* Forwarded: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page
2026-03-23 20:13 [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) syzbot
@ 2026-03-24 1:49 ` syzbot
2026-03-24 2:30 ` syzbot
` (5 subsequent siblings)
6 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-03-24 1:49 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
filemap_get_folio() can return an ERR_PTR if the folio is not
present in the page cache. This can happen when a crafted or
corrupted GFS2 filesystem image is mounted and journal recovery
is triggered.
gfs2_jhead_process_page() calls filemap_get_folio() without
checking the return value, and passes the result directly to
folio_wait_locked(). When an ERR_PTR is passed to
folio_wait_locked(), the kernel task gets stuck in uninterruptible
sleep (state D) forever, triggering the hung task watchdog.
This was reported by syzbot. The reproducer mounts a crafted GFS2
image which causes gfs2_find_jhead() to call
gfs2_jhead_process_page() on a page that was never properly
submitted for I/O, causing filemap_get_folio() to return
ERR_PTR(-ENOENT).
Fix this by checking the return value of filemap_get_folio() and
marking the journal head search as done if the folio is not found,
allowing the caller to return an error gracefully.
Reported-by: syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
fs/gfs2/lops.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 797931eb5845..c2bb262318bb 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -467,6 +467,11 @@ static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,
folio = filemap_get_folio(jd->jd_inode->i_mapping, index);
+ if (IS_ERR(folio)) {
+ *done = true;
+ return ;
+ }
+
folio_wait_locked(folio);
if (!folio_test_uptodate(folio))
*done = true;
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Forwarded: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page
2026-03-23 20:13 [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) syzbot
2026-03-24 1:49 ` Forwarded: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page syzbot
@ 2026-03-24 2:30 ` syzbot
2026-03-24 9:27 ` Forwarded: [PATCH] gfs2: fix duplicate kmem_cache on repeated mount failure syzbot
` (4 subsequent siblings)
6 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-03-24 2:30 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
filemap_get_folio() can return an ERR_PTR if the folio is not
present in the page cache. This can happen when a crafted or
corrupted GFS2 filesystem image is mounted and journal recovery
is triggered.
gfs2_jhead_process_page() calls filemap_get_folio() without
checking the return value, and passes the result directly to
folio_wait_locked(). When an ERR_PTR is passed to
folio_wait_locked(), the kernel task gets stuck in uninterruptible
sleep (state D) forever, triggering the hung task watchdog.
Fix this by checking the return value of filemap_get_folio().
If the folio is not found, record the error via filemap_set_wb_err()
so that gfs2_find_jhead() picks it up through filemap_check_wb_err()
and returns a proper error code to the caller. Without this,
gfs2_find_jhead() would return success despite the failure, leading
to further issues during mount such as duplicate kmem_cache creation.
Reported-by: syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
fs/gfs2/lops.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 797931eb5845..a832904a09e3 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -467,6 +467,12 @@ static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,
folio = filemap_get_folio(jd->jd_inode->i_mapping, index);
+ if (IS_ERR(folio)) {
+ filemap_set_wb_err(jd->jd_inode->i_mapping, PTR_ERR(folio));
+ *done = true;
+ return;
+ }
+
folio_wait_locked(folio);
if (!folio_test_uptodate(folio))
*done = true;
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Forwarded: [PATCH] gfs2: fix duplicate kmem_cache on repeated mount failure
2026-03-23 20:13 [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) syzbot
2026-03-24 1:49 ` Forwarded: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page syzbot
2026-03-24 2:30 ` syzbot
@ 2026-03-24 9:27 ` syzbot
2026-03-25 7:37 ` [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) Edward Adam Davis
` (3 subsequent siblings)
6 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-03-24 9:27 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] gfs2: fix duplicate kmem_cache on repeated mount failure
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
When gfs2_fill_super() fails after the bufdata cache has been
created, the error path destroys the cache via fail_bufdata but
does not set sd_bufdata to NULL. The VFS then calls gfs2_put_super()
as part of mount cleanup, which destroys the cache a second time,
corrupting the slab state.
On the next mount attempt, kmem_cache_create() finds a ghost entry
with the same name and triggers a WARN, causing a kernel panic.
