For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] gfs2: add debug printk to trace existing entry in gfs2_create_inode
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


Add a debug printk when gfs2_dir_search finds an existing entry in
gfs2_create_inode. This helps confirm whether the rwsem unlock WARNING
in filename_symlinkat is caused by gfs2_create_inode returning false
success (0) when file is NULL and an existing entry is found on a
corrupted GFS2 image.

The printk logs the directory inode, creation mode, file pointer, found
inode, and rwsem owner at the point where the existing entry is
detected.

This is a temporary diagnostic patch and should be reverted once the
root cause is confirmed.

Reported-by: syzbot+2ed46b6b748df855347f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2ed46b6b748df855347f
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
 fs/gfs2/inode.c |  3 +++
 fs/namei.c      | 24 ++++++++++++++++++++++--
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 8344040ecaf7..e38dafea198c 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -738,6 +738,9 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry,
 	inode = gfs2_dir_search(dir, &dentry->d_name, !S_ISREG(mode) || excl);
 	error = PTR_ERR(inode);
 	if (!IS_ERR(inode)) {
+		pr_warn("DEBUG GFS2: gfs2_create_inode found existing entry! dir=%px mode=%o file=%px inode=%px S_ISDIR=%d rwsem owner=%px current=%px\n",
+			dir, mode, file, inode, S_ISDIR(inode->i_mode),
+			READ_ONCE(dir->i_rwsem.owner), current);
 		if (S_ISDIR(inode->i_mode)) {
 			iput(inode);
 			inode = NULL;
diff --git a/fs/namei.c b/fs/namei.c
index 58f715f7657e..caa2bf7c3401 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2944,6 +2944,11 @@ struct dentry *start_dirop(struct dentry *parent, struct qstr *name,
 void end_dirop(struct dentry *de)
 {
 	if (!IS_ERR(de)) {
+		struct inode *dir = d_inode(de->d_parent);
+		pr_warn("DEBUG: end_dirop: de=%px parent=%px inode=%px rwsem count=%ld owner=%px current=%px\n",
+			de, de->d_parent, dir,
+			atomic_long_read(&dir->i_rwsem.count),
+			READ_ONCE(dir->i_rwsem.owner), current);
 		inode_unlock(de->d_parent->d_inode);
 		dput(de);
 	}
@@ -4922,7 +4927,9 @@ static struct dentry *filename_create(int dfd, struct filename *name,
 	dentry = start_dirop(path->dentry, &last, reval_flag | create_flags);
 	if (IS_ERR(dentry))
 		goto out_drop_write;
-
+	pr_warn("DEBUG: after start_dirop: dentry=%px parent=%px parent_inode=%px rwsem owner=%px current=%px\n",
+		dentry, dentry->d_parent, d_inode(dentry->d_parent),
+		(void *)atomic_long_read(&d_inode(dentry->d_parent)->i_rwsem.count), current);
 	if (unlikely(error))
 		goto fail;
 
@@ -4959,7 +4966,10 @@ EXPORT_SYMBOL(start_creating_path);
  */
 void end_creating_path(const struct path *path, struct dentry *dentry)
 {
-	end_creating(dentry);
+	if (!IS_ERR(dentry)) {
+		inode_unlock(d_inode(path->dentry));
+		dput(dentry);
+	}
 	mnt_drop_write(path->mnt);
 	path_put(path);
 }
@@ -5595,6 +5605,9 @@ int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
 		struct dentry *dentry, const char *oldname,
 		struct delegated_inode *delegated_inode)
 {
+	pr_warn("DEBUG VFS: before symlink: dir=%px sb_type=%s symlink_fn=%ps rwsem owner=%px current=%px\n",
+		dir, dir->i_sb->s_type->name, dir->i_op->symlink,
+		READ_ONCE(dir->i_rwsem.owner), current);
 	int error;
 
 	error = may_create_dentry(idmap, dir, dentry);
@@ -5613,6 +5626,9 @@ int vfs_symlink(struct mnt_idmap *idmap, struct inode *dir,
 		return error;
 
 	error = dir->i_op->symlink(idmap, dir, dentry, oldname);
+	pr_warn("DEBUG VFS: after symlink: dir=%px sb_type=%s error=%d rwsem owner=%px current=%px\n",
+		dir, dir->i_sb->s_type->name, error,
+		READ_ONCE(dir->i_rwsem.owner), current);
 	if (!error)
 		fsnotify_create(dir, dentry);
 	return error;
@@ -5639,6 +5655,10 @@ int filename_symlinkat(struct filename *from, int newdfd, struct filename *to)
 	if (!error)
 		error = vfs_symlink(mnt_idmap(path.mnt), path.dentry->d_inode,
 				    dentry, from->name, &delegated_inode);
+	pr_warn("DEBUG: after vfs_symlink: error=%d dentry=%px parent=%px parent_inode=%px rwsem owner=%px path_dentry=%px path_inode=%px\n",
+		error, dentry, dentry->d_parent, d_inode(dentry->d_parent),
+		(void *)atomic_long_read(&d_inode(path.dentry)->i_rwsem.count),
+		path.dentry, d_inode(path.dentry));
 	end_creating_path(&path, dentry);
 	if (is_delegated(&delegated_inode)) {
 		error = break_deleg_wait(&delegated_inode);
-- 
2.43.0