Forwarded: [PATCH] gfs2: add debug printk to trace existing entry in gfs2_create_inode

syzbot
2026-03-06T10:41:51Z

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] gfs2: add debug printk to trace existing entry in gfs2_create_inode
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Add a debug printk when gfs2_dir_search finds an existing entry in
gfs2_create_inode. This helps confirm whether the rwsem unlock WARNING
in filename_symlinkat is caused by gfs2_create_inode returning false
success (0) when file is NULL and an existing entry is found on a
corrupted GFS2 image.

The printk logs the directory inode, creation mode, file pointer, found
inode, and rwsem owner at the point where the existing entry is
detected.

This is a temporary diagnostic patch and should be reverted once the
root cause is confirmed.

Reported-by: syzbot+2ed46b6b748df855347f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2ed46b6b748df855347f
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
fs/gfs2/inode.c | 26 +++++++++++++++++++++++++-
fs/namei.c | 30 ++++++++++++++++++++++++++++--
2 files changed, 53 insertions(+), 3 deletions(-)

diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 8344040ecaf7..e252f7720735 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -725,19 +725,26 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
error = gfs2_rindex_update(sdp);
if (error)
goto fail;
+ pr_warn("DEBUG GFS2: after glock_nq dir=%px rwsem owner=%px current=%px\n",
+ dir, READ_ONCE(dir->i_rwsem.owner), current);

error = gfs2_glock_nq_init(dip->i_gl, LM_ST_EXCLUSIVE, 0, &d_gh);
+ pr_warn("DEBUG GFS2 A: dir=%px rwsem owner=%px\n", dir, READ_ONCE(dir->i_rwsem.owner));
if (error)
goto fail;
gfs2_holder_mark_uninitialized(&gh);

error = create_ok(dip, name, mode);
+ pr_warn("DEBUG GFS2 B: dir=%px rwsem owner=%px error=%d\n", dir, READ_ONCE(dir->i_rwsem.owner), error);
if (error)
goto fail_gunlock;

inode = gfs2_dir_search(dir, &dentry->d_name, !S_ISREG(mode) || excl);
error = PTR_ERR(inode);
if (!IS_ERR(inode)) {
+ pr_warn("DEBUG GFS2: gfs2_create_inode found existing entry! dir=%px mode=%o file=%px inode=%px S_ISDIR=%d rwsem owner=%px current=%px\n",
+ dir, mode, file, inode, S_ISDIR(inode->i_mode),
+ READ_ONCE(dir->i_rwsem.owner), current);
if (S_ISDIR(inode->i_mode)) {
iput(inode);
inode = NULL;
@@ -759,6 +766,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
}

error = gfs2_diradd_alloc_required(dir, name, &da);
+ pr_warn("DEBUG GFS2 C: dir=%px rwsem owner=%px error=%d\n", dir, READ_ONCE(dir->i_rwsem.owner), error);
if (error < 0)
goto fail_gunlock;

@@ -820,16 +828,20 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
blocks++;

error = alloc_dinode(ip, aflags, &blocks);
+ pr_warn("DEBUG GFS2 D: dir=%px rwsem owner=%px error=%d\n", dir, READ_ONCE(dir->i_rwsem.owner), error);
if (error)
goto fail_free_inode;

gfs2_set_inode_blocks(inode, blocks);

error = gfs2_glock_get(sdp, ip->i_no_addr, &gfs2_inode_glops, CREATE, &ip->i_gl);
+ pr_warn("DEBUG GFS2 D1: dir=%px rwsem owner=%px error=%d\n", dir, READ_ONCE(dir->i_rwsem.owner), error);
+ if (error)
if (error)
goto fail_dealloc_inode;

error = gfs2_glock_get(sdp, ip->i_no_addr, &gfs2_iopen_glops, CREATE, &io_gl);
+ pr_warn("DEBUG GFS2 D2: dir=%px rwsem owner=%px error=%d\n", dir, READ_ONCE(dir->i_rwsem.owner), error);
if (error)
goto fail_dealloc_inode;
gfs2_cancel_delete_work(io_gl);
@@ -837,6 +849,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,

retry:
error = insert_inode_locked4(inode, ip->i_no_addr, iget_test, &ip->i_no_addr);
+ pr_warn("DEBUG GFS2 D3: dir=%px rwsem owner=%px error=%d\n", dir, READ_ONCE(dir->i_rwsem.owner), error);
if (error == -EBUSY)
goto retry;
if (error)
@@ -844,6 +857,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,

error = gfs2_glock_nq_init(io_gl, LM_ST_SHARED, GL_EXACT | GL_NOPID,
&ip->i_iopen_gh);
+ pr_warn("DEBUG GFS2 E: dir=%px rwsem owner=%px error=%d\n", dir, READ_ONCE(dir->i_rwsem.owner), error);
if (error)
goto fail_gunlock2;

@@ -862,7 +876,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
}
init_dinode(dip, ip, symname);
gfs2_trans_end(sdp);
-
+ pr_warn("DEBUG GFS2 F: dir=%px rwsem owner=%px\n", dir, READ_ONCE(dir->i_rwsem.owner));
glock_set_object(ip->i_gl, ip);
glock_set_object(io_gl, ip);
gfs2_set_iop(inode);
@@ -888,11 +902,15 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
goto fail_gunlock4;

error = link_dinode(dip, name, ip, &da);
+ pr_warn("DEBUG GFS2 G: dir=%px rwsem owner=%px error=%d\n", dir, READ_ONCE(dir->i_rwsem.owner), error);
if (error)
goto fail_gunlock4;

mark_inode_dirty(inode);
d_instantiate(dentry, inode);
+ pr_warn("DEBUG GFS2 H: dir=%px rwsem owner=%px\n", dir, READ_ONCE(dir->i_rwsem.owner));
+ pr_warn("DEBUG GFS2: before glock_dq dir=%px rwsem owner=%px current=%px\n",
+ dir, READ_ONCE(dir->i_rwsem.owner), current);
/* After instantiate, errors should result in evict which will destroy
* both inode and iopen glocks properly. */
if (file) {
@@ -900,6 +918,8 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
error = finish_open(file, dentry, gfs2_open_common);
}
gfs2_glock_dq_uninit(&d_gh);
+ pr_warn("DEBUG GFS2: after glock_dq dir=%px rwsem owner=%px current=%px\n",
+ dir, READ_ONCE(dir->i_rwsem.owner), current);
gfs2_qa_put(ip);
gfs2_glock_dq_uninit(&gh);
gfs2_glock_put(io_gl);
@@ -937,7 +957,11 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
posix_acl_release(acl);
fail_gunlock:
gfs2_dir_no_add(&da);
+ pr_warn("DEBUG GFS2: fail_gunlock before glock_dq dir=%px rwsem owner=%px current=%px error=%d\n",
+ dir, READ_ONCE(dir->i_rwsem.owner), current, error);
gfs2_glock_dq_uninit(&d_gh);
+ pr_warn("DEBUG GFS2: fail_gunlock after glock_dq dir=%px rwsem owner=%px current=%px\n",
+ dir, READ_ONCE(dir->i_rwsem.owner), current);
if (!IS_ERR_OR_NULL(inode)) {
if (inode_state_read_once(inode) & I_NEW)
iget_failed(inode);
diff --git a/fs/namei.c b/fs/namei.c
index 58f715f7657e..768944691e24 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2922,7 +2922,13 @@ static struct dentry *__start_dirop(struct dentry *parent, struct qstr *name,
} else {
inode_lock_nested(dir, I_MUTEX_PARENT);
}
+ pr_warn("DEBUG LOCK: __start_dirop locked dir=%px count=%ld owner=%px current=%px\n",
+ dir, atomic_long_read(&dir->i_rwsem.count),
+ READ_ONCE(dir->i_rwsem.owner), current);
dentry = lookup_one_qstr_excl(name, parent, lookup_flags);
+ pr_warn("DEBUG LOCK: __start_dirop after lookup dir=%px count=%ld owner=%px current=%px dentry_err=%d\n",
+ dir, atomic_long_read(&dir->i_rwsem.count),
+ READ_ONCE(dir->i_rwsem.owner), current, IS_ERR(dentry));
if (IS_ERR(dentry))
inode_unlock(dir);
return dentry;
@@ -2944,6 +2950,11 @@ struct dentry *start_dirop(struct dentry *parent, struct qstr *name,
void end_dirop(struct dentry *de)
{
if (!IS_ERR(de)) {
+ struct inode *dir = d_inode(de->d_parent);
+ pr_warn("DEBUG: end_dirop: de=%px parent=%px inode=%px rwsem count=%ld owner=%px current=%px\n",
+ de, de->d_parent, dir,
+ atomic_long_read(&dir->i_rwsem.count),
+ READ_ONCE(dir->i_rwsem.owner), current);
inode_unlock(de->d_parent->d_inode);
dput(de);
}
@@ -4922,7 +4933,9 @@ static struct dentry *filename_create(int dfd, struct filename *name,
dentry = start_dirop(path->dentry, &last, reval_flag | create_flags);
if (IS_ERR(dentry))
goto out_drop_write;
-
+ pr_warn("DEBUG: after start_dirop: dentry=%px parent=%px parent_inode=%px rwsem owner=%px current=%px\n",
+ dentry, dentry->d_parent, d_inode(dentry->d_parent),
+ (void *)atomic_long_read(&d_inode(dentry->d_parent)->i_rwsem.count), current);
if (unlikely(error))
goto fail;