Fix this by setting sd_bufdata to NULL after destroying it in the
error path. kmem_cache_destroy(NULL) is a no-op, so the subsequent
call in gfs2_put_super() becomes safe.
Reported-by: syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
Fixes: f9d6fc9557e6 ("gfs2: per-filesystem bufdata cache")
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
fs/gfs2/lops.c | 3 +++
fs/gfs2/ops_fstype.c | 1 +
2 files changed, 4 insertions(+)
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 797931eb5845..005584311eff 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -467,6 +467,9 @@ static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,
folio = filemap_get_folio(jd->jd_inode->i_mapping, index);
+ if (IS_ERR(folio))
+ return;
+
folio_wait_locked(folio);
if (!folio_test_uptodate(folio))
*done = true;
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index b44adb40635d..4cff08fa3b50 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1315,6 +1315,7 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
gfs2_sys_fs_del(sdp);
fail_bufdata:
kmem_cache_destroy(sdp->sd_bufdata);
+ sdp->sd_bufdata = NULL;
fail_delete_wq:
destroy_workqueue(sdp->sd_delete_wq);
fail_glock_wq:
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4)
2026-03-23 20:13 [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) syzbot
` (2 preceding siblings ...)
2026-03-24 9:27 ` Forwarded: [PATCH] gfs2: fix duplicate kmem_cache on repeated mount failure syzbot
@ 2026-03-25 7:37 ` Edward Adam Davis
2026-03-25 8:18 ` syzbot
2026-03-25 7:49 ` Edward Adam Davis
` (2 subsequent siblings)
6 siblings, 1 reply; 14+ messages in thread
From: Edward Adam Davis @ 2026-03-25 7:37 UTC (permalink / raw)
To: syzbot+9013411dc43f3582823a; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 1cd8ec0bce83..fd11d5aa93b6 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -2266,6 +2266,9 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
u64 size;
int rc;
ktime_t start, end;
+ struct super_block *sb = sdp->sd_vfs;
+ sector_t maxsector = bdev_nr_sectors(sb->s_bdev);
+ u32 bshift = sdp->sd_fsb2bb_shift;
start = ktime_get();
lblock_stop = i_size_read(jd->jd_inode) >> shift;
@@ -2280,6 +2283,10 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
rc = gfs2_block_map(jd->jd_inode, lblock, &bh, 0);
if (rc || !buffer_mapped(&bh))
goto fail;
+ if (bh.b_blocknr << bshift > maxsector) {
+ rc = -EIO;
+ goto fail;
+ }
rc = gfs2_add_jextent(jd, lblock, bh.b_blocknr, bh.b_size >> shift);
if (rc)
goto fail;
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4)
2026-03-25 7:37 ` [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) Edward Adam Davis
@ 2026-03-25 8:18 ` syzbot
0 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-03-25 8:18 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in gfs2_invalidate_folio
RBP: 00007ffde9a1cf60 R08: 00007ffde9a1df60 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffde9a1dff0
R13: 00007fe90d032050 R14: 000000000001f130 R15: 00007ffde9a1e030
</TASK>
gfs2: fsid=syz:syz.0: gfs2_evict_inode: -5
==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in gfs2_discard fs/gfs2/aops.c:590 [inline]
BUG: KASAN: slab-use-after-free in gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
Read of size 8 at addr ffff88807c9098d8 by task syz-executor/6336
CPU: 0 UID: 0 PID: 6336 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
list_empty include/linux/list.h:381 [inline]
gfs2_discard fs/gfs2/aops.c:590 [inline]
gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
folio_invalidate mm/truncate.c:140 [inline]
truncate_cleanup_folio+0xcb/0x190 mm/truncate.c:160
truncate_inode_pages_range+0x2ce/0xe30 mm/truncate.c:404
gfs2_evict_inode+0x9da/0x12d0 fs/gfs2/super.c:1476
evict+0x61e/0xb10 fs/inode.c:846
gfs2_put_super+0x355/0x890 fs/gfs2/super.c:619
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe90cf9d9d7
Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffde9a1cea8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007fe90d032050 RCX: 00007fe90cf9d9d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffde9a1cf60
RBP: 00007ffde9a1cf60 R08: 00007ffde9a1df60 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffde9a1dff0
R13: 00007fe90d032050 R14: 000000000001f130 R15: 00007ffde9a1e030
</TASK>
Allocated by task 6336:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4905
gfs2_alloc_bufdata fs/gfs2/trans.c:176 [inline]
gfs2_trans_add_data+0x1e8/0x610 fs/gfs2/trans.c:215
gfs2_unstuffer_folio fs/gfs2/bmap.c:81 [inline]
__gfs2_unstuff_inode fs/gfs2/bmap.c:119 [inline]
gfs2_unstuff_dinode+0xace/0x1240 fs/gfs2/bmap.c:166
gfs2_adjust_quota+0x23f/0x850 fs/gfs2/quota.c:848
do_sync+0x872/0xcb0 fs/gfs2/quota.c:962
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6336:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6242 [inline]
kmem_cache_free+0x182/0x650 mm/slub.c:6369
gfs2_trans_drain_list fs/gfs2/log.c:995 [inline]
gfs2_trans_drain fs/gfs2/log.c:1013 [inline]
gfs2_log_flush+0x18c1/0x2640 fs/gfs2/log.c:1185
do_sync+0xa48/0xcb0 fs/gfs2/quota.c:982
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88807c9098c0
which belongs to the cache gfs2-bufdata/syz:syz of size 80
The buggy address is located 24 bytes inside of
freed 80-byte region [ffff88807c9098c0, ffff88807c909910)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807c909a80 pfn:0x7c909
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff8881499c0500 ffff888035149d08 ffff888035149d08
raw: ffff88807c909a80 0000000800240018 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6336, tgid 6336 (syz-executor), ts 127950955156, free_ts 125551511102
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x2418/0x24b0 mm/page_alloc.c:3926
__alloc_frozen_pages_noprof+0x233/0x3d0 mm/page_alloc.c:5213
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3467
new_slab mm/slub.c:3525 [inline]
refill_objects+0x339/0x3d0 mm/slub.c:7247
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x321/0x720 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
kmem_cache_alloc_noprof+0x37d/0x650 mm/slub.c:4905
gfs2_alloc_bufdata fs/gfs2/trans.c:176 [inline]
gfs2_trans_add_meta+0x214/0x8e0 fs/gfs2/trans.c:279
gfs2_alloc_extent fs/gfs2/rgrp.c:2237 [inline]
gfs2_alloc_blocks+0x7ae/0x2090 fs/gfs2/rgrp.c:2447
__gfs2_unstuff_inode fs/gfs2/bmap.c:107 [inline]
gfs2_unstuff_dinode+0x249/0x1240 fs/gfs2/bmap.c:166
gfs2_adjust_quota+0x23f/0x850 fs/gfs2/quota.c:848
do_sync+0x872/0xcb0 fs/gfs2/quota.c:962
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
page last free pid 23 tgid 23 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2944
__tlb_remove_table_free mm/mmu_gather.c:228 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:291
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x840 kernel/softirq.c:622
run_ksoftirqd+0x36/0x60 kernel/softirq.c:1076
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff88807c909780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807c909800: fc fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb
>ffff88807c909880: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff88807c909900: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb
ffff88807c909980: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fc fc
==================================================================
Tested on:
commit: 85964cdc Add linux-next specific files for 20260324
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14e9506a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=84ab18c6f45b39c
dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=11b46a06580000
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4)
2026-03-23 20:13 [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) syzbot
` (3 preceding siblings ...)
