[Kriish Sharma]

#syz test

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 26d6c1eea559..a879e8030568 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -760,7 +760,7 @@ static int compute_bitstructs(struct gfs2_rgrpd *rgd)
        u32 bytes_left, bytes;
        int x;

-       if (!length)
+       if (!length || length > KMALLOC_MAX_SIZE / sizeof(struct gfs2_bitmap))
                return -EINVAL;

        rgd->rd_bits = kcalloc(length, sizeof(struct gfs2_bitmap), GFP_NOFS);

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
checking file fs/gfs2/rgrp.c
patch: **** unexpected end of file in patch



Tested on:

commit: cbf658dd Merge tag 'net-6.17-rc7' of git://git.kernel...
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=d2f00edef461175
dashboard link: https://syzkaller.appspot.com/bug?extid=7567dc5c8aa8f68bde74
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=10c6cf62580000

[Pedro Gomes]

---
 fs/jfs/jfs_dtree.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index ab11849cf9cc..c200b37f4562 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -2129,11 +2129,17 @@ int dtDelete(tid_t tid,
  next_index = -1;
  else {
  stbl = DT_GETSTBL(np);
- ldtentry =
-    (struct ldtentry *) & np->
-    slot[stbl[0]];
- next_index =
-    le32_to_cpu(ldtentry->index);
+ if (stbl[0] < 0 || stbl[0] >= DTPAGEMAXSLOT) {
+ jfs_err("JFS: Invalid stbl[0] = %d for inode %ld, block = %lld",
+ stbl[0], (long)ip->i_ino, (long long)le64_to_cpu(p->header.next));
+ next_index = -1;
+ } else {
+ ldtentry =
+ (struct ldtentry *) & np->
+ slot[stbl[0]];
+ next_index =
+ le32_to_cpu(ldtentry->index);
+ }
  DT_PUTPAGE(nmp);
  }
  }
--
2.43.0

--

Pedro Demarchi Gomes

[syzbot]

> #syz test

This crash does not have a reproducer. I cannot test it.

[syzbot]

> #syz test on: linux-next

[Jori Koolstra]

#syz test

---
fs/jfs/namei.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..7879c049632b 100644
--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
jfs_err("jfs_rename: dtInsert returned -EIO");
goto out_tx;
}
- if (S_ISDIR(old_ip->i_mode))
+ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
inc_nlink(new_dir);
}
/*
@@ -1244,7 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
goto out_tx;
}
if (S_ISDIR(old_ip->i_mode)) {
- drop_nlink(old_dir);
+ if (new_ip || old_dir != new_dir)
+ drop_nlink(old_dir);
+
if (old_dir != new_dir) {
/*
* Change inode number of parent for moved directory
--
2.51.0

[Jori Koolstra]

#syz test

---
fs/jfs/namei.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
index 65a218eba8fa..37cd16a423c5 100644

--- a/fs/jfs/namei.c
+++ b/fs/jfs/namei.c
@@ -1228,7 +1228,7 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
jfs_err("jfs_rename: dtInsert returned -EIO");
goto out_tx;
}
- if (S_ISDIR(old_ip->i_mode))
+ if (S_ISDIR(old_ip->i_mode) && old_dir != new_dir)
inc_nlink(new_dir);
}
/*

@@ -1244,8 +1244,9 @@ static int jfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,

goto out_tx;
}
if (S_ISDIR(old_ip->i_mode)) {
- drop_nlink(old_dir);

if (old_dir != new_dir) {
+ drop_nlink(old_dir);
+

/*
* Change inode number of parent for moved directory

*/
--
2.51.0

[Jori Koolstra]

#syz test

---
fs/minix/namei.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..86779a6ec1a7 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -224,7 +224,7 @@ static int minix_rename(struct mnt_idmap *idmap,
err = minix_add_link(new_dentry, old_inode);
if (err)
goto out_dir;
- if (dir_de)
+ if (dir_de && old_dir != new_dir)
inode_inc_link_count(new_dir);
}
@@ -236,7 +236,7 @@ static int minix_rename(struct mnt_idmap *idmap,
if (dir_de) {
err = minix_set_link(dir_de, dir_folio, new_dir);
- if (!err)
+ if (!err && (new_inode || old_dir != new_dir))
inode_dec_link_count(old_dir);
}
out_dir:
--
2.51.0

