[syzbot] [gfs2?] INFO: task hung in gfs2_recover_journal (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 785f0eb2f85d Add linux-next specific files for 20260320
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=11b352f6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c584910d0d74158d
dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b352f6580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1528aada580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a1f7fd9c1a63/disk-785f0eb2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6c138da87c25/vmlinux-785f0eb2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4d1be64e56db/bzImage-785f0eb2.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/b8d9a874b489/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=16fc7ada580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+901341...@syzkaller.appspotmail.com

INFO: task kworker/0:3:5963 blocked in I/O wait for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:3 state:D stack:25400 pid:5963 tgid:5963 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: gfs2_recovery gfs2_recover_func
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5352 [inline]
__schedule+0x165c/0x5560 kernel/sched/core.c:6964
__schedule_loop kernel/sched/core.c:7047 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7062
io_schedule+0x7f/0xd0 kernel/sched/core.c:7889
folio_wait_bit_common+0x6d8/0xbc0 mm/filemap.c:1324
folio_wait_locked include/linux/pagemap.h:1245 [inline]
gfs2_jhead_process_page+0x175/0x670 fs/gfs2/lops.c:470
gfs2_find_jhead+0xbd2/0xd30 fs/gfs2/lops.c:586
gfs2_recover_func+0x6cf/0x1f60 fs/gfs2/recovery.c:459
process_one_work+0x9a3/0x1710 kernel/workqueue.c:3288
process_scheduled_works kernel/workqueue.c:3379 [inline]
worker_thread+0xba8/0x11e0 kernel/workqueue.c:3465
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
INFO: task syz.0.18:6005 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.18 state:D stack:24120 pid:6005 tgid:6005 ppid:5953 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5352 [inline]
__schedule+0x165c/0x5560 kernel/sched/core.c:6964
__schedule_loop kernel/sched/core.c:7047 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7062
bit_wait+0x11/0xd0 kernel/sched/wait_bit.c:240
__wait_on_bit+0xb9/0x310 kernel/sched/wait_bit.c:52
out_of_line_wait_on_bit+0x13b/0x190 kernel/sched/wait_bit.c:67
wait_on_bit include/linux/wait_bit.h:77 [inline]
gfs2_recover_journal+0xda/0x140 fs/gfs2/recovery.c:579
init_journal+0x16ad/0x2280 fs/gfs2/ops_fstype.c:794
init_inodes+0xdb/0x320 fs/gfs2/ops_fstype.c:844
gfs2_fill_super+0x1a38/0x21d0 fs/gfs2/ops_fstype.c:1250
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
gfs2_get_tree+0x51/0x1e0 fs/gfs2/ops_fstype.c:1332
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3764 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3840
do_mount fs/namespace.c:4173 [inline]
__do_sys_mount fs/namespace.c:4372 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4349
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f611259da0a
RSP: 002b:00007ffe1764d4e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe1764d570 RCX: 00007f611259da0a
RDX: 0000200000037f40 RSI: 0000200000037f80 RDI: 00007ffe1764d530
RBP: 0000200000037f40 R08: 00007ffe1764d570 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000037f80
R13: 00007ffe1764d530 R14: 0000000000037fc4 R15: 0000200000000300
</TASK>

Showing all locks held in the system:
1 lock held by pool_workqueue_/3:
1 lock held by khungtaskd/30:
#0: ffffffff8e75d7e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#0: ffffffff8e75d7e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#0: ffffffff8e75d7e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by getty/5600:
#0: ffff888037d8f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 drivers/tty/n_tty.c:2211
2 locks held by kworker/0:3/5963:
#0: ffff8880232a6140 ((wq_completion)gfs2_recovery){+.+.}-{0:0}, at: process_one_work+0x890/0x1710 kernel/workqueue.c:3260
#1: ffffc900043b7c40 ((work_completion)(&jd->jd_work)){+.+.}-{0:0}, at: process_one_work+0x8b7/0x1710 kernel/workqueue.c:3261
1 lock held by syz.0.18/6005:
#0: ffff8880346ce0d8 (&type->s_umount_key#54/1){+.+.}-{4:4}, at: alloc_super+0x28c/0xab0 fs/super.c:345
3 locks held by syz.1.203/6599:

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd3/0x1030 kernel/hung_task.c:561
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6599 Comm: syz.1.203 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:mark_lock+0xa4/0x190 kernel/locking/lockdep.c:4774
Code: 0e 48 c7 c6 19 03 06 8e 67 48 0f b9 3a 90 31 c9 4c 89 fe 4c 89 f7 b8 01 00 00 00 85 69 60 74 10 5b 41 5c 41 5d 41 5e 41 5f 5d <c3> cc cc cc cc cc 49 89 fe 49 89 f7 e8 5b 94 ff ff 89 c1 31 c0 85
RSP: 0018:ffffc90000a08840 EFLAGS: 00000006
RAX: 0000000000000001 RBX: ffff88801d3dc8e8 RCX: ffffffff93c65330
RDX: 0000000000000008 RSI: ffff88801d3dc8c8 RDI: ffff88801d3dbd00
RBP: ffff88801d3dc8c8 R08: ffffffff84b9d570 R09: ffffffff9a4fdcb8
R10: ffffc90000a08a60 R11: fffff5200014114e R12: 0000000000000003
R13: ffff88801d3dc8c8 R14: ffff88801d3dbd00 R15: 0000000000000003
FS: 000055557c000500(0000) GS:ffff888125548000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055910e737168 CR3: 000000006c700000 CR4: 00000000003526f0
Call Trace:
<IRQ>
mark_usage kernel/locking/lockdep.c:4674 [inline]
__lock_acquire+0x6b5/0x2cf0 kernel/locking/lockdep.c:5191
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:166
debug_object_assert_init+0xb0/0x370 lib/debugobjects.c:1035
debug_timer_assert_init kernel/time/timer.c:803 [inline]
debug_assert_init kernel/time/timer.c:848 [inline]
__mod_timer+0x4a/0xf30 kernel/time/timer.c:1025
dsp_cmx_send+0x1abe/0x1b40 drivers/isdn/mISDN/dsp_cmx.c:1839
call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2373 [inline]
__run_timer_base+0x652/0x8b0 kernel/time/timer.c:2385
run_timer_base kernel/time/timer.c:2394 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2404
handle_softirqs+0x22a/0x840 kernel/softirq.c:626
__do_softirq kernel/softirq.c:660 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x220 kernel/softirq.c:739
irq_exit_rcu+0x9/0x30 kernel/softirq.c:756
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:2039 [inline]
RIP: 0010:vprintk_emit+0x45d/0x560 kernel/printk/printk.c:2478
Code: 0f 84 44 ff ff ff e8 a2 09 21 00 fb eb 44 e8 9a 09 21 00 e8 75 7b 0b 0a 4d 85 f6 74 94 e8 8b 09 21 00 fb 48 c7 c7 00 fc 74 8e <31> f6 ba 01 00 00 00 31 c9 41 b8 01 00 00 00 45 31 c9 53 e8 cb 18
RSP: 0018:ffffc90004b06e00 EFLAGS: 00000293
RAX: ffffffff81a547f5 RBX: ffffffff81a5466f RCX: ffff88801d3dbd00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e74fc00
RBP: ffffc90004b06eb0 R08: ffffffff90123cf7 R09: 1ffffffff202479e
R10: dffffc0000000000 R11: fffffbfff202479f R12: 0000000000000000
R13: 000000000000002f R14: 0000000000000200 R15: 1ffff92000960dc4
_printk+0xdd/0x130 kernel/printk/printk.c:2504
set_capacity_and_notify+0x2c5/0x320 block/genhd.c:93
loop_set_size+0x44/0xb0 drivers/block/loop.c:220
loop_configure+0x9ac/0xdf0 drivers/block/loop.c:1079
lo_ioctl+0x447/0x1fb0 drivers/block/loop.c:1534
blkdev_ioctl+0x5e3/0x740 block/ioctl.c:804
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa17279c42b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffde9d10a80 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fa17279c42b
RDX: 0000000000000003 RSI: 0000000000004c00 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 00007ffde9d10bb0 R14: 00007ffde9d10b70 R15: 00007fa169800000
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master


filemap_get_folio() can return an ERR_PTR if the folio is not
present in the page cache. This can happen when a crafted or
corrupted GFS2 filesystem image is mounted and journal recovery
is triggered.

gfs2_jhead_process_page() calls filemap_get_folio() without
checking the return value, and passes the result directly to
folio_wait_locked(). When an ERR_PTR is passed to
folio_wait_locked(), the kernel task gets stuck in uninterruptible
sleep (state D) forever, triggering the hung task watchdog.

This was reported by syzbot. The reproducer mounts a crafted GFS2
image which causes gfs2_find_jhead() to call
gfs2_jhead_process_page() on a page that was never properly
submitted for I/O, causing filemap_get_folio() to return
ERR_PTR(-ENOENT).

Fix this by checking the return value of filemap_get_folio() and
marking the journal head search as done if the folio is not found,
allowing the caller to return an error gracefully.

Reported-by: syzbot+901341...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
Signed-off-by: Deepanshu Kartikey <Karti...@gmail.com>
---
fs/gfs2/lops.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 797931eb5845..c2bb262318bb 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -467,6 +467,11 @@ static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,

folio = filemap_get_folio(jd->jd_inode->i_mapping, index);

+ if (IS_ERR(folio)) {
+ *done = true;
+ return ;
+ }
+
folio_wait_locked(folio);
if (!folio_test_uptodate(folio))
*done = true;
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gfs2_fill_super

loop1: detected capacity change from 0 to 32768
------------[ cut here ]------------
kmem_cache of name 'gfs2-bufdata/syz:syz' already exists
WARNING: mm/slab_common.c:112 at kmem_cache_sanity_check mm/slab_common.c:111 [inline], CPU#1: syz.1.18/6629
WARNING: mm/slab_common.c:112 at __kmem_cache_create_args+0xac/0x440 mm/slab_common.c:352, CPU#1: syz.1.18/6629
Modules linked in:
CPU: 1 UID: 0 PID: 6629 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026

RIP: 0010:kmem_cache_sanity_check mm/slab_common.c:111 [inline]
RIP: 0010:__kmem_cache_create_args+0xaf/0x440 mm/slab_common.c:352
Code: 86 8e 4d 8b 24 24 49 81 fc 18 68 86 8e 74 20 49 8b 7c 24 f8 48 89 de e8 3f 5c 9c 09 85 c0 75 e2 48 8d 3d 54 70 06 0e 48 89 de <67> 48 0f b9 3a 48 89 df be 20 00 00 00 e8 df 5d 9c 09 48 85 c0 0f
RSP: 0018:ffffc90002587948 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88805dca3500 RCX: 0000000000000005
RDX: 000000005dca3504 RSI: ffff88805dca3500 RDI: ffffffff9016e0b0
RBP: 0000000000000000 R08: ffffffff901246f7 R09: 1ffffffff20248de
R10: dffffc0000000000 R11: fffffbfff20248df R12: ffff888035c9b920
R13: ffff88807cdf8000 R14: 0000000000000050 R15: ffffc90002587a60
FS: 00007f0e2aa0a6c0(0000) GS:ffff888125548000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fffebd18738 CR3: 000000007944c000 CR4: 00000000003526f0
Call Trace:
<TASK>
__kmem_cache_create include/linux/slab.h:390 [inline]
gfs2_fill_super+0x13a4/0x21d0 fs/gfs2/ops_fstype.c:1202
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
gfs2_get_tree+0x51/0x1e0 fs/gfs2/ops_fstype.c:1342

vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3764 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3840
do_mount fs/namespace.c:4173 [inline]
__do_sys_mount fs/namespace.c:4372 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4349
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f0e29b9da0a
Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0e2aa09e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f0e2aa09ee0 RCX: 00007f0e29b9da0a
RDX: 0000200000037f40 RSI: 0000200000037f80 RDI: 00007f0e2aa09ea0
RBP: 0000200000037f40 R08: 00007f0e2aa09ee0 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000037f80

R13: 00007f0e2aa09ea0 R14: 0000000000037fc4 R15: 0000200000000300
</TASK>
----------------
Code disassembly (best guess):
0: 86 8e 4d 8b 24 24 xchg %cl,0x24248b4d(%rsi)
6: 49 81 fc 18 68 86 8e cmp $0xffffffff8e866818,%r12
d: 74 20 je 0x2f
f: 49 8b 7c 24 f8 mov -0x8(%r12),%rdi
14: 48 89 de mov %rbx,%rsi
17: e8 3f 5c 9c 09 call 0x99c5c5b
1c: 85 c0 test %eax,%eax
1e: 75 e2 jne 0x2
20: 48 8d 3d 54 70 06 0e lea 0xe067054(%rip),%rdi # 0xe06707b
27: 48 89 de mov %rbx,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 48 89 df mov %rbx,%rdi
32: be 20 00 00 00 mov $0x20,%esi
37: e8 df 5d 9c 09 call 0x99c5e1b
3c: 48 85 c0 test %rax,%rax
3f: 0f .byte 0xf


Tested on:

commit: 09c0f7f1 Add linux-next specific files for 20260323
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13a59e16580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c0c30527ccbcb0f2

dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=11d9c1d6580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master


filemap_get_folio() can return an ERR_PTR if the folio is not
present in the page cache. This can happen when a crafted or
corrupted GFS2 filesystem image is mounted and journal recovery
is triggered.

gfs2_jhead_process_page() calls filemap_get_folio() without
checking the return value, and passes the result directly to
folio_wait_locked(). When an ERR_PTR is passed to
folio_wait_locked(), the kernel task gets stuck in uninterruptible
sleep (state D) forever, triggering the hung task watchdog.

Fix this by checking the return value of filemap_get_folio().
If the folio is not found, record the error via filemap_set_wb_err()
so that gfs2_find_jhead() picks it up through filemap_check_wb_err()
and returns a proper error code to the caller. Without this,
gfs2_find_jhead() would return success despite the failure, leading
to further issues during mount such as duplicate kmem_cache creation.