2026-03-25 7:37 ` [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) Edward Adam Davis
@ 2026-03-25 7:49 ` Edward Adam Davis
2026-03-25 8:30 ` syzbot
2026-03-25 7:50 ` [PATCH] gfs2: prevent corrupt data from entering jextent Edward Adam Davis
2026-03-25 10:25 ` [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) Edward Adam Davis
6 siblings, 1 reply; 14+ messages in thread
From: Edward Adam Davis @ 2026-03-25 7:49 UTC (permalink / raw)
To: syzbot+9013411dc43f3582823a; +Cc: linux-kernel, syzkaller-bugs
#syz test
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 1cd8ec0bce83..fd11d5aa93b6 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -2266,6 +2266,9 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
u64 size;
int rc;
ktime_t start, end;
+ struct super_block *sb = sdp->sd_vfs;
+ sector_t maxsector = bdev_nr_sectors(sb->s_bdev);
+ u32 bshift = sdp->sd_fsb2bb_shift;
start = ktime_get();
lblock_stop = i_size_read(jd->jd_inode) >> shift;
@@ -2280,6 +2283,10 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
rc = gfs2_block_map(jd->jd_inode, lblock, &bh, 0);
if (rc || !buffer_mapped(&bh))
goto fail;
+ if (bh.b_blocknr << bshift > maxsector) {
+ rc = -EIO;
+ goto fail;
+ }
rc = gfs2_add_jextent(jd, lblock, bh.b_blocknr, bh.b_size >> shift);
if (rc)
goto fail;
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4)
2026-03-25 7:49 ` Edward Adam Davis
@ 2026-03-25 8:30 ` syzbot
0 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-03-25 8:30 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in gfs2_invalidate_folio
RBP: 00007ffc7d4253b0 R08: 00007ffc7d4263b0 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc7d426440
R13: 00007f8d07e32050 R14: 0000000000025091 R15: 00007ffc7d426480
</TASK>
gfs2: fsid=syz:syz.0: gfs2_evict_inode: -5
==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in gfs2_discard fs/gfs2/aops.c:590 [inline]
BUG: KASAN: slab-use-after-free in gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
Read of size 8 at addr ffff88807e71e8d8 by task syz-executor/6427
CPU: 0 UID: 0 PID: 6427 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
list_empty include/linux/list.h:381 [inline]
gfs2_discard fs/gfs2/aops.c:590 [inline]
gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
folio_invalidate mm/truncate.c:140 [inline]
truncate_cleanup_folio+0xcb/0x190 mm/truncate.c:160
truncate_inode_pages_range+0x2ce/0xe30 mm/truncate.c:404
gfs2_evict_inode+0x9da/0x12d0 fs/gfs2/super.c:1476
evict+0x61e/0xb10 fs/inode.c:846
gfs2_put_super+0x355/0x890 fs/gfs2/super.c:619
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8d07d9d9d7
Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffc7d4252f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f8d07e32050 RCX: 00007f8d07d9d9d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc7d4253b0
RBP: 00007ffc7d4253b0 R08: 00007ffc7d4263b0 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc7d426440
R13: 00007f8d07e32050 R14: 0000000000025091 R15: 00007ffc7d426480
</TASK>
Allocated by task 6427:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4905
gfs2_alloc_bufdata fs/gfs2/trans.c:176 [inline]
gfs2_trans_add_data+0x1e8/0x610 fs/gfs2/trans.c:215
gfs2_unstuffer_folio fs/gfs2/bmap.c:81 [inline]
__gfs2_unstuff_inode fs/gfs2/bmap.c:119 [inline]
gfs2_unstuff_dinode+0xace/0x1240 fs/gfs2/bmap.c:166
gfs2_adjust_quota+0x23f/0x850 fs/gfs2/quota.c:848
do_sync+0x872/0xcb0 fs/gfs2/quota.c:962
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6427:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6242 [inline]
kmem_cache_free+0x182/0x650 mm/slub.c:6369
gfs2_trans_drain_list fs/gfs2/log.c:995 [inline]
gfs2_trans_drain fs/gfs2/log.c:1013 [inline]
gfs2_log_flush+0x18c1/0x2640 fs/gfs2/log.c:1185
do_sync+0xa48/0xcb0 fs/gfs2/quota.c:982
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88807e71e8c0
which belongs to the cache gfs2-bufdata/syz:syz of size 80
The buggy address is located 24 bytes inside of
freed 80-byte region [ffff88807e71e8c0, ffff88807e71e910)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807e71ea80 pfn:0x7e71e
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff888141ad78c0 ffff8880307dde88 ffff8880307dde88