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:

checking file fs/minix/namei.c
patch: **** malformed patch at line 8: @@ -236,7 +236,7 @@ static int minix_rename(struct mnt_idmap *idmap,




Tested on:

commit: 3a866087 Linux 6.18-rc1
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=28cc6f051378bb16
dashboard link: https://syzkaller.appspot.com/bug?extid=a65e824272c5f741247d
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=12089542580000

[Jori Koolstra]

#syz test

---
fs/minix/inode.c | 14 ++++++++++++++
fs/minix/namei.c | 22 ++++++++++++++--------
2 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index f007e389d5d2..e27907fc9bf2 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -517,6 +517,13 @@ static struct inode *V1_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
@@ -555,6 +562,13 @@ static struct inode *V2_minix_iget(struct inode *inode)
iget_failed(inode);
return ERR_PTR(-ESTALE);
}
+ if (S_ISDIR(raw_inode->i_mode) && raw_inode->i_nlinks == 1) {
+ printk("MINIX-fs: directory inode (%lu) has single i_nlink\n",
+ inode->i_ino);
+ brelse(bh);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
+ }
inode->i_mode = raw_inode->i_mode;
i_uid_write(inode, raw_inode->i_uid);
i_gid_write(inode, raw_inode->i_gid);
diff --git a/fs/minix/namei.c b/fs/minix/namei.c
index 8938536d8d3c..8297ee6651a1 100644
--- a/fs/minix/namei.c
+++ b/fs/minix/namei.c
@@ -161,15 +161,21 @@ static int minix_unlink(struct inode * dir, struct dentry *dentry)
static int minix_rmdir(struct inode * dir, struct dentry *dentry)
{
struct inode * inode = d_inode(dentry);
- int err = -ENOTEMPTY;
-
- if (minix_empty_dir(inode)) {
- err = minix_unlink(dir, dentry);
- if (!err) {
- inode_dec_link_count(dir);
- inode_dec_link_count(inode);
- }
+ int err = -EIO;
+
+ if (dir->i_nlink <= 2)
+ goto out;
+
+ err = -ENOTEMPTY;
+ if (!minix_empty_dir(inode))
+ goto out;
+
+ err = minix_unlink(dir, dentry);
+ if (!err) {
+ inode_dec_link_count(dir);
+ inode_dec_link_count(inode);
}
+out:
return err;
}

--
2.51.0

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+4e4972...@syzkaller.appspotmail.com
Tested-by: syzbot+4e4972...@syzkaller.appspotmail.com

Tested on:

commit: 3a866087 Linux 6.18-rc1
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=16c7e52f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=69c57c2b3206cecb
dashboard link: https://syzkaller.appspot.com/bug?extid=4e49728ec1cbaf3b91d2
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=145a5dcd980000

Note: testing is done by a robot and is best-effort only.

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in minix_rename

------------[ cut here ]------------
WARNING: CPU: 1 PID: 6502 at fs/inode.c:417 drop_nlink+0xc5/0x110 fs/inode.c:417
Modules linked in:
CPU: 1 UID: 0 PID: 6502 Comm: syz.1.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:drop_nlink+0xc5/0x110 fs/inode.c:417
Code: 70 07 00 00 be 08 00 00 00 e8 57 df e7 ff f0 48 ff 83 70 07 00 00 5b 41 5c 41 5e 41 5f 5d e9 92 ba f1 08 cc e8 9c d7 82 ff 90 <0f> 0b 90 eb 81 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 5b ff ff ff
RSP: 0018:ffffc90003cefa30 EFLAGS: 00010293
RAX: ffffffff823cc9d4 RBX: ffff8880560b0fe8 RCX: ffff888058c0dac0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8f5a6577 R09: 1ffffffff1eb4cae
R10: dffffc0000000000 R11: fffffbfff1eb4caf R12: 1ffff1100ac16206
R13: 0000000000000000 R14: ffff8880560b1030 R15: dffffc0000000000
FS: 00007fc01f0c26c0(0000) GS:ffff8881264ca000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc01f0c1f98 CR3: 0000000032b16000 CR4: 00000000003526f0
Call Trace:
<TASK>
inode_dec_link_count include/linux/fs.h:2655 [inline]
minix_rename+0x3cf/0x700 fs/minix/namei.c:228
vfs_rename+0xb34/0xe80 fs/namei.c:5216
do_renameat2+0x6a2/0xa50 fs/namei.c:5364
__do_sys_rename fs/namei.c:5411 [inline]
__se_sys_rename fs/namei.c:5409 [inline]
__x64_sys_rename+0x82/0x90 fs/namei.c:5409
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc01e18e929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fc01f0c2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000052
RAX: ffffffffffffffda RBX: 00007fc01e3b6080 RCX: 00007fc01e18e929
RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000200000001980
RBP: 00007fc01e210b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fc01e3b6080 R15: 00007ffc5451e3e8
</TASK>

Tested on:

commit: 3a866087 Linux 6.18-rc1
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=17642c58580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4dacb8e711c7e98e
dashboard link: https://syzkaller.appspot.com/bug?extid=a65e824272c5f741247d

compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=126705e2580000

[Nikola Ivanov]

#syz test

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+e7be6b...@syzkaller.appspotmail.com
Tested-by: syzbot+e7be6b...@syzkaller.appspotmail.com

Tested on:

commit: 6548d364 Merge tag 'cgroup-for-6.18-rc2-fixes' of git:..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=135943cd980000
kernel config: https://syzkaller.appspot.com/x/.config?x=308983f9c02338e8
dashboard link: https://syzkaller.appspot.com/bug?extid=e7be6bf3e45b7b463bfa

compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=10a77de2580000

[Bartłomiej Kubik]

#syz test

[Jori Koolstra]

#syz test

diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index 0ab83bb7bbdf..07dd01c79ca2 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -170,8 +170,8 @@ static void dtGetKey(dtpage_t * p, int i, struct component_name * key,
static int ciGetLeafPrefixKey(dtpage_t * lp, int li, dtpage_t * rp,
int ri, struct component_name * key, int flag);

-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
- ddata_t * data, struct dt_lock **);
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+ ddata_t * data, struct dt_lock **);

static void dtMoveEntry(dtpage_t * sp, int si, dtpage_t * dp,
struct dt_lock ** sdtlock, struct dt_lock ** ddtlock,
@@ -891,7 +891,8 @@ int dtInsert(tid_t tid, struct inode *ip,
lv->length = 1;
dtlck->index++;

- dtInsertEntry(p, index, name, &data, &dtlck);
+ if (!(rc = dtInsertEntry(p, index, name, &data, &dtlck)))
+ return rc;

/* linelock stbl of non-root leaf page */
if (!(p->header.flag & BT_ROOT)) {
@@ -3627,7 +3628,7 @@ static void dtGetKey(dtpage_t * p, int i, /* entry index */
*
* return: entry slot index
*/
-static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
+static int dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
ddata_t * data, struct dt_lock ** dtlock)
{
struct dtslot *h, *t;
@@ -3649,6 +3650,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,

/* allocate a free slot */
hsi = fsi = p->header.freelist;
+ if (fsi >= p->header.maxslot) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
h = &p->slot[fsi];
p->header.freelist = h->next;
--p->header.freecnt;
@@ -3697,6 +3702,10 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,
while (klen) {
/* get free slot */
fsi = p->header.freelist;
+ if (fsi >= p->header.maxslot) {
+ jfs_err("Encountered corrupted dtpage before insert");
+ return -EIO;
+ }
t = &p->slot[fsi];
p->header.freelist = t->next;
--p->header.freecnt;
@@ -3774,6 +3783,8 @@ static void dtInsertEntry(dtpage_t * p, int index, struct component_name * key,

/* advance next available entry index of stbl */
++p->header.nextindex;
+
+ return 0;
}

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+cd7590...@syzkaller.appspotmail.com
Tested-by: syzbot+cd7590...@syzkaller.appspotmail.com

Tested on:

commit: fd575722 Merge tag 'sched_ext-for-6.18-rc3-fixes' of g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10aa832f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=41ad820f608cb833
dashboard link: https://syzkaller.appspot.com/bug?extid=cd7590567cc388f064f3

compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=1749ef34580000