* [syzbot] [mm?] [gfs2?] WARNING in read_rindex_entry
@ 2026-08-19 22:49 syzbot
2026-08-20 0:14 ` Andrew Morton
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: syzbot @ 2026-08-19 22:49 UTC (permalink / raw)
To: akpm, apopple, byungchul, david, gfs2, gourry, joshua.hahnjy,
linux-kernel, linux-mm, matthew.brost, rakie.kim, syzkaller-bugs,
ying.huang, ziy
Hello,
syzbot found the following issue on:
HEAD commit: 15ef2f78c49d Merge tag 'input-for-v7.2-rc7' of git://git.k..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=10871279580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a0fdc3b566746377
dashboard link: https://syzkaller.appspot.com/bug?extid=9d20c3ad7d29227de28d
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14871279580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=100d2a25580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c2a8c7d3a889/disk-15ef2f78.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2da78afed345/vmlinux-15ef2f78.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c4ffd97e4708/bzImage-15ef2f78.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/eaa4120812b6/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=17f52a25580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9d20c3ad7d29227de28d@syzkaller.appspotmail.com
gfs2: fsid=.: Now mounting FS (format 1801)...
gfs2: fsid=..0: journal 0 mapped with 18 extents in 0ms
gfs2: fsid=..0: first mount done, others may mount
------------[ cut here ]------------
1
WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2427/0x2dc0 mm/page_alloc.c:5280, CPU#1: syz-executor256/5629
Modules linked in:
CPU: 1 UID: 0 PID: 5629 Comm: syz-executor256 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:__alloc_frozen_pages_noprof+0x2427/0x2dc0 mm/page_alloc.c:5280
Code: e9 8d fb ff ff 31 d2 be 28 12 00 00 48 c7 c7 a0 64 e1 8b e8 5b 8c 69 ff 2e 2e 2e 31 c0 e9 02 ed ff ff c6 05 54 c1 9d 0e 01 90 <0f> 0b 90 e9 6f df ff ff 48 c7 c7 80 ae d3 8e 45 89 f7 44 8b 74 24
RSP: 0018:ffffc9000345f0e0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 1ffff9200068be36 RDI: 0000000000040d40
RBP: 000000000000000b R08: 0000000000000005 R09: 0000000000000009
R10: 000000000000000b R11: 0000000000000000 R12: 0000000000040d40
R13: 1ffff9200068be74 R14: ffffffff9b759444 R15: 0000000000000001
FS: 000055556d263400(0000) GS:ffff888123ee1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055886dbe9978 CR3: 000000003394d000 CR4: 0000000000350ef0
Call Trace:
<TASK>
alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490
___kmalloc_large_node+0xe5/0x120 mm/slub.c:5274
__kmalloc_large_node_noprof+0x1c/0x70 mm/slub.c:5305
__do_kmalloc_node mm/slub.c:5322 [inline]
__kmalloc_noprof+0x5a1/0x820 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
_kzalloc_noprof include/linux/slab.h:1309 [inline]
compute_bitstructs fs/gfs2/rgrp.c:766 [inline]
read_rindex_entry+0x4a1/0x1250 fs/gfs2/rgrp.c:931
gfs2_ri_update+0x6f/0x3b0 fs/gfs2/rgrp.c:1001
gfs2_rindex_update+0x40b/0x480 fs/gfs2/rgrp.c:1051
init_inodes+0x1f78/0x2790 fs/gfs2/ops_fstype.c:872
gfs2_fill_super+0x1d3d/0x2cf0 fs/gfs2/ops_fstype.c:1250
get_tree_bdev_flags+0x38c/0x620 fs/super.c:1640
gfs2_get_tree+0x4e/0x280 fs/gfs2/ops_fstype.c:1332
vfs_get_tree+0x92/0x320 fs/super.c:1700
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3765 [inline]
do_new_mount fs/namespace.c:3841 [inline]
path_mount+0x7d0/0x23d0 fs/namespace.c:4161
do_mount fs/namespace.c:4174 [inline]
__do_sys_mount fs/namespace.c:4390 [inline]
__se_sys_mount fs/namespace.c:4367 [inline]
__x64_sys_mount+0x293/0x310 fs/namespace.c:4367
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff9e8de99ea
