linux-kernel - Re: [syzbot] [gfs2?] memory leak in gfs2_trans

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <690fcb36.a70a0220.22f260.008e.GAE@google.com>
Date: Sat, 08 Nov 2025 14:59:02 -0800
From: syzbot <syzbot+63ba84f14f62e61a5fd0@...kaller.appspotmail.com>
To: agruenba@...hat.com, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [gfs2?] memory leak in gfs2_trans_begin (2)

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in do_xmote

gfs2: fsid=syz:syz.0:  H: s:EX f:nW e:0 p:7821 [syz.6.189] gfs2_iomap_begin_write fs/gfs2/bmap.c:1040 [inline]
gfs2: fsid=syz:syz.0:  H: s:EX f:nW e:0 p:7821 [syz.6.189] gfs2_iomap_begin+0x3e6/0x8a0 fs/gfs2/bmap.c:1133
gfs2: fsid=syz:syz.0:  R: n:8336 f:80000000 b:70/70 i:7 q:0 r:0 e:7055
------------[ cut here ]------------
kernel BUG at fs/gfs2/glock.c:674!
Oops: invalid opcode: 0000 [#1] SMP PTI
CPU: 0 UID: 0 PID: 7389 Comm: kworker/0:2H Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: gfs2-glock/syz:syz glock_work_func
RIP: 0010:do_xmote+0x33d/0x360 fs/gfs2/glock.c:674
Code: 03 00 e9 cf fd ff ff e8 c1 85 09 ff 83 43 24 01 e9 53 ff ff ff e8 b3 85 09 ff ba 01 00 00 00 48 89 de 31 ff e8 f4 c9 ff ff 90 <0f> 0b e8 9c 85 09 ff ba 01 00 00 00 48 89 de 31 ff e8 dd c9 ff ff
RSP: 0018:ffffc9000a073d88 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88812e8a7728 RCX: ffffffff825ac696
RDX: ffff888102c61180 RSI: ffffffff8257e401 RDI: ffff88812d388afc
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 205d393833375420 R12: ffff8881087d0000
R13: 0000000000000001 R14: ffffffff857d0580 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8881b25c4000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000c1b000 CR3: 0000000119f7c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 run_queue+0x21a/0x310 fs/gfs2/glock.c:793
 glock_work_func+0xac/0x280 fs/gfs2/glock.c:1002
 process_one_work+0x26b/0x620 kernel/workqueue.c:3263
 process_scheduled_works kernel/workqueue.c:3346 [inline]
 worker_thread+0x2c4/0x4f0 kernel/workqueue.c:3427
 kthread+0x15b/0x310 kernel/kthread.c:463
 ret_from_fork+0x210/0x240 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:do_xmote+0x33d/0x360 fs/gfs2/glock.c:674
Code: 03 00 e9 cf fd ff ff e8 c1 85 09 ff 83 43 24 01 e9 53 ff ff ff e8 b3 85 09 ff ba 01 00 00 00 48 89 de 31 ff e8 f4 c9 ff ff 90 <0f> 0b e8 9c 85 09 ff ba 01 00 00 00 48 89 de 31 ff e8 dd c9 ff ff
RSP: 0018:ffffc9000a073d88 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88812e8a7728 RCX: ffffffff825ac696
RDX: ffff888102c61180 RSI: ffffffff8257e401 RDI: ffff88812d388afc
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 205d393833375420 R12: ffff8881087d0000
R13: 0000000000000001 R14: ffffffff857d0580 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8881b25c4000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000c1b000 CR3: 0000000119f7c000 CR4: 00000000003526f0


Tested on:

commit:         17448d78 gfs2: Clean up SDF_JOURNAL_LIVE flag handling
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git withdraw
console output: https://syzkaller.appspot.com/x/log.txt?x=12da8b42580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=63ba84f14f62e61a5fd0
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.