Re: [syzbot] [gfs2?] kernel BUG in gfs2_quota_cleanup (3)

[shaurya <ssranevjti@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 83 bytes --]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[-- Attachment #2: 0001-gfs2-allow-quota-cleanup-when-filesystem-is-withdraw.patch --]
[-- Type: text/x-patch, Size: 1937 bytes --]

From cb1658e55b1727dcb662f7cb9f287adf46bfe917 Mon Sep 17 00:00:00 2001
From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Date: Sat, 29 Nov 2025 15:38:18 +0530
Subject: [PATCH] gfs2: allow quota cleanup when filesystem is withdrawing

gfs2_quota_cleanup() triggers a kernel BUG when called while the
journal is still marked live, SDF_NORECOVERY is not set, and the
filesystem is in the process of withdrawing. This can occur during
filesystem reconfigure operations when a withdraw is triggered
during gfs2_make_fs_ro().

The withdraw process clears SDF_JOURNAL_LIVE in signal_our_withdraw(),
but there's a race window where gfs2_quota_cleanup() can be reached
before this happens during the gfs2_make_fs_ro() -> gfs2_quota_cleanup()
call path.

Add a check for gfs2_withdrawing_or_withdrawn() to the BUG_ON condition
to allow quota cleanup to proceed safely during a withdraw. This is
safe because:
1. The withdraw process handles cleanup gracefully
2. gfs2_quota_cleanup() already skips entries with active references
3. The function waits for references to drain via wait_event_timeout()

Reported-by: syzbot+af4d53576692f8956fd6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=af4d53576692f8956fd6
Fixes: 71733b492200 ("gfs2: fix kernel BUG in gfs2_quota_cleanup")

Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
---
 fs/gfs2/quota.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 2298e06797ac..4ae07c6cee98 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -1517,7 +1517,8 @@ void gfs2_quota_cleanup(struct gfs2_sbd *sdp)
 	int count;
 
 	BUG_ON(!test_bit(SDF_NORECOVERY, &sdp->sd_flags) &&
-		test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags));
+	       !gfs2_withdrawing_or_withdrawn(sdp) &&
+	       test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags));
 
 	spin_lock(&qd_lock);
 	list_for_each_entry(qd, &sdp->sd_quota_list, qd_list) {
-- 
2.34.1