Forwarded: [PATCH] gfs2: fix duplicate kmem_cache on repeated mount failure

[syzbot <syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] gfs2: fix duplicate kmem_cache on repeated mount failure
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master


When gfs2_fill_super() fails after the bufdata cache has been
created, the error path destroys the cache via fail_bufdata but
does not set sd_bufdata to NULL. The VFS then calls gfs2_put_super()
as part of mount cleanup, which destroys the cache a second time,
corrupting the slab state.

On the next mount attempt, kmem_cache_create() finds a ghost entry
with the same name and triggers a WARN, causing a kernel panic.

Fix this by setting sd_bufdata to NULL after destroying it in the
error path. kmem_cache_destroy(NULL) is a no-op, so the subsequent
call in gfs2_put_super() becomes safe.

Reported-by: syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
Fixes: f9d6fc9557e6 ("gfs2: per-filesystem bufdata cache")
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
 fs/gfs2/lops.c       | 3 +++
 fs/gfs2/ops_fstype.c | 1 +
 2 files changed, 4 insertions(+)

diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 797931eb5845..005584311eff 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -467,6 +467,9 @@ static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,
 
 	folio = filemap_get_folio(jd->jd_inode->i_mapping, index);
 
+	if (IS_ERR(folio))
+		return;
+
 	folio_wait_locked(folio);
 	if (!folio_test_uptodate(folio))
 		*done = true;
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index b44adb40635d..4cff08fa3b50 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1315,6 +1315,7 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
 	gfs2_sys_fs_del(sdp);
 fail_bufdata:
 	kmem_cache_destroy(sdp->sd_bufdata);
+	sdp->sd_bufdata = NULL;
 fail_delete_wq:
 	destroy_workqueue(sdp->sd_delete_wq);
 fail_glock_wq:
-- 
2.43.0