@@ -4959,7 +4972,10 @@ EXPORT_SYMBOL(start_creating_path);
*/
void end_creating_path(const struct path *path, struct dentry *dentry)
{
- end_creating(dentry);
+ if (!IS_ERR(dentry)) {
+ inode_unlock(d_inode(path->dentry));
+ dput(dentry);
+ }
mnt_drop_write(path->mnt);
path_put(path);
}
@@ -5595,6 +5611,9 @@ int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
struct dentry *dentry, const char *oldname,
struct delegated_inode *delegated_inode)
{
+ pr_warn("DEBUG VFS: before symlink: dir=%px sb_type=%s symlink_fn=%ps rwsem owner=%px current=%px\n",
+ dir, dir->i_sb->s_type->name, dir->i_op->symlink,
+ READ_ONCE(dir->i_rwsem.owner), current);
int error;

error = may_create_dentry(idmap, dir, dentry);
@@ -5613,6 +5632,9 @@ int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
return error;

error = dir->i_op->symlink(idmap, dir, dentry, oldname);
+ pr_warn("DEBUG VFS: after symlink: dir=%px sb_type=%s error=%d rwsem owner=%px current=%px\n",
+ dir, dir->i_sb->s_type->name, error,
+ READ_ONCE(dir->i_rwsem.owner), current);
if (!error)
fsnotify_create(dir, dentry);
return error;
@@ -5639,6 +5661,10 @@ int filename_symlinkat(struct filename *from, int newdfd, struct filename *to)
if (!error)
error = vfs_symlink(mnt_idmap(path.mnt), path.dentry->d_inode,
dentry, from->name, &delegated_inode);
+ pr_warn("DEBUG: after vfs_symlink: error=%d dentry=%px parent=%px parent_inode=%px rwsem owner=%px path_dentry=%px path_inode=%px\n",
+ error, dentry, dentry->d_parent, d_inode(dentry->d_parent),
+ (void *)atomic_long_read(&d_inode(path.dentry)->i_rwsem.count),
+ path.dentry, d_inode(path.dentry));
end_creating_path(&path, dentry);
if (is_delegated(&delegated_inode)) {
error = break_deleg_wait(&delegated_inode);
--
2.43.0