For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] gfs2: don't add further folios to a chained bio
Author: kmehltretter@gmail.com

#syz test

diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 6dabe73ad790..a00787df2507 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -514,6 +514,7 @@ int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
 	int ret = 0;
 	struct bio *bio = NULL;
 	struct folio *folio = NULL;
+	bool bio_chained = false;
 	bool done = false;
 	errseq_t since;
 
@@ -537,7 +538,8 @@ int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
 				off = 0;
 			}
 
-			if (bio && (off || block < blocks_submitted + max_blocks)) {
+			if (bio && (off || (!bio_chained &&
+					block < blocks_submitted + max_blocks))) {
 				sector_t sector = dblock << sdp->sd_fsb2bb_shift;
 
 				if (bio_end_sector(bio) == sector) {
@@ -550,6 +552,7 @@ int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
 
 					bio = gfs2_chain_bio(bio, blocks, sector,
 							     REQ_OP_READ);
+					bio_chained = true;
 					goto add_block_to_new_bio;
 				}
 			}
@@ -561,6 +564,7 @@ int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
 
 			bio = gfs2_log_alloc_bio(sdp, dblock, gfs2_end_log_read,
 						 REQ_OP_READ);
+			bio_chained = false;
 add_block_to_new_bio:
 			bio_add_folio_nofail(bio, folio, bsize, off);
 block_added: