When mounting a GFS2 filesystem with a locktable name that already
exists in the gfs2_kset, kobject_init_and_add() triggers a WARN()
and a stack trace. This can be reproduced by a user attempting to
mount two different images using the same fsid/locktable name.

Check for the existence of the kobject using kset_find_obj() before
attempting registration. If a collision is detected, return -EBUSY
with an error message instead of allowing the kobject core to
generate a stack dump.

Reported-by: syzbot+092ef2e75c24d23f33c4@syzkaller.appspotmail.com
Signed-off-by: Jinchao Wang <wangjinchao600@gmail.com>
---
Note: During testing with syzkaller, I noticed that after this fix
prevents the sysfs WARN, a secondary "withdraw" warning still occurs
in the GFS2 cleanup path. I believe this is a separate issue.

 fs/gfs2/sys.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index 7051db9dbea0..06035e3d5829 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -720,6 +720,21 @@ int gfs2_sys_fs_add(struct gfs2_sbd *sdp)
 	sprintf(ro, "RDONLY=%d", sb_rdonly(sb));
 	sprintf(spectator, "SPECTATOR=%d", sdp->sd_args.ar_spectator ? 1 : 0);
 
+	/*
+	 * Check for existence because kobject_init_and_add() warns
+	 * with a dump_stack() if the name exists
+	 */
+	if (gfs2_kset) {
+		struct kobject *existing = kset_find_obj(gfs2_kset, sdp->sd_table_name);
+
+		if (existing) {
+			kobject_put(existing);
+			fs_err(sdp, "fsid %s: sysfs entry already exists\n",
+			       sdp->sd_table_name);
+				return -EBUSY;
+			}
+	}
+
 	init_completion(&sdp->sd_kobj_unregister);
 	sdp->sd_kobj.kset = gfs2_kset;
 	error = kobject_init_and_add(&sdp->sd_kobj, &gfs2_ktype, NULL,
-- 
2.43.0