Forwarded: [PATCH] gfs2: replace WARN_ON_ONCE with error message in

[syzbot <syzbot+3e2c95229d1ab81a0bfd@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] gfs2: replace WARN_ON_ONCE with error message in
Author: tristmd@gmail.com

From: Tristan Madani <tristan@talencesecurity.com>

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

 rgblk_free

rgblk_free() uses WARN_ON_ONCE to report when gfs2_rbm_from_block()
fails to map the starting block to a valid resource group position:

    if (WARN_ON_ONCE(gfs2_rbm_from_block(&rbm, bstart)))
        return;

On crafted GFS2 images with corrupted resource group metadata, this
WARNING fires reliably, producing a full kernel stack trace on every
mount attempt.  The function already returns early on failure, so the
error is handled -- only the WARNING itself is problematic.

Replace WARN_ON_ONCE with an fs_warn() message that logs the invalid
block number without triggering a kernel WARNING.

Reported-by: syzbot+3e2c95229d1ab81a0bfd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3e2c95229d1ab81a0bfd
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/gfs2/rgrp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -2265,7 +2265,10 @@ static void rgblk_free(struct gfs2_sbd *sdp, struct gfs2_rgrpd *rgd,
 	struct gfs2_bitmap *bi, *bi_prev = NULL;

 	rbm.rgd = rgd;
-	if (WARN_ON_ONCE(gfs2_rbm_from_block(&rbm, bstart)))
+	if (gfs2_rbm_from_block(&rbm, bstart)) {
+		fs_warn(sdp, "rgblk_free: block %llu outside rgrp\n",
+			(unsigned long long)bstart);
 		return;
+	}
 	while (blen--) {
 		bi = rbm_bi(&rbm);
--
2.43.0