Reported-by: syzbot+901341...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
Signed-off-by: Deepanshu Kartikey <Karti...@gmail.com>
---

fs/gfs2/lops.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 797931eb5845..a832904a09e3 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -467,6 +467,12 @@ static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,

folio = filemap_get_folio(jd->jd_inode->i_mapping, index);

+ if (IS_ERR(folio)) {

+ filemap_set_wb_err(jd->jd_inode->i_mapping, PTR_ERR(folio));

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gfs2_fill_super

loop1: detected capacity change from 0 to 32768
------------[ cut here ]------------
kmem_cache of name 'gfs2-bufdata/syz:syz' already exists

WARNING: mm/slab_common.c:112 at kmem_cache_sanity_check mm/slab_common.c:111 [inline], CPU#0: syz.1.21/6483
WARNING: mm/slab_common.c:112 at __kmem_cache_create_args+0xac/0x440 mm/slab_common.c:352, CPU#0: syz.1.21/6483
Modules linked in:
CPU: 0 UID: 0 PID: 6483 Comm: syz.1.21 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:kmem_cache_sanity_check mm/slab_common.c:111 [inline]
RIP: 0010:__kmem_cache_create_args+0xaf/0x440 mm/slab_common.c:352
Code: 86 8e 4d 8b 24 24 49 81 fc 18 68 86 8e 74 20 49 8b 7c 24 f8 48 89 de e8 3f 5c 9c 09 85 c0 75 e2 48 8d 3d 54 70 06 0e 48 89 de <67> 48 0f b9 3a 48 89 df be 20 00 00 00 e8 df 5d 9c 09 48 85 c0 0f

RSP: 0018:ffffc90003477948 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888026fe5f80 RCX: 0000000000000005
RDX: 0000000026fe5f04 RSI: ffff888026fe5f80 RDI: ffffffff9016e0b0

RBP: 0000000000000000 R08: ffffffff901246f7 R09: 1ffffffff20248de

R10: dffffc0000000000 R11: fffffbfff20248df R12: ffff888027604ba0
R13: ffff888078654000 R14: 0000000000000050 R15: ffffc90003477a60
FS: 00007fe28ae0f6c0(0000) GS:ffff888125448000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fe289f85900 CR3: 0000000026234000 CR4: 00000000003526f0

Call Trace:
<TASK>
__kmem_cache_create include/linux/slab.h:390 [inline]
gfs2_fill_super+0x13a4/0x21d0 fs/gfs2/ops_fstype.c:1202
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
gfs2_get_tree+0x51/0x1e0 fs/gfs2/ops_fstype.c:1342
vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3764 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3840
do_mount fs/namespace.c:4173 [inline]
__do_sys_mount fs/namespace.c:4372 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4349
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7fe289f9da0a

Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fe28ae0ee58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fe28ae0eee0 RCX: 00007fe289f9da0a
RDX: 0000200000037f40 RSI: 0000200000037f80 RDI: 00007fe28ae0eea0
RBP: 0000200000037f40 R08: 00007fe28ae0eee0 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000037f80

R13: 00007fe28ae0eea0 R14: 0000000000037fc4 R15: 0000200000000300

</TASK>
----------------
Code disassembly (best guess):
0: 86 8e 4d 8b 24 24 xchg %cl,0x24248b4d(%rsi)
6: 49 81 fc 18 68 86 8e cmp $0xffffffff8e866818,%r12
d: 74 20 je 0x2f
f: 49 8b 7c 24 f8 mov -0x8(%r12),%rdi
14: 48 89 de mov %rbx,%rsi
17: e8 3f 5c 9c 09 call 0x99c5c5b
1c: 85 c0 test %eax,%eax
1e: 75 e2 jne 0x2
20: 48 8d 3d 54 70 06 0e lea 0xe067054(%rip),%rdi # 0xe06707b
27: 48 89 de mov %rbx,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 48 89 df mov %rbx,%rdi
32: be 20 00 00 00 mov $0x20,%esi
37: e8 df 5d 9c 09 call 0x99c5e1b
3c: 48 85 c0 test %rax,%rax
3f: 0f .byte 0xf


Tested on:

commit: 09c0f7f1 Add linux-next specific files for 20260323
git tree: linux-next

console output: https://syzkaller.appspot.com/x/log.txt?x=16b46ada580000

kernel config: https://syzkaller.appspot.com/x/.config?x=c0c30527ccbcb0f2
dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=146f906a580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] gfs2: fix duplicate kmem_cache on repeated mount failure

Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

When gfs2_fill_super() fails after the bufdata cache has been
created, the error path destroys the cache via fail_bufdata but
does not set sd_bufdata to NULL. The VFS then calls gfs2_put_super()
as part of mount cleanup, which destroys the cache a second time,
corrupting the slab state.

On the next mount attempt, kmem_cache_create() finds a ghost entry
with the same name and triggers a WARN, causing a kernel panic.

Fix this by setting sd_bufdata to NULL after destroying it in the
error path. kmem_cache_destroy(NULL) is a no-op, so the subsequent
call in gfs2_put_super() becomes safe.