Code: 56 53 b8 9d 00 00 00 0f 05 83 f8 ea 75 a2 c7 05 a4 30 0a 00 00 00 00 00 eb 96 e8 51 05 00 00 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc770eecc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc770eece0 RCX: 00007ff9e8de99ea
RDX: 0000200000000040 RSI: 0000200000000100 RDI: 00007ffc770eece0
RBP: 0000200000000100 R08: 00007ffc770eed20 R09: 0000000000000000
R10: 0000000000008cd3 R11: 0000000000000246 R12: 0000200000000040
R13: 0000000000000004 R14: 0000000000000003 R15: 00007ffc770eed20
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [syzbot] [mm?] [gfs2?] WARNING in read_rindex_entry
2026-08-19 22:49 [syzbot] [mm?] [gfs2?] WARNING in read_rindex_entry syzbot
@ 2026-08-20 0:14 ` Andrew Morton
2026-08-20 1:35 ` Zi Yan
2026-08-20 1:24 ` Edward Adam Davis
2026-08-20 4:21 ` [PATCH] gfs2: valid the length of rgrp header Edward Adam Davis
2 siblings, 1 reply; 6+ messages in thread
From: Andrew Morton @ 2026-08-20 0:14 UTC (permalink / raw)
To: syzbot
Cc: apopple, byungchul, david, gfs2, gourry, joshua.hahnjy,
linux-kernel, linux-mm, matthew.brost, rakie.kim, syzkaller-bugs,
ying.huang, ziy
On Wed, 19 Aug 2026 15:49:42 -0700 syzbot <syzbot+9d20c3ad7d29227de28d@syzkaller.appspotmail.com> wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 15ef2f78c49d Merge tag 'input-for-v7.2-rc7' of git://git.k..
> git tree: upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=10871279580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=a0fdc3b566746377
> dashboard link: https://syzkaller.appspot.com/bug?extid=9d20c3ad7d29227de28d
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14871279580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=100d2a25580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/c2a8c7d3a889/disk-15ef2f78.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/2da78afed345/vmlinux-15ef2f78.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/c4ffd97e4708/bzImage-15ef2f78.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/eaa4120812b6/mount_0.gz
> fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=17f52a25580000)
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+9d20c3ad7d29227de28d@syzkaller.appspotmail.com
Thanks. Mounting an intentionally corrupted fs image, I assume.
It appears that GFS2 forgot to validate the `ri_length' which it read
from disk. That gets used in compute_bitstructs()->kzalloc_objs() and
the memory allocator didn't like the excessively-sized allocation
attempt.
> gfs2: fsid=.: Now mounting FS (format 1801)...
> gfs2: fsid=..0: journal 0 mapped with 18 extents in 0ms
> gfs2: fsid=..0: first mount done, others may mount
> ------------[ cut here ]------------
> 1
> WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2427/0x2dc0 mm/page_alloc.c:5280, CPU#1: syz-executor256/5629
> Modules linked in:
> CPU: 1 UID: 0 PID: 5629 Comm: syz-executor256 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
> RIP: 0010:__alloc_frozen_pages_noprof+0x2427/0x2dc0 mm/page_alloc.c:5280
> Code: e9 8d fb ff ff 31 d2 be 28 12 00 00 48 c7 c7 a0 64 e1 8b e8 5b 8c 69 ff 2e 2e 2e 31 c0 e9 02 ed ff ff c6 05 54 c1 9d 0e 01 90 <0f> 0b 90 e9 6f df ff ff 48 c7 c7 80 ae d3 8e 45 89 f7 44 8b 74 24
> RSP: 0018:ffffc9000345f0e0 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 1ffff9200068be36 RDI: 0000000000040d40
> RBP: 000000000000000b R08: 0000000000000005 R09: 0000000000000009
> R10: 000000000000000b R11: 0000000000000000 R12: 0000000000040d40
> R13: 1ffff9200068be74 R14: ffffffff9b759444 R15: 0000000000000001
