmap.c:81 [inline]
__gfs2_unstuff_inode fs/gfs2/bmap.c:119 [inline]
gfs2_unstuff_dinode+0xace/0x1240 fs/gfs2/bmap.c:166
gfs2_adjust_quota+0x23f/0x850 fs/gfs2/quota.c:848
do_sync+0x872/0xcb0 fs/gfs2/quota.c:962
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6427:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6242 [inline]
kmem_cache_free+0x182/0x650 mm/slub.c:6369
gfs2_trans_drain_list fs/gfs2/log.c:995 [inline]
gfs2_trans_drain fs/gfs2/log.c:1013 [inline]
gfs2_log_flush+0x18c1/0x2640 fs/gfs2/log.c:1185
do_sync+0xa48/0xcb0 fs/gfs2/quota.c:982
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88807e71e8c0
which belongs to the cache gfs2-bufdata/syz:syz of size 80
The buggy address is located 24 bytes inside of
freed 80-byte region [ffff88807e71e8c0, ffff88807e71e910)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807e71ea80 pfn:0x7e71e
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff888141ad78c0 ffff8880307dde88 ffff8880307dde88
raw: ffff88807e71ea80 0000000800240018 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6427, tgid 6427 (syz-executor), ts 151784205341, free_ts 151343117657
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x2418/0x24b0 mm/page_alloc.c:3926
__alloc_frozen_pages_noprof+0x233/0x3d0 mm/page_alloc.c:5213
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3467
new_slab mm/slub.c:3525 [inline]
refill_objects+0x339/0x3d0 mm/slub.c:7247
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x321/0x720 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
kmem_cache_alloc_noprof+0x37d/0x650 mm/slub.c:4905
gfs2_alloc_bufdata fs/gfs2/trans.c:176 [inline]
gfs2_trans_add_meta+0x214/0x8e0 fs/gfs2/trans.c:279
gfs2_alloc_extent fs/gfs2/rgrp.c:2237 [inline]
gfs2_alloc_blocks+0x7ae/0x2090 fs/gfs2/rgrp.c:2447
__gfs2_unstuff_inode fs/gfs2/bmap.c:107 [inline]
gfs2_unstuff_dinode+0x249/0x1240 fs/gfs2/bmap.c:166
gfs2_adjust_quota+0x23f/0x850 fs/gfs2/quota.c:848
do_sync+0x872/0xcb0 fs/gfs2/quota.c:962
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
page last free pid 6500 tgid 6499 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
free_unref_folios+0xcec/0x1480 mm/page_alloc.c:3005
folios_put_refs+0x9ff/0xb40 mm/swap.c:1008
folio_batch_release include/linux/folio_batch.h:101 [inline]
truncate_inode_pages_range+0x3dd/0xe30 mm/truncate.c:408
kill_bdev block/bdev.c:91 [inline]
set_blocksize+0x2ce/0x440 block/bdev.c:207
sb_set_blocksize+0xf8/0x240 block/bdev.c:240
init_sb+0x9d4/0x12f0 fs/gfs2/ops_fstype.c:490
gfs2_fill_super+0x1739/0x21d0 fs/gfs2/ops_fstype.c:1225
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
gfs2_get_tree+0x51/0x1e0 fs/gfs2/ops_fstype.c:1342
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3764 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3840
do_mount fs/namespace.c:4173 [inline]
__do_sys_mount fs/namespace.c:4372 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4349
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88807e71e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807e71e800: fc fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb
>ffff88807e71e880: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff88807e71e900: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb
ffff88807e71e980: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fc fc
==================================================================
Tested on:
commit: 85964cdc Add linux-next specific files for 20260324
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=126f0c26580000
kernel config: https://syzkaller.appspot.com/x/.config?x=84ab18c6f45b39c
dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=14bbc4ca580000
next prev parent reply other threads:[~2026-03-25 8:30 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-23 20:13 [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) syzbot
2026-03-24 1:49 ` Forwarded: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page syzbot
2026-03-24 2:30 ` syzbot
2026-03-24 9:27 ` Forwarded: [PATCH] gfs2: fix duplicate kmem_cache on repeated mount failure syzbot
2026-03-25 7:37 ` [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) Edward Adam Davis
2026-03-25 8:18 ` syzbot
2026-03-25 7:49 ` Edward Adam Davis
2026-03-25 8:30 ` syzbot [this message]
2026-03-25 7:50 ` [PATCH] gfs2: prevent corrupt data from entering jextent Edward Adam Davis
2026-03-25 10:25 ` [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) Edward Adam Davis
2026-03-25 11:24 ` syzbot
[not found] <20260324014901.1451209-1-kartikey406@gmail.com>
2026-03-24 2:21 ` syzbot
[not found] <20260324023042.1453608-1-kartikey406@gmail.com>
2026-03-24 2:48 ` syzbot
[not found] <20260324092747.1459265-1-kartikey406@gmail.com>
2026-03-24 9:46 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69c39d09.050a0220.abc16.0011.GAE@google.com \
--to=syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.