linux-kernel - Re: [syzbot] [block?] general protection fault in rtlock_slowlock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251108074339.9025-1-hdanton@sina.com>
Date: Sat,  8 Nov 2025 15:43:30 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+08df3e4c9b304b37cb04@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [block?] general protection fault in rtlock_slowlock_locked

> Date: Fri, 07 Nov 2025 20:01:26 -0800
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    da32d155f4a8 Merge tag 'gpio-fixes-for-v6.18-rc5' of git:/..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=118faa58580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=41ad820f608cb833
> dashboard link: https://syzkaller.appspot.com/bug?extid=08df3e4c9b304b37cb04
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=103d4412580000

#syz test

--- x/fs/jfs/jfs_logmgr.c
+++ y/fs/jfs/jfs_logmgr.c
@@ -149,6 +149,7 @@ do {						\
 				 * of log page
 				 */
 #define lbmDIRECT	0x0100
+#define lbmInflight	0x0200
 
 /*
  * Global list of active external journals
@@ -1861,6 +1862,8 @@ static void lbmLogShutdown(struct jfs_lo
 	while (lbuf) {
 		struct lbuf *next = lbuf->l_freelist;
 		__free_page(lbuf->l_page);
+		while (lbuf->l_flag & lbmInflight)
+			schedule_timeout_idle(HZ);
 		kfree(lbuf);
 		lbuf = next;
 	}
@@ -2130,6 +2133,7 @@ static void lbmStartIO(struct lbuf * bp)
 		bio->bi_iter.bi_size = 0;
 		lbmIODone(bio);
 	} else {
+		bp->l_flag |= lbmInflight;
 		submit_bio(bio);
 		INCREMENT(lmStat.submitted);
 	}
@@ -2226,6 +2230,7 @@ static void lbmIODone(struct bio *bio)
 	if (bp->l_flag & lbmDIRECT) {
 		LCACHE_WAKEUP(&bp->l_ioevent);
 		LCACHE_UNLOCK(flags);
+		bp->l_flag &= ~lbmInflight;
 		return;
 	}
 
@@ -2305,6 +2310,7 @@ static void lbmIODone(struct bio *bio)
 
 		LCACHE_UNLOCK(flags);	/* unlock+enable */
 	}
+	bp->l_flag &= ~lbmInflight;
 }
 
 int jfsIOWait(void *arg)
--