> FS: 000055556d263400(0000) GS:ffff888123ee1000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000055886dbe9978 CR3: 000000003394d000 CR4: 0000000000350ef0
> Call Trace:
> <TASK>
> alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490
> ___kmalloc_large_node+0xe5/0x120 mm/slub.c:5274
> __kmalloc_large_node_noprof+0x1c/0x70 mm/slub.c:5305
> __do_kmalloc_node mm/slub.c:5322 [inline]
> __kmalloc_noprof+0x5a1/0x820 mm/slub.c:5359
> _kmalloc_noprof include/linux/slab.h:992 [inline]
> _kzalloc_noprof include/linux/slab.h:1309 [inline]
> compute_bitstructs fs/gfs2/rgrp.c:766 [inline]
> read_rindex_entry+0x4a1/0x1250 fs/gfs2/rgrp.c:931
> gfs2_ri_update+0x6f/0x3b0 fs/gfs2/rgrp.c:1001
> gfs2_rindex_update+0x40b/0x480 fs/gfs2/rgrp.c:1051
> init_inodes+0x1f78/0x2790 fs/gfs2/ops_fstype.c:872
> gfs2_fill_super+0x1d3d/0x2cf0 fs/gfs2/ops_fstype.c:1250
> get_tree_bdev_flags+0x38c/0x620 fs/super.c:1640
> gfs2_get_tree+0x4e/0x280 fs/gfs2/ops_fstype.c:1332
> vfs_get_tree+0x92/0x320 fs/super.c:1700
> fc_mount fs/namespace.c:1198 [inline]
> do_new_mount_fc fs/namespace.c:3765 [inline]
> do_new_mount fs/namespace.c:3841 [inline]
> path_mount+0x7d0/0x23d0 fs/namespace.c:4161
> do_mount fs/namespace.c:4174 [inline]
> __do_sys_mount fs/namespace.c:4390 [inline]
> __se_sys_mount fs/namespace.c:4367 [inline]
> __x64_sys_mount+0x293/0x310 fs/namespace.c:4367
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7ff9e8de99ea
> Code: 56 53 b8 9d 00 00 00 0f 05 83 f8 ea 75 a2 c7 05 a4 30 0a 00 00 00 00 00 eb 96 e8 51 05 00 00 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffc770eecc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
> RAX: ffffffffffffffda RBX: 00007ffc770eece0 RCX: 00007ff9e8de99ea
> RDX: 0000200000000040 RSI: 0000200000000100 RDI: 00007ffc770eece0
> RBP: 0000200000000100 R08: 00007ffc770eed20 R09: 0000000000000000
> R10: 0000000000008cd3 R11: 0000000000000246 R12: 0000200000000040
> R13: 0000000000000004 R14: 0000000000000003 R15: 00007ffc770eed20
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [mm?] [gfs2?] WARNING in read_rindex_entry
2026-08-20 0:14 ` Andrew Morton
@ 2026-08-20 1:35 ` Zi Yan
0 siblings, 0 replies; 6+ messages in thread
From: Zi Yan @ 2026-08-20 1:35 UTC (permalink / raw)
To: Andrew Morton, syzbot, Vlastimil Babka
Cc: apopple, byungchul, david, gfs2, gourry, joshua.hahnjy,
linux-kernel, linux-mm, matthew.brost, rakie.kim, syzkaller-bugs,
ying.huang
On Wed Aug 19, 2026 at 8:14 PM EDT, Andrew Morton wrote:
> On Wed, 19 Aug 2026 15:49:42 -0700 syzbot <syzbot+9d20c3ad7d29227de28d@syzkaller.appspotmail.com> wrote:
>
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 15ef2f78c49d Merge tag 'input-for-v7.2-rc7' of git://git.k..
>> git tree: upstream
>> console+strace: https://syzkaller.appspot.com/x/log.txt?x=10871279580000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=a0fdc3b566746377
>> dashboard link: https://syzkaller.appspot.com/bug?extid=9d20c3ad7d29227de28d
>> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14871279580000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=100d2a25580000
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/c2a8c7d3a889/disk-15ef2f78.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/2da78afed345/vmlinux-15ef2f78.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/c4ffd97e4708/bzImage-15ef2f78.xz
>> mounted in repro: https://storage.googleapis.com/syzbot-assets/eaa4120812b6/mount_0.gz
>> fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=17f52a25580000)
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+9d20c3ad7d29227de28d@syzkaller.appspotmail.com
>
> Thanks. Mounting an intentionally corrupted fs image, I assume.