raw: ffff88807e71ea80 0000000800240018 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6427, tgid 6427 (syz-executor), ts 151784205341, free_ts 151343117657
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x2418/0x24b0 mm/page_alloc.c:3926
__alloc_frozen_pages_noprof+0x233/0x3d0 mm/page_alloc.c:5213
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3467
new_slab mm/slub.c:3525 [inline]
refill_objects+0x339/0x3d0 mm/slub.c:7247
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x321/0x720 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
kmem_cache_alloc_noprof+0x37d/0x650 mm/slub.c:4905
gfs2_alloc_bufdata fs/gfs2/trans.c:176 [inline]
gfs2_trans_add_meta+0x214/0x8e0 fs/gfs2/trans.c:279
gfs2_alloc_extent fs/gfs2/rgrp.c:2237 [inline]
gfs2_alloc_blocks+0x7ae/0x2090 fs/gfs2/rgrp.c:2447
__gfs2_unstuff_inode fs/gfs2/bmap.c:107 [inline]
gfs2_unstuff_dinode+0x249/0x1240 fs/gfs2/bmap.c:166
gfs2_adjust_quota+0x23f/0x850 fs/gfs2/quota.c:848
do_sync+0x872/0xcb0 fs/gfs2/quota.c:962
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
page last free pid 6500 tgid 6499 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
free_unref_folios+0xcec/0x1480 mm/page_alloc.c:3005
folios_put_refs+0x9ff/0xb40 mm/swap.c:1008
folio_batch_release include/linux/folio_batch.h:101 [inline]
truncate_inode_pages_range+0x3dd/0xe30 mm/truncate.c:408
kill_bdev block/bdev.c:91 [inline]
set_blocksize+0x2ce/0x440 block/bdev.c:207
sb_set_blocksize+0xf8/0x240 block/bdev.c:240
init_sb+0x9d4/0x12f0 fs/gfs2/ops_fstype.c:490
gfs2_fill_super+0x1739/0x21d0 fs/gfs2/ops_fstype.c:1225
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
gfs2_get_tree+0x51/0x1e0 fs/gfs2/ops_fstype.c:1342
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3764 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3840
do_mount fs/namespace.c:4173 [inline]
__do_sys_mount fs/namespace.c:4372 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4349
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88807e71e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807e71e800: fc fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb
>ffff88807e71e880: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff88807e71e900: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb
ffff88807e71e980: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fc fc
==================================================================
Tested on:
commit: 85964cdc Add linux-next specific files for 20260324
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=126f0c26580000
kernel config: https://syzkaller.appspot.com/x/.config?x=84ab18c6f45b39c
dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=14bbc4ca580000
^ permalink raw reply [flat|nested] 14+ messages in thread
* [PATCH] gfs2: prevent corrupt data from entering jextent
2026-03-23 20:13 [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) syzbot
` (4 preceding siblings ...)
2026-03-25 7:49 ` Edward Adam Davis
@ 2026-03-25 7:50 ` Edward Adam Davis
2026-03-25 10:25 ` [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) Edward Adam Davis
6 siblings, 0 replies; 14+ messages in thread
From: Edward Adam Davis @ 2026-03-25 7:50 UTC (permalink / raw)
To: syzbot+9013411dc43f3582823a; +Cc: agruenba, gfs2, linux-kernel, syzkaller-bugs
During the mount process, when the journal recovery is executed, the
system blocks and waits for the recovery to complete. The issue reported
in [1] involves the kernel thread responsible for journal recovery
becoming blocked on a specific folio that had not yet been fully read.
This folio was submitted via a bio chain containing an excessively large
sector value; however, the submission failed during the process because
the end-of-file (EOF) check for the bio failed. Consequently, the folio
was never unlocked, which ultimately triggered the timeout issue reported
in [1].
To address this, a check for the blocknr value has been added during the
loading of journal extents from the disk. If the blocknr value exceeds
the maximum sector value supported by the disk, it indicates that the
data on the disk is corrupted; in such cases, the loading of the journal
extent is immediately terminated.
[1]
INFO: task kworker/0:3:5963 blocked in I/O wait for more than 143 seconds.