Reported-by: syzbot+901341...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a

Fixes: f9d6fc9557e6 ("gfs2: per-filesystem bufdata cache")

Signed-off-by: Deepanshu Kartikey <Karti...@gmail.com>
---

fs/gfs2/lops.c | 3 +++
fs/gfs2/ops_fstype.c | 1 +
2 files changed, 4 insertions(+)

diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 797931eb5845..005584311eff 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -467,6 +467,9 @@ static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,

folio = filemap_get_folio(jd->jd_inode->i_mapping, index);

+ if (IS_ERR(folio))

+ return;

+
folio_wait_locked(folio);
if (!folio_test_uptodate(folio))
*done = true;

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index b44adb40635d..4cff08fa3b50 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1315,6 +1315,7 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
gfs2_sys_fs_del(sdp);
fail_bufdata:
kmem_cache_destroy(sdp->sd_bufdata);
+ sdp->sd_bufdata = NULL;
fail_delete_wq:
destroy_workqueue(sdp->sd_delete_wq);
fail_glock_wq:
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in gfs2_fill_super

loop1: detected capacity change from 0 to 32768
------------[ cut here ]------------
kmem_cache of name 'gfs2-bufdata/syz:syz' already exists

WARNING: mm/slab_common.c:112 at kmem_cache_sanity_check mm/slab_common.c:111 [inline], CPU#0: syz.1.18/6515
WARNING: mm/slab_common.c:112 at __kmem_cache_create_args+0xac/0x440 mm/slab_common.c:352, CPU#0: syz.1.18/6515
Modules linked in:
CPU: 0 UID: 0 PID: 6515 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:kmem_cache_sanity_check mm/slab_common.c:111 [inline]
RIP: 0010:__kmem_cache_create_args+0xaf/0x440 mm/slab_common.c:352
Code: 86 8e 4d 8b 24 24 49 81 fc 18 68 86 8e 74 20 49 8b 7c 24 f8 48 89 de e8 3f 5c 9c 09 85 c0 75 e2 48 8d 3d 54 70 06 0e 48 89 de <67> 48 0f b9 3a 48 89 df be 20 00 00 00 e8 df 5d 9c 09 48 85 c0 0f

RSP: 0018:ffffc90003407948 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880563c5040 RCX: 0000000000000005
RDX: 00000000563c5004 RSI: ffff8880563c5040 RDI: ffffffff9016e0b0

RBP: 0000000000000000 R08: ffffffff901246f7 R09: 1ffffffff20248de

R10: dffffc0000000000 R11: fffffbfff20248df R12: ffff88814a3b6a60
R13: ffff888035dd4000 R14: 0000000000000050 R15: ffffc90003407a60
FS: 00007fdcb83716c0(0000) GS:ffff888125448000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fdcb7585900 CR3: 000000005e392000 CR4: 00000000003526f0

Call Trace:
<TASK>
__kmem_cache_create include/linux/slab.h:390 [inline]

gfs2_fill_super+0x13a7/0x21f0 fs/gfs2/ops_fstype.c:1202
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
gfs2_get_tree+0x51/0x1e0 fs/gfs2/ops_fstype.c:1343

vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3764 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3840
do_mount fs/namespace.c:4173 [inline]
__do_sys_mount fs/namespace.c:4372 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4349
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7fdcb759da0a

Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fdcb8370e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fdcb8370ee0 RCX: 00007fdcb759da0a
RDX: 0000200000037f40 RSI: 0000200000037f80 RDI: 00007fdcb8370ea0
RBP: 0000200000037f40 R08: 00007fdcb8370ee0 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000037f80

R13: 00007fdcb8370ea0 R14: 0000000000037fc4 R15: 0000200000000300

</TASK>
----------------
Code disassembly (best guess):
0: 86 8e 4d 8b 24 24 xchg %cl,0x24248b4d(%rsi)
6: 49 81 fc 18 68 86 8e cmp $0xffffffff8e866818,%r12
d: 74 20 je 0x2f
f: 49 8b 7c 24 f8 mov -0x8(%r12),%rdi
14: 48 89 de mov %rbx,%rsi
17: e8 3f 5c 9c 09 call 0x99c5c5b
1c: 85 c0 test %eax,%eax
1e: 75 e2 jne 0x2
20: 48 8d 3d 54 70 06 0e lea 0xe067054(%rip),%rdi # 0xe06707b
27: 48 89 de mov %rbx,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 48 89 df mov %rbx,%rdi
32: be 20 00 00 00 mov $0x20,%esi
37: e8 df 5d 9c 09 call 0x99c5e1b
3c: 48 85 c0 test %rax,%rax
3f: 0f .byte 0xf


Tested on:

commit: 09c0f7f1 Add linux-next specific files for 20260323
git tree: linux-next

console output: https://syzkaller.appspot.com/x/log.txt?x=10f39e16580000

kernel config: https://syzkaller.appspot.com/x/.config?x=c0c30527ccbcb0f2
dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=132fc1d6580000

[Edward Adam Davis]

#syz test

diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 1cd8ec0bce83..fd11d5aa93b6 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -2266,6 +2266,9 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
u64 size;
int rc;
ktime_t start, end;
+ struct super_block *sb = sdp->sd_vfs;
+ sector_t maxsector = bdev_nr_sectors(sb->s_bdev);
+ u32 bshift = sdp->sd_fsb2bb_shift;

start = ktime_get();
lblock_stop = i_size_read(jd->jd_inode) >> shift;
@@ -2280,6 +2283,10 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
rc = gfs2_block_map(jd->jd_inode, lblock, &bh, 0);
if (rc || !buffer_mapped(&bh))
goto fail;
+ if (bh.b_blocknr << bshift > maxsector) {
+ rc = -EIO;
+ goto fail;
+ }
rc = gfs2_add_jextent(jd, lblock, bh.b_blocknr, bh.b_size >> shift);
if (rc)
goto fail;