>
> It appears that GFS2 forgot to validate the `ri_length' which it read
> from disk. That gets used in compute_bitstructs()->kzalloc_objs() and
> the memory allocator didn't like the excessively-sized allocation
> attempt.
+Vlastimil
This makes me question my recent patch[1] that returns NULL for kmalloc
sizes bigger than KMALLOC_MAX_SIZE. It masks this issue.
Probably, we should use __GFP_NOWARN for the GadgetFS warn[2] like
Andrew suggested, since the caller does not care the NULL from kmalloc()
is caused by invalid input or ENOMEM.
For this one, GFS2 needs to validate the ri_length.
[1] https://lore.kernel.org/all/20260817-limit_kmalloc_size-v1-1-5bef487701cc@nvidia.com/
[2] https://lore.kernel.org/all/6a820ebc.9ebadd4d.20b15e.001b.GAE@google.com/
>
>> gfs2: fsid=.: Now mounting FS (format 1801)...
>> gfs2: fsid=..0: journal 0 mapped with 18 extents in 0ms
>> gfs2: fsid=..0: first mount done, others may mount
>> ------------[ cut here ]------------
>> 1
>> WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2427/0x2dc0 mm/page_alloc.c:5280, CPU#1: syz-executor256/5629
>> Modules linked in:
>> CPU: 1 UID: 0 PID: 5629 Comm: syz-executor256 Not tainted syzkaller #0 PREEMPT(full)
>> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
>> RIP: 0010:__alloc_frozen_pages_noprof+0x2427/0x2dc0 mm/page_alloc.c:5280
>> Code: e9 8d fb ff ff 31 d2 be 28 12 00 00 48 c7 c7 a0 64 e1 8b e8 5b 8c 69 ff 2e 2e 2e 31 c0 e9 02 ed ff ff c6 05 54 c1 9d 0e 01 90 <0f> 0b 90 e9 6f df ff ff 48 c7 c7 80 ae d3 8e 45 89 f7 44 8b 74 24
>> RSP: 0018:ffffc9000345f0e0 EFLAGS: 00010246
>> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
>> RDX: 0000000000000000 RSI: 1ffff9200068be36 RDI: 0000000000040d40
>> RBP: 000000000000000b R08: 0000000000000005 R09: 0000000000000009
>> R10: 000000000000000b R11: 0000000000000000 R12: 0000000000040d40
>> R13: 1ffff9200068be74 R14: ffffffff9b759444 R15: 0000000000000001
>> FS: 000055556d263400(0000) GS:ffff888123ee1000(0000) knlGS:0000000000000000
>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> CR2: 000055886dbe9978 CR3: 000000003394d000 CR4: 0000000000350ef0
>> Call Trace:
>> <TASK>
>> alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490
>> ___kmalloc_large_node+0xe5/0x120 mm/slub.c:5274
>> __kmalloc_large_node_noprof+0x1c/0x70 mm/slub.c:5305
>> __do_kmalloc_node mm/slub.c:5322 [inline]
>> __kmalloc_noprof+0x5a1/0x820 mm/slub.c:5359
>> _kmalloc_noprof include/linux/slab.h:992 [inline]
>> _kzalloc_noprof include/linux/slab.h:1309 [inline]
>> compute_bitstructs fs/gfs2/rgrp.c:766 [inline]
>> read_rindex_entry+0x4a1/0x1250 fs/gfs2/rgrp.c:931
>> gfs2_ri_update+0x6f/0x3b0 fs/gfs2/rgrp.c:1001
>> gfs2_rindex_update+0x40b/0x480 fs/gfs2/rgrp.c:1051
>> init_inodes+0x1f78/0x2790 fs/gfs2/ops_fstype.c:872
>> gfs2_fill_super+0x1d3d/0x2cf0 fs/gfs2/ops_fstype.c:1250
>> get_tree_bdev_flags+0x38c/0x620 fs/super.c:1640
>> gfs2_get_tree+0x4e/0x280 fs/gfs2/ops_fstype.c:1332
>> vfs_get_tree+0x92/0x320 fs/super.c:1700
>> fc_mount fs/namespace.c:1198 [inline]
>> do_new_mount_fc fs/namespace.c:3765 [inline]
>> do_new_mount fs/namespace.c:3841 [inline]
>> path_mount+0x7d0/0x23d0 fs/namespace.c:4161
>> do_mount fs/namespace.c:4174 [inline]
>> __do_sys_mount fs/namespace.c:4390 [inline]
>> __se_sys_mount fs/namespace.c:4367 [inline]
>> __x64_sys_mount+0x293/0x310 fs/namespace.c:4367
>> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>> do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
>> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>> RIP: 0033:0x7ff9e8de99ea
