* [syzbot] [gfs2?] general protection fault in _find_first_zero_bit
@ 2026-06-29 20:48 syzbot
2026-06-30 0:06 ` Forwarded: [PATCH] gfs2: fix null-ptr-deref in gfs2_quota_hold during unmount syzbot
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2026-06-29 20:48 UTC (permalink / raw)
To: agruenba, gfs2, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 51cb1aa1250c Merge tag 'loongarch-7.2' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10748efa580000
kernel config: https://syzkaller.appspot.com/x/.config?x=86ba763b42fa66a
dashboard link: https://syzkaller.appspot.com/bug?extid=cb79de2cc8b76fbf474f
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12b7c246580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1205b6b1580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/edf195a1627e/disk-51cb1aa1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e282a4f3a85b/vmlinux-51cb1aa1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a485374265d8/bzImage-51cb1aa1.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/82f270d69c7c/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=17b48efa580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cb79de2cc8b76fbf474f@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 5755 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:_find_first_zero_bit+0x29/0xb0 lib/find_bit.c:149
Code: 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 85 f6 74 46 48 89 f3 49 89 fe 49 bf 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 b8 55 7c fd 49 8b 06 48 83 f8 ff
RSP: 0018:ffffc9000365f6c0 EFLAGS: 00010256
RAX: 0000000000000000 RBX: 000000000000f800 RCX: 0000000000000000
RDX: ffff888034374c40 RSI: 000000000000f800 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520006cbecc R12: ffff888058d1d3f0
R13: ffff888034374c38 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888125223000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8b8a06ea00 CR3: 000000000e746000 CR4: 0000000000350ef0
Call Trace:
<TASK>
find_first_zero_bit include/linux/find.h:391 [inline]
slot_get fs/gfs2/quota.c:355 [inline]
qdsb_get+0x133/0x340 fs/gfs2/quota.c:522
gfs2_quota_hold+0x191/0x5c0 fs/gfs2/quota.c:606
gfs2_dinode_dealloc+0x176/0x3f0 fs/gfs2/inode.c:488
evict_unlinked_inode fs/gfs2/super.c:1329 [inline]
gfs2_evict_inode+0x11cd/0x1400 fs/gfs2/super.c:1479
evict+0x624/0xb50 fs/inode.c:825
gfs2_put_super+0x300/0x860 fs/gfs2/super.c:618
generic_shutdown_super+0x13d/0x2d0 fs/super.c:647
kill_block_super+0x44/0x90 fs/super.c:1665
deactivate_locked_super+0xbc/0x130 fs/super.c:477
cleanup_mnt+0x3d3/0x460 fs/namespace.c:1317
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x73a/0x2360 kernel/exit.c:1004
do_group_exit+0x22d/0x2f0 kernel/exit.c:1147
__do_sys_exit_group kernel/exit.c:1158 [inline]
__se_sys_exit_group kernel/exit.c:1156 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1156
x64_sys_call+0x221a/0x2240 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8b89f9ce59
Code: Unable to access opcode bytes at 0x7f8b89f9ce2f.
RSP: 002b:00007ffc5b7df378 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f8b8a03233c RCX: 00007f8b89f9ce59
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000016 R08: 0000000000000000 R09: 00007f8b8a0322ca
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc5b7e0630
R13: 00007f8b8a0322ca R14: 0000555582f544e8 R15: 00007ffc5b7e49d0
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:_find_first_zero_bit+0x29/0xb0 lib/find_bit.c:149
Code: 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 85 f6 74 46 48 89 f3 49 89 fe 49 bf 00 00 00 00 00 fc ff df 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 b8 55 7c fd 49 8b 06 48 83 f8 ff
RSP: 0018:ffffc9000365f6c0 EFLAGS: 00010256
RAX: 0000000000000000 RBX: 000000000000f800 RCX: 0000000000000000
RDX: ffff888034374c40 RSI: 000000000000f800 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520006cbecc R12: ffff888058d1d3f0
R13: ffff888034374c38 R14: 0000000000000000 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888125223000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8b8a06ea00 CR3: 000000000e746000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 90 nop
