linux-kernel - Re: [syzbot] [gfs2?] BUG: corrupted list in gfs2_fill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun,  2 Jun 2024 17:50:24 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+d34c2a269ed512c531b0@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [gfs2?] BUG: corrupted list in gfs2_fill_super

On Sat, 01 Jun 2024 23:20:21 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    9d99040b1bc8 Add linux-next specific files for 20240529
> git tree:       linux-next
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=100817e6980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git  master

--- x/fs/gfs2/ops_fstype.c
+++ y/fs/gfs2/ops_fstype.c
@@ -1137,6 +1137,7 @@ static int gfs2_fill_super(struct super_
 	struct gfs2_sbd *sdp;
 	struct gfs2_holder mount_gh;
 	int error;
+	int destroyed = 0;
 
 	sdp = init_sbd(sb);
 	if (!sdp) {
@@ -1301,6 +1302,7 @@ fail_locking:
 fail_lm:
 	complete_all(&sdp->sd_journal_ready);
 	gfs2_gl_hash_clear(sdp);
+	destroyed = 1;
 	gfs2_lm_unmount(sdp);
 fail_debug:
 	gfs2_delete_debugfs_file(sdp);
@@ -1308,7 +1310,8 @@ fail_debug:
 fail_delete_wq:
 	destroy_workqueue(sdp->sd_delete_wq);
 fail_glock_wq:
-	destroy_workqueue(sdp->sd_glock_wq);
+	if (!destroyed)
+		destroy_workqueue(sdp->sd_glock_wq);
 fail_free:
 	free_sbd(sdp);
 	sb->s_fs_info = NULL;
--