Workqueue: gfs2_recovery gfs2_recover_func
Call Trace:
folio_wait_locked include/linux/pagemap.h:1245 [inline]
gfs2_jhead_process_page+0x175/0x670 fs/gfs2/lops.c:470
gfs2_find_jhead+0xbd2/0xd30 fs/gfs2/lops.c:586
gfs2_recover_func+0x6cf/0x1f60 fs/gfs2/recovery.c:459
Fixes: b50f227bddf1 ("GFS2: Clean up journal extent mapping")
Reported-by: syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
Tested-by: syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
fs/gfs2/bmap.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 1cd8ec0bce83..d42307ab0684 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -2266,6 +2266,9 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
u64 size;
int rc;
ktime_t start, end;
+ struct super_block *sb = sdp->sd_vfs;
+ sector_t maxsector = bdev_nr_sectors(sb->s_bdev);
+ u32 bshift = sdp->sd_fsb2bb_shift;
start = ktime_get();
lblock_stop = i_size_read(jd->jd_inode) >> shift;
@@ -2280,6 +2283,10 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
rc = gfs2_block_map(jd->jd_inode, lblock, &bh, 0);
if (rc || !buffer_mapped(&bh))
goto fail;
+ if (bh.b_blocknr << bshift > maxsector) {
+ rc = -EIO;
+ goto fail;
+ }
rc = gfs2_add_jextent(jd, lblock, bh.b_blocknr, bh.b_size >> shift);
if (rc)
goto fail;
--
2.43.0
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4)
2026-03-23 20:13 [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) syzbot
` (5 preceding siblings ...)
2026-03-25 7:50 ` [PATCH] gfs2: prevent corrupt data from entering jextent Edward Adam Davis
@ 2026-03-25 10:25 ` Edward Adam Davis
2026-03-25 11:24 ` syzbot
6 siblings, 1 reply; 14+ messages in thread
From: Edward Adam Davis @ 2026-03-25 10:25 UTC (permalink / raw)
To: syzbot+9013411dc43f3582823a; +Cc: linux-kernel, syzkaller-bugs
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 09c0f7f1bcdb
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 1cd8ec0bce83..fd11d5aa93b6 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -2266,6 +2266,9 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
u64 size;
int rc;
ktime_t start, end;
+ struct super_block *sb = sdp->sd_vfs;
+ sector_t maxsector = bdev_nr_sectors(sb->s_bdev);
+ u32 bshift = sdp->sd_fsb2bb_shift;
start = ktime_get();
lblock_stop = i_size_read(jd->jd_inode) >> shift;
@@ -2280,6 +2283,10 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
rc = gfs2_block_map(jd->jd_inode, lblock, &bh, 0);
if (rc || !buffer_mapped(&bh))
goto fail;
+ if (bh.b_blocknr << bshift > maxsector) {
+ rc = -EIO;
+ goto fail;
+ }
rc = gfs2_add_jextent(jd, lblock, bh.b_blocknr, bh.b_size >> shift);
if (rc)
goto fail;
^ permalink raw reply related [flat|nested] 14+ messages in thread* Re: [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4)
2026-03-25 10:25 ` [syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4) Edward Adam Davis
@ 2026-03-25 11:24 ` syzbot
0 siblings, 0 replies; 14+ messages in thread
From: syzbot @ 2026-03-25 11:24 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in gfs2_invalidate_folio
RBP: 00007ffd3cccca40 R08: 00007ffd3cccda40 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd3cccdad0
R13: 00007f2a75832050 R14: 0000000000020287 R15: 00007ffd3cccdb10
</TASK>
gfs2: fsid=syz:syz.0: gfs2_evict_inode: -5
==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in gfs2_discard fs/gfs2/aops.c:590 [inline]
BUG: KASAN: slab-use-after-free in gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
Read of size 8 at addr ffff88804e6038d8 by task syz-executor/6493
CPU: 0 UID: 0 PID: 6493 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
list_empty include/linux/list.h:381 [inline]
gfs2_discard fs/gfs2/aops.c:590 [inline]
gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
folio_invalidate mm/truncate.c:140 [inline]
truncate_cleanup_folio+0xcb/0x190 mm/truncate.c:160
truncate_inode_pages_range+0x2ce/0xe30 mm/truncate.c:404
gfs2_evict_inode+0xa60/0x1300 fs/gfs2/super.c:1459
evict+0x61e/0xb10 fs/inode.c:846