1: f3 0f 1e fa endbr64
5: 41 57 push %r15
7: 41 56 push %r14
9: 41 55 push %r13
b: 41 54 push %r12
d: 53 push %rbx
e: 48 85 f6 test %rsi,%rsi
11: 74 46 je 0x59
13: 48 89 f3 mov %rsi,%rbx
16: 49 89 fe mov %rdi,%r14
19: 49 bf 00 00 00 00 00 movabs $0xdffffc0000000000,%r15
20: fc ff df
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 4c 89 f7 mov %r14,%rdi
34: e8 b8 55 7c fd call 0xfd7c55f1
39: 49 8b 06 mov (%r14),%rax
3c: 48 83 f8 ff cmp $0xffffffffffffffff,%rax
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 2+ messages in thread
* Forwarded: [PATCH] gfs2: fix null-ptr-deref in gfs2_quota_hold during unmount
2026-06-29 20:48 [syzbot] [gfs2?] general protection fault in _find_first_zero_bit syzbot
@ 2026-06-30 0:06 ` syzbot
0 siblings, 0 replies; 2+ messages in thread
From: syzbot @ 2026-06-30 0:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] gfs2: fix null-ptr-deref in gfs2_quota_hold during unmount
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
gfs2_quota_cleanup() frees sd_quota_bitmap early in gfs2_put_super()
before the iput() calls that can trigger inode eviction. When an unlinked
inode is evicted during unmount, it goes through:
gfs2_evict_inode() -> gfs2_dinode_dealloc() -> gfs2_quota_hold()
-> qdsb_get() -> slot_get() -> find_first_zero_bit(sd_quota_bitmap)
If sd_quota_bitmap has already been freed by gfs2_quota_cleanup(), this
results in a null pointer dereference:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
_find_first_zero_bit+0x29/0xb0 lib/find_bit.c:149
slot_get fs/gfs2/quota.c:355
qdsb_get+0x133/0x340 fs/gfs2/quota.c:522
gfs2_quota_hold+0x191/0x5c0 fs/gfs2/quota.c:606
gfs2_dinode_dealloc+0x176/0x3f0 fs/gfs2/inode.c:488
gfs2_evict_inode+0x11cd/0x1400 fs/gfs2/super.c:1479
gfs2_put_super+0x300/0x860 fs/gfs2/super.c:618
The same problem exists in both paths through gfs2_put_super(): the
direct gfs2_quota_cleanup() call in the read-only branch, and indirectly
via gfs2_make_fs_ro() in the read-write branch.
Fix this by removing gfs2_quota_cleanup() from gfs2_make_fs_ro() and
moving it to after all the iput() calls in gfs2_put_super(), ensuring
sd_quota_bitmap remains valid for the entire duration of inode eviction.
Restore an explicit gfs2_quota_cleanup() call in gfs2_reconfigure() after
gfs2_make_fs_ro() to preserve the remount-ro cleanup behaviour.
Reported-by: syzbot+cb79de2cc8b76fbf474f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cb79de2cc8b76fbf474f
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
fs/gfs2/ops_fstype.c | 1 +
fs/gfs2/super.c | 5 ++---
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 9b9e70f14d25..56bc966531f2 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1592,6 +1592,7 @@ static int gfs2_reconfigure(struct fs_context *fc)
if ((sb->s_flags ^ fc->sb_flags) & SB_RDONLY) {
if (fc->sb_flags & SB_RDONLY) {
gfs2_make_fs_ro(sdp);
+ gfs2_quota_cleanup(sdp);
} else {
error = gfs2_make_fs_rw(sdp);
if (error)
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 4d854556b529..e13c9f9efe6c 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -565,7 +565,6 @@ void gfs2_make_fs_ro(struct gfs2_sbd *sdp)
HZ * 5);
gfs2_assert_warn(sdp, gfs2_log_is_empty(sdp));
}
- gfs2_quota_cleanup(sdp);
}
/**
@@ -604,8 +603,6 @@ static void gfs2_put_super(struct super_block *sb)
else {
if (gfs2_withdrawn(sdp))
gfs2_destroy_threads(sdp);
-
- gfs2_quota_cleanup(sdp);
}
/* At this point, we're through modifying the disk */
@@ -637,6 +634,8 @@ static void gfs2_put_super(struct super_block *sb)
gfs2_glock_dq_uninit(&sdp->sd_live_gh);
gfs2_clear_rgrpd(sdp);
gfs2_jindex_free(sdp);
+
+ gfs2_quota_cleanup(sdp);
/* Take apart glock structures and buffer lists */
gfs2_gl_hash_clear(sdp);
iput(sdp->sd_inode);
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-30 0:06 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-29 20:48 [syzbot] [gfs2?] general protection fault in _find_first_zero_bit syzbot
2026-06-30 0:06 ` Forwarded: [PATCH] gfs2: fix null-ptr-deref in gfs2_quota_hold during unmount syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.