>> Code: 56 53 b8 9d 00 00 00 0f 05 83 f8 ea 75 a2 c7 05 a4 30 0a 00 00 00 00 00 eb 96 e8 51 05 00 00 90 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
>> RSP: 002b:00007ffc770eecc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
>> RAX: ffffffffffffffda RBX: 00007ffc770eece0 RCX: 00007ff9e8de99ea
>> RDX: 0000200000000040 RSI: 0000200000000100 RDI: 00007ffc770eece0
>> RBP: 0000200000000100 R08: 00007ffc770eed20 R09: 0000000000000000
>> R10: 0000000000008cd3 R11: 0000000000000246 R12: 0000200000000040
>> R13: 0000000000000004 R14: 0000000000000003 R15: 00007ffc770eed20
>> </TASK>
>>
>>
>> ---
>> This report is generated by a bot. It may contain errors.
>> See https://goo.gl/tpsmEJ for more information about syzbot.
>> syzbot engineers can be reached at syzkaller@googlegroups.com.
>>
>> syzbot will keep track of this issue. See:
>> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>>
>> If the report is already addressed, let syzbot know by replying with:
>> #syz fix: exact-commit-title
>>
>> If you want syzbot to run the reproducer, reply with:
>> #syz test: git://repo/address.git branch-or-commit-hash
>> If you attach or paste a git patch, syzbot will apply it before testing.
>>
>> If you want to overwrite report's subsystems, reply with:
>> #syz set subsystems: new-subsystem
>> (See the list of subsystem names on the web dashboard)
>>
>> If the report is a duplicate of another one, reply with:
>> #syz dup: exact-subject-of-another-report
>>
>> If you want to undo deduplication, reply with:
>> #syz undup
--
Best Regards,
Yan, Zi
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [mm?] [gfs2?] WARNING in read_rindex_entry
2026-08-19 22:49 [syzbot] [mm?] [gfs2?] WARNING in read_rindex_entry syzbot
2026-08-20 0:14 ` Andrew Morton
@ 2026-08-20 1:24 ` Edward Adam Davis
2026-08-20 4:20 ` syzbot
2026-08-20 4:21 ` [PATCH] gfs2: valid the length of rgrp header Edward Adam Davis
2 siblings, 1 reply; 6+ messages in thread
From: Edward Adam Davis @ 2026-08-20 1:24 UTC (permalink / raw)
To: syzbot+9d20c3ad7d29227de28d; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 5988a165a830..945657bf5006 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -899,6 +899,7 @@ static int read_rindex_entry(struct gfs2_inode *ip)
struct gfs2_rindex buf;
int error;
struct gfs2_rgrpd *rgd;
+ size_t size;
if (pos >= i_size_read(&ip->i_inode))
return 1;
@@ -917,6 +918,13 @@ static int read_rindex_entry(struct gfs2_inode *ip)
rgd->rd_sbd = sdp;
rgd->rd_addr = be64_to_cpu(buf.ri_addr);
rgd->rd_length = be32_to_cpu(buf.ri_length);
+
+ size = rgd->rd_length * sizeof(struct gfs2_bitmap);
+ if (get_order(size) > MAX_PAGE_ORDER) {
+ error = -EFBIG;
+ goto fail;
+ }
+
rgd->rd_data0 = be64_to_cpu(buf.ri_data0);
rgd->rd_data = be32_to_cpu(buf.ri_data);
rgd->rd_bitbytes = be32_to_cpu(buf.ri_bitbytes);
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] gfs2: valid the length of rgrp header
2026-08-19 22:49 [syzbot] [mm?] [gfs2?] WARNING in read_rindex_entry syzbot
2026-08-20 0:14 ` Andrew Morton
2026-08-20 1:24 ` Edward Adam Davis
@ 2026-08-20 4:21 ` Edward Adam Davis
2 siblings, 0 replies; 6+ messages in thread
From: Edward Adam Davis @ 2026-08-20 4:21 UTC (permalink / raw)
To: syzbot+9d20c3ad7d29227de28d
Cc: agruenba, swhiteho, akpm, apopple, byungchul, david, gfs2, gourry,
joshua.hahnjy, linux-kernel, linux-mm, matthew.brost, rakie.kim,
syzkaller-bugs, ying.huang, ziy
When mounting a deliberately corrupted filesystem image, an excessively
large rgrp header length is used in a call to kzalloc_objs() within
compute_bitstructs(), and the memory allocator cannot handle such a large
allocation request. This triggers [1].
