[syzbot] [netfs?] kernel BUG in netfs_perform_write

[syzbot] [netfs?] kernel BUG in netfs_perform_write

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    b9a10f876409 Merge tag 'soc-fixes-6.17-2' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=148b6312580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=d4703ac89d9e185a
dashboard link: https://syzkaller.appspot.com/bug?extid=b73c7d94a151e2ee1e9b
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14dd1a42580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12eb0134580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f78fc7403c46/disk-b9a10f87.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a6cdb7126dd0/vmlinux-b9a10f87.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3e315b6f116e/bzImage-b9a10f87.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b73c7d94a151e2ee1e9b@syzkaller.appspotmail.com

 kill_anon_super+0x3a/0x60 fs/super.c:1282
 v9fs_kill_super+0x3d/0xa0 fs/9p/vfs_super.c:195
 deactivate_locked_super+0xc1/0x1a0 fs/super.c:474
 deactivate_super fs/super.c:507 [inline]
 deactivate_super+0xde/0x100 fs/super.c:503
 cleanup_mnt+0x225/0x450 fs/namespace.c:1375
------------[ cut here ]------------
kernel BUG at mm/filemap.c:1498!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 6039 Comm: syz.0.22 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:folio_unlock mm/filemap.c:1498 [inline]
RIP: 0010:folio_unlock+0xb3/0xd0 mm/filemap.c:1493
Code: b3 5c c9 ff 48 89 ef 31 f6 e8 f9 ed ff ff 5b 5d e9 a2 5c c9 ff e8 9d 5c c9 ff 48 c7 c6 60 19 b9 8b 48 89 ef e8 0e 0d 12 00 90 <0f> 0b 48 89 df e8 d3 bb 2f 00 e9 7b ff ff ff 66 66 2e 0f 1f 84 00
RSP: 0018:ffffc90002e97980 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88802f3cc880 RSI: ffffffff81f231a2 RDI: ffff88802f3cccc4
RBP: ffffea0001850e80 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90ab5c97 R11: 0000000000000000 R12: ffff88805caf0f00
R13: ffffc90002e97de8 R14: ffffea0001850e80 R15: dffffc0000000000
FS:  000055555d2d5500(0000) GS:ffff8881246b8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c0071b4000 CR3: 000000007d73b000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 netfs_perform_write+0xacd/0x1e60 fs/netfs/buffered_write.c:407
 netfs_buffered_write_iter_locked fs/netfs/buffered_write.c:452 [inline]
 netfs_file_write_iter+0x495/0x570 fs/netfs/buffered_write.c:491
 v9fs_file_write_iter+0x9b/0x100 fs/9p/vfs_file.c:407
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x7d3/0x11d0 fs/read_write.c:686
 ksys_write+0x12a/0x250 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1f5f98ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd97e08798 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f1f5fbc5fa0 RCX: 00007f1f5f98ebe9
RDX: 0000000000000018 RSI: 0000200000000380 RDI: 0000000000000007
RBP: 00007f1f5fa11e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1f5fbc5fa0 R14: 00007f1f5fbc5fa0 R15: 0000000000000003
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:folio_unlock mm/filemap.c:1498 [inline]
RIP: 0010:folio_unlock+0xb3/0xd0 mm/filemap.c:1493
Code: b3 5c c9 ff 48 89 ef 31 f6 e8 f9 ed ff ff 5b 5d e9 a2 5c c9 ff e8 9d 5c c9 ff 48 c7 c6 60 19 b9 8b 48 89 ef e8 0e 0d 12 00 90 <0f> 0b 48 89 df e8 d3 bb 2f 00 e9 7b ff ff ff 66 66 2e 0f 1f 84 00
RSP: 0018:ffffc90002e97980 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88802f3cc880 RSI: ffffffff81f231a2 RDI: ffff88802f3cccc4
RBP: ffffea0001850e80 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90ab5c97 R11: 0000000000000000 R12: ffff88805caf0f00
R13: ffffc90002e97de8 R14: ffffea0001850e80 R15: dffffc0000000000
FS:  000055555d2d5500(0000) GS:ffff8881246b8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c0071b4000 CR3: 000000007d73b000 CR4: 00000000003526f0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[PATCH] netfs: Prevent duplicate unlocking

[Lizhi Xu]

The filio lock has been released here, so there is no need to jump to
error_folio_unlock to release it again.

Reported-by: syzbot+b73c7d94a151e2ee1e9b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b73c7d94a151e2ee1e9b
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
---
 fs/netfs/buffered_write.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/netfs/buffered_write.c b/fs/netfs/buffered_write.c
index f27ea5099a68..09394ac2c180 100644
--- a/fs/netfs/buffered_write.c
+++ b/fs/netfs/buffered_write.c
@@ -347,7 +347,7 @@ ssize_t netfs_perform_write(struct kiocb *iocb, struct iov_iter *iter,
 		folio_put(folio);
 		ret = filemap_write_and_wait_range(mapping, fpos, fpos + flen - 1);
 		if (ret < 0)
-			goto error_folio_unlock;
+			goto out;
 		continue;
 
 	copied:
-- 
2.43.0

Re: [PATCH] netfs: Prevent duplicate unlocking

[Paulo Alcantara]

Lizhi Xu <lizhi.xu@windriver.com> writes:

> The filio lock has been released here, so there is no need to jump to
      ^ s/filio/folio/

> error_folio_unlock to release it again.
>
> Reported-by: syzbot+b73c7d94a151e2ee1e9b@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=b73c7d94a151e2ee1e9b
> Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
> ---
>  fs/netfs/buffered_write.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>

Re: [PATCH] netfs: Prevent duplicate unlocking

[Christian Brauner]

On Fri, 05 Sep 2025 09:59:25 +0800, Lizhi Xu wrote:
> The filio lock has been released here, so there is no need to jump to
> error_folio_unlock to release it again.
> 
> 

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] netfs: Prevent duplicate unlocking
      https://git.kernel.org/vfs/vfs/c/66d938e89e94

Re: [PATCH] netfs: Prevent duplicate unlocking

[David Howells]

Hi Christian,

Can you pick this up and add:

	Acked-by: David Howells <dhowells@redhat.com>

Thanks,
David