gfs2_put_super+0x355/0x890 fs/gfs2/super.c:619
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2a7579d9d7
Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffd3cccc988 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f2a75832050 RCX: 00007f2a7579d9d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3cccca40
RBP: 00007ffd3cccca40 R08: 00007ffd3cccda40 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd3cccdad0
R13: 00007f2a75832050 R14: 0000000000020287 R15: 00007ffd3cccdb10
</TASK>
Allocated by task 6493:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4905
gfs2_alloc_bufdata fs/gfs2/trans.c:176 [inline]
gfs2_trans_add_data+0x1e8/0x610 fs/gfs2/trans.c:215
gfs2_unstuffer_folio fs/gfs2/bmap.c:81 [inline]
__gfs2_unstuff_inode fs/gfs2/bmap.c:119 [inline]
gfs2_unstuff_dinode+0xace/0x1240 fs/gfs2/bmap.c:166
gfs2_adjust_quota+0x23f/0x850 fs/gfs2/quota.c:848
do_sync+0x872/0xcb0 fs/gfs2/quota.c:962
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6493:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6242 [inline]
kmem_cache_free+0x182/0x650 mm/slub.c:6369
gfs2_trans_drain_list fs/gfs2/log.c:995 [inline]
gfs2_trans_drain fs/gfs2/log.c:1013 [inline]
gfs2_log_flush+0x18c1/0x2640 fs/gfs2/log.c:1185
do_sync+0xa48/0xcb0 fs/gfs2/quota.c:982
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88804e6038c0
which belongs to the cache gfs2-bufdata/syz:syz of size 80
The buggy address is located 24 bytes inside of
freed 80-byte region [ffff88804e6038c0, ffff88804e603910)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804e603a80 pfn:0x4e603
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff888140adea00 ffff888034f85e88 ffff888034f85e88
raw: ffff88804e603a80 0000000800240018 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6493, tgid 6493 (syz-executor), ts 131787600701, free_ts 125848846283
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x2418/0x24b0 mm/page_alloc.c:3926
__alloc_frozen_pages_noprof+0x233/0x3d0 mm/page_alloc.c:5213
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3467
new_slab mm/slub.c:3525 [inline]
refill_objects+0x339/0x3d0 mm/slub.c:7247
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x321/0x720 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
kmem_cache_alloc_noprof+0x37d/0x650 mm/slub.c:4905
gfs2_alloc_bufdata fs/gfs2/trans.c:176 [inline]
gfs2_trans_add_meta+0x214/0x8e0 fs/gfs2/trans.c:279
gfs2_alloc_extent fs/gfs2/rgrp.c:2237 [inline]
gfs2_alloc_blocks+0x7ae/0x2090 fs/gfs2/rgrp.c:2447
__gfs2_unstuff_inode fs/gfs2/bmap.c:107 [inline]
gfs2_unstuff_dinode+0x249/0x1240 fs/gfs2/bmap.c:166
gfs2_adjust_quota+0x23f/0x850 fs/gfs2/quota.c:848
do_sync+0x872/0xcb0 fs/gfs2/quota.c:962
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
page last free pid 6391 tgid 6391 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2944
vfree+0x1d1/0x2f0 mm/vmalloc.c:3472
kcov_put kernel/kcov.c:442 [inline]
kcov_close+0x28/0x50 kernel/kcov.c:543
__fput+0x44f/0xa70 fs/file_table.c:469
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x70f/0x22c0 kernel/exit.c:974
do_group_exit+0x21b/0x2d0 kernel/exit.c:1116
get_signal+0x1284/0x1330 kernel/signal.c:3036
arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88804e603780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88804e603800: fc fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb
>ffff88804e603880: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff88804e603900: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb
ffff88804e603980: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fc fc
==================================================================
Tested on:
commit: 09c0f7f1 Add linux-next specific files for 20260323
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1277ac26580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c0c30527ccbcb0f2
dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=11ced6da580000
^ permalink raw reply [flat|nested] 14+ messages in thread