[Edward Adam Davis]

[Edward Adam Davis]

During the mount process, when the journal recovery is executed, the
system blocks and waits for the recovery to complete. The issue reported
in [1] involves the kernel thread responsible for journal recovery
becoming blocked on a specific folio that had not yet been fully read.
This folio was submitted via a bio chain containing an excessively large
sector value; however, the submission failed during the process because
the end-of-file (EOF) check for the bio failed. Consequently, the folio
was never unlocked, which ultimately triggered the timeout issue reported
in [1].

To address this, a check for the blocknr value has been added during the
loading of journal extents from the disk. If the blocknr value exceeds
the maximum sector value supported by the disk, it indicates that the
data on the disk is corrupted; in such cases, the loading of the journal
extent is immediately terminated.

[1]

INFO: task kworker/0:3:5963 blocked in I/O wait for more than 143 seconds.

Workqueue: gfs2_recovery gfs2_recover_func
Call Trace:

folio_wait_locked include/linux/pagemap.h:1245 [inline]
gfs2_jhead_process_page+0x175/0x670 fs/gfs2/lops.c:470
gfs2_find_jhead+0xbd2/0xd30 fs/gfs2/lops.c:586
gfs2_recover_func+0x6cf/0x1f60 fs/gfs2/recovery.c:459

Fixes: b50f227bddf1 ("GFS2: Clean up journal extent mapping")

Reported-by: syzbot+901341...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a

Tested-by: syzbot+901341...@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <ead...@qq.com>
---
fs/gfs2/bmap.c | 7 +++++++
1 file changed, 7 insertions(+)

diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 1cd8ec0bce83..d42307ab0684 100644

--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -2266,6 +2266,9 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
u64 size;
int rc;
ktime_t start, end;
+ struct super_block *sb = sdp->sd_vfs;
+ sector_t maxsector = bdev_nr_sectors(sb->s_bdev);
+ u32 bshift = sdp->sd_fsb2bb_shift;

start = ktime_get();
lblock_stop = i_size_read(jd->jd_inode) >> shift;
@@ -2280,6 +2283,10 @@ int gfs2_map_journal_extents(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd)
rc = gfs2_block_map(jd->jd_inode, lblock, &bh, 0);
if (rc || !buffer_mapped(&bh))
goto fail;
+ if (bh.b_blocknr << bshift > maxsector) {
+ rc = -EIO;
+ goto fail;
+ }
rc = gfs2_add_jextent(jd, lblock, bh.b_blocknr, bh.b_size >> shift);
if (rc)
goto fail;

--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

KASAN: slab-use-after-free Read in gfs2_invalidate_folio

RBP: 00007ffde9a1cf60 R08: 00007ffde9a1df60 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffde9a1dff0
R13: 00007fe90d032050 R14: 000000000001f130 R15: 00007ffde9a1e030
</TASK>
gfs2: fsid=syz:syz.0: gfs2_evict_inode: -5
==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in gfs2_discard fs/gfs2/aops.c:590 [inline]
BUG: KASAN: slab-use-after-free in gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
Read of size 8 at addr ffff88807c9098d8 by task syz-executor/6336

CPU: 0 UID: 0 PID: 6336 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026

Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120

print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
list_empty include/linux/list.h:381 [inline]
gfs2_discard fs/gfs2/aops.c:590 [inline]
gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
folio_invalidate mm/truncate.c:140 [inline]
truncate_cleanup_folio+0xcb/0x190 mm/truncate.c:160
truncate_inode_pages_range+0x2ce/0xe30 mm/truncate.c:404
gfs2_evict_inode+0x9da/0x12d0 fs/gfs2/super.c:1476
evict+0x61e/0xb10 fs/inode.c:846
gfs2_put_super+0x355/0x890 fs/gfs2/super.c:619
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe90cf9d9d7
Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffde9a1cea8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007fe90d032050 RCX: 00007fe90cf9d9d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffde9a1cf60
RBP: 00007ffde9a1cf60 R08: 00007ffde9a1df60 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffde9a1dff0
R13: 00007fe90d032050 R14: 000000000001f130 R15: 00007ffde9a1e030
</TASK>