Add a check for the rgrp header length to avoid [1].
[1]
WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2427/0x2dc0 mm/page_alloc.c:5280, CPU#1: syz-executor256/5629
Call Trace:
alloc_pages_mpol+0x1fb/0x540 mm/mempolicy.c:2490
___kmalloc_large_node+0xe5/0x120 mm/slub.c:5274
__kmalloc_large_node_noprof+0x1c/0x70 mm/slub.c:5305
__do_kmalloc_node mm/slub.c:5322 [inline]
__kmalloc_noprof+0x5a1/0x820 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
_kzalloc_noprof include/linux/slab.h:1309 [inline]
compute_bitstructs fs/gfs2/rgrp.c:766 [inline]
read_rindex_entry+0x4a1/0x1250 fs/gfs2/rgrp.c:931
gfs2_ri_update+0x6f/0x3b0 fs/gfs2/rgrp.c:1001
gfs2_rindex_update+0x40b/0x480 fs/gfs2/rgrp.c:1051
init_inodes+0x1f78/0x2790 fs/gfs2/ops_fstype.c:872
gfs2_fill_super+0x1d3d/0x2cf0 fs/gfs2/ops_fstype.c:1250
get_tree_bdev_flags+0x38c/0x620 fs/super.c:1640
gfs2_get_tree+0x4e/0x280 fs/gfs2/ops_fstype.c:1332
vfs_get_tree+0x92/0x320 fs/super.c:1700
fc_mount fs/namespace.c:1198 [inline]
Fixes: bb8d8a6f54c1 ("[GFS2] Fix sign problem in quota/statfs and cleanup _host structures")
Reported-by: syzbot+9d20c3ad7d29227de28d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9d20c3ad7d29227de28d
Tested-by: syzbot+9d20c3ad7d29227de28d@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
fs/gfs2/rgrp.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 5988a165a830..53d097ce668e 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -899,6 +899,7 @@ static int read_rindex_entry(struct gfs2_inode *ip)
struct gfs2_rindex buf;
int error;
struct gfs2_rgrpd *rgd;
+ size_t size;
if (pos >= i_size_read(&ip->i_inode))
return 1;
@@ -917,6 +918,13 @@ static int read_rindex_entry(struct gfs2_inode *ip)
rgd->rd_sbd = sdp;
rgd->rd_addr = be64_to_cpu(buf.ri_addr);
rgd->rd_length = be32_to_cpu(buf.ri_length);
+
+ size = rgd->rd_length * sizeof(struct gfs2_bitmap);
+ if (get_order(size) > MAX_PAGE_ORDER) {
+ error = -EINVAL;
+ goto fail;
+ }
+
rgd->rd_data0 = be64_to_cpu(buf.ri_data0);
rgd->rd_data = be32_to_cpu(buf.ri_data);
rgd->rd_bitbytes = be32_to_cpu(buf.ri_bitbytes);
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-20 4:21 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-19 22:49 [syzbot] [mm?] [gfs2?] WARNING in read_rindex_entry syzbot
2026-08-20 0:14 ` Andrew Morton
2026-08-20 1:35 ` Zi Yan
2026-08-20 1:24 ` Edward Adam Davis
2026-08-20 4:20 ` syzbot
2026-08-20 4:21 ` [PATCH] gfs2: valid the length of rgrp header Edward Adam Davis
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.