For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] gfs2: replace WARN_ON_ONCE with error message in
Author: tristmd@gmail.com
From: Tristan Madani <tristan@talencesecurity.com>
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
rgblk_free
rgblk_free() uses WARN_ON_ONCE to report when gfs2_rbm_from_block()
fails to map the starting block to a valid resource group position:
if (WARN_ON_ONCE(gfs2_rbm_from_block(&rbm, bstart)))
return;
On crafted GFS2 images with corrupted resource group metadata, this
WARNING fires reliably, producing a full kernel stack trace on every
mount attempt. The function already returns early on failure, so the
error is handled -- only the WARNING itself is problematic.
Replace WARN_ON_ONCE with an fs_warn() message that logs the invalid
block number without triggering a kernel WARNING.
Reported-by: syzbot+3e2c95229d1ab81a0bfd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3e2c95229d1ab81a0bfd
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/gfs2/rgrp.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index XXXXXXX..XXXXXXX 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -2265,7 +2265,10 @@ static void rgblk_free(struct gfs2_sbd *sdp, struct gfs2_rgrpd *rgd,
struct gfs2_bitmap *bi, *bi_prev = NULL;
rbm.rgd = rgd;
- if (WARN_ON_ONCE(gfs2_rbm_from_block(&rbm, bstart)))
+ if (gfs2_rbm_from_block(&rbm, bstart)) {
+ fs_warn(sdp, "rgblk_free: block %llu outside rgrp\n",
+ (unsigned long long)bstart);
return;
+ }
while (blen--) {
bi = rbm_bi(&rbm);
--
2.43.0