Allocated by task 6336:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_noprof+0x2bc/0x650 mm/slub.c:4905
gfs2_alloc_bufdata fs/gfs2/trans.c:176 [inline]
gfs2_trans_add_data+0x1e8/0x610 fs/gfs2/trans.c:215
gfs2_unstuffer_folio fs/gfs2/bmap.c:81 [inline]
__gfs2_unstuff_inode fs/gfs2/bmap.c:119 [inline]
gfs2_unstuff_dinode+0xace/0x1240 fs/gfs2/bmap.c:166
gfs2_adjust_quota+0x23f/0x850 fs/gfs2/quota.c:848
do_sync+0x872/0xcb0 fs/gfs2/quota.c:962
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6336:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6242 [inline]
kmem_cache_free+0x182/0x650 mm/slub.c:6369
gfs2_trans_drain_list fs/gfs2/log.c:995 [inline]
gfs2_trans_drain fs/gfs2/log.c:1013 [inline]
gfs2_log_flush+0x18c1/0x2640 fs/gfs2/log.c:1185
do_sync+0xa48/0xcb0 fs/gfs2/quota.c:982
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88807c9098c0
which belongs to the cache gfs2-bufdata/syz:syz of size 80
The buggy address is located 24 bytes inside of
freed 80-byte region [ffff88807c9098c0, ffff88807c909910)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807c909a80 pfn:0x7c909
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff8881499c0500 ffff888035149d08 ffff888035149d08
raw: ffff88807c909a80 0000000800240018 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6336, tgid 6336 (syz-executor), ts 127950955156, free_ts 125551511102
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x2418/0x24b0 mm/page_alloc.c:3926
__alloc_frozen_pages_noprof+0x233/0x3d0 mm/page_alloc.c:5213
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3467
new_slab mm/slub.c:3525 [inline]
refill_objects+0x339/0x3d0 mm/slub.c:7247
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x321/0x720 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
kmem_cache_alloc_noprof+0x37d/0x650 mm/slub.c:4905
gfs2_alloc_bufdata fs/gfs2/trans.c:176 [inline]
gfs2_trans_add_meta+0x214/0x8e0 fs/gfs2/trans.c:279
gfs2_alloc_extent fs/gfs2/rgrp.c:2237 [inline]
gfs2_alloc_blocks+0x7ae/0x2090 fs/gfs2/rgrp.c:2447
__gfs2_unstuff_inode fs/gfs2/bmap.c:107 [inline]
gfs2_unstuff_dinode+0x249/0x1240 fs/gfs2/bmap.c:166
gfs2_adjust_quota+0x23f/0x850 fs/gfs2/quota.c:848
do_sync+0x872/0xcb0 fs/gfs2/quota.c:962
gfs2_quota_sync+0x370/0x470 fs/gfs2/quota.c:1358
gfs2_sync_fs+0x4c/0xb0 fs/gfs2/super.c:661
sync_filesystem+0xee/0x230 fs/sync.c:56
generic_shutdown_super+0x77/0x2d0 fs/super.c:625
page last free pid 23 tgid 23 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2944
__tlb_remove_table_free mm/mmu_gather.c:228 [inline]
tlb_remove_table_rcu+0x85/0x100 mm/mmu_gather.c:291
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x840 kernel/softirq.c:622
run_ksoftirqd+0x36/0x60 kernel/softirq.c:1076
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160

kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
ffff88807c909780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807c909800: fc fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb
>ffff88807c909880: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff88807c909900: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb
ffff88807c909980: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fc fc
==================================================================


Tested on:

commit: 85964cdc Add linux-next specific files for 20260324
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=14e9506a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=84ab18c6f45b39c

dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=11b46a06580000

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in gfs2_invalidate_folio

RBP: 00007ffc7d4253b0 R08: 00007ffc7d4263b0 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc7d426440
R13: 00007f8d07e32050 R14: 0000000000025091 R15: 00007ffc7d426480

</TASK>
gfs2: fsid=syz:syz.0: gfs2_evict_inode: -5
==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in gfs2_discard fs/gfs2/aops.c:590 [inline]
BUG: KASAN: slab-use-after-free in gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628

Read of size 8 at addr ffff88807e71e8d8 by task syz-executor/6427

CPU: 0 UID: 0 PID: 6427 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)

RIP: 0033:0x7f8d07d9d9d7

Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8

RSP: 002b:00007ffc7d4252f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f8d07e32050 RCX: 00007f8d07d9d9d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc7d4253b0
RBP: 00007ffc7d4253b0 R08: 00007ffc7d4263b0 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc7d426440
R13: 00007f8d07e32050 R14: 0000000000025091 R15: 00007ffc7d426480
</TASK>

Allocated by task 6427:

Freed by task 6427:

The buggy address belongs to the object at ffff88807e71e8c0

which belongs to the cache gfs2-bufdata/syz:syz of size 80
The buggy address is located 24 bytes inside of

freed 80-byte region [ffff88807e71e8c0, ffff88807e71e910)

The buggy address belongs to the physical page:

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807e71ea80 pfn:0x7e71e

flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)

raw: 00fff00000000200 ffff888141ad78c0 ffff8880307dde88 ffff8880307dde88
raw: ffff88807e71ea80 0000000800240018 00000000f5000000 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6427, tgid 6427 (syz-executor), ts 151784205341, free_ts 151343117657

page last free pid 6500 tgid 6499 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]

free_unref_folios+0xcec/0x1480 mm/page_alloc.c:3005
folios_put_refs+0x9ff/0xb40 mm/swap.c:1008
folio_batch_release include/linux/folio_batch.h:101 [inline]
truncate_inode_pages_range+0x3dd/0xe30 mm/truncate.c:408
kill_bdev block/bdev.c:91 [inline]
set_blocksize+0x2ce/0x440 block/bdev.c:207
sb_set_blocksize+0xf8/0x240 block/bdev.c:240
init_sb+0x9d4/0x12f0 fs/gfs2/ops_fstype.c:490
gfs2_fill_super+0x1739/0x21d0 fs/gfs2/ops_fstype.c:1225
get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
gfs2_get_tree+0x51/0x1e0 fs/gfs2/ops_fstype.c:1342

vfs_get_tree+0x92/0x2a0 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3764 [inline]
do_new_mount+0x341/0xd30 fs/namespace.c:3840
do_mount fs/namespace.c:4173 [inline]
__do_sys_mount fs/namespace.c:4372 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4349
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff88807e71e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807e71e800: fc fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb
>ffff88807e71e880: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff88807e71e900: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb
ffff88807e71e980: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fc fc

==================================================================


Tested on:

commit: 85964cdc Add linux-next specific files for 20260324
git tree: linux-next

console output: https://syzkaller.appspot.com/x/log.txt?x=126f0c26580000

kernel config: https://syzkaller.appspot.com/x/.config?x=84ab18c6f45b39c
dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=14bbc4ca580000

[Edward Adam Davis]

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 09c0f7f1bcdb

diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index 1cd8ec0bce83..fd11d5aa93b6 100644

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in gfs2_invalidate_folio

RBP: 00007ffd3cccca40 R08: 00007ffd3cccda40 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd3cccdad0
R13: 00007f2a75832050 R14: 0000000000020287 R15: 00007ffd3cccdb10

</TASK>
gfs2: fsid=syz:syz.0: gfs2_evict_inode: -5
==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in gfs2_discard fs/gfs2/aops.c:590 [inline]
BUG: KASAN: slab-use-after-free in gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628

Read of size 8 at addr ffff88804e6038d8 by task syz-executor/6493

CPU: 0 UID: 0 PID: 6493 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
list_empty include/linux/list.h:381 [inline]
gfs2_discard fs/gfs2/aops.c:590 [inline]
gfs2_invalidate_folio+0x40b/0x750 fs/gfs2/aops.c:628
folio_invalidate mm/truncate.c:140 [inline]
truncate_cleanup_folio+0xcb/0x190 mm/truncate.c:160
truncate_inode_pages_range+0x2ce/0xe30 mm/truncate.c:404

gfs2_evict_inode+0xa60/0x1300 fs/gfs2/super.c:1459

evict+0x61e/0xb10 fs/inode.c:846
gfs2_put_super+0x355/0x890 fs/gfs2/super.c:619
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f2a7579d9d7

Code: a2 c7 05 1c fd 24 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8

RSP: 002b:00007ffd3cccc988 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f2a75832050 RCX: 00007f2a7579d9d7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd3cccca40
RBP: 00007ffd3cccca40 R08: 00007ffd3cccda40 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd3cccdad0
R13: 00007f2a75832050 R14: 0000000000020287 R15: 00007ffd3cccdb10
</TASK>

Allocated by task 6493:

Freed by task 6493:

The buggy address belongs to the object at ffff88804e6038c0

which belongs to the cache gfs2-bufdata/syz:syz of size 80
The buggy address is located 24 bytes inside of

freed 80-byte region [ffff88804e6038c0, ffff88804e603910)

The buggy address belongs to the physical page:

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804e603a80 pfn:0x4e603

flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)

raw: 00fff00000000200 ffff888140adea00 ffff888034f85e88 ffff888034f85e88
raw: ffff88804e603a80 0000000800240018 00000000f5000000 0000000000000000

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6493, tgid 6493 (syz-executor), ts 131787600701, free_ts 125848846283

page last free pid 6391 tgid 6391 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]

__free_frozen_pages+0xbc7/0xd30 mm/page_alloc.c:2944
vfree+0x1d1/0x2f0 mm/vmalloc.c:3472
kcov_put kernel/kcov.c:442 [inline]
kcov_close+0x28/0x50 kernel/kcov.c:543
__fput+0x44f/0xa70 fs/file_table.c:469
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x70f/0x22c0 kernel/exit.c:974
do_group_exit+0x21b/0x2d0 kernel/exit.c:1116
get_signal+0x1284/0x1330 kernel/signal.c:3036
arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98

__exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff88804e603780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88804e603800: fc fc fc fc fc fc fc fc fc fc fa fb fb fb fb fb
>ffff88804e603880: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff88804e603900: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb
ffff88804e603980: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fc fc
==================================================================


Tested on:

commit: 09c0f7f1 Add linux-next specific files for 20260323
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1277ac26580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c0c30527ccbcb0f2

dashboard link: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=11ced6da580000