linux-kernel - [PATCH] gfs2: replace BUG_ON with WARN_ON_ONCE in gfs2_quota

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251127193247.17030-1-ssrane_b23@ee.vjti.ac.in>
Date: Fri, 28 Nov 2025 01:02:47 +0530
From: Shaurya Rane <ssrane_b23@...vjti.ac.in>
To: agruenba@...hat.com
Cc: gfs2@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	skhan@...uxfoundation.org,
	linux-kernel-mentees@...ts.linux.dev,
	david.hunter.linux@...il.com,
	khalid@...nel.org,
	Shaurya Rane <ssrane_b23@...vjti.ac.in>,
	syzbot+af4d53576692f8956fd6@...kaller.appspotmail.com
Subject: [PATCH] gfs2: replace BUG_ON with WARN_ON_ONCE in gfs2_quota_cleanup

gfs2_quota_cleanup() triggers a kernel BUG when called while the
journal is still marked live and SDF_NORECOVERY is not set. This
can occur during filesystem withdraw or error recovery paths,
particularly via gfs2_make_fs_ro() during a reconfigure operation.

The BUG_ON was intended to catch unexpected state where quota
cleanup runs while the journal is active. However, the cleanup
code is safe in this scenario because it skips quota entries with
active references and waits for all references to drain via
wait_event_timeout().

Crashing the kernel is unnecessarily harsh for what is a
recoverable situation. Replace the BUG_ON with WARN_ON_ONCE to
flag the unexpected state for debugging while allowing the
cleanup to proceed safely.

Reported-by: syzbot+af4d53576692f8956fd6@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=af4d53576692f8956fd6
Fixes: 71733b492200 ("gfs2: fix kernel BUG in gfs2_quota_cleanup")
Signed-off-by: Shaurya Rane <ssrane_b23@...vjti.ac.in>
---
 fs/gfs2/quota.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 2298e06797ac..13f113d8aaef 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -1516,8 +1516,8 @@ void gfs2_quota_cleanup(struct gfs2_sbd *sdp)
 	LIST_HEAD(dispose);
 	int count;

-	BUG_ON(!test_bit(SDF_NORECOVERY, &sdp->sd_flags) &&
-		test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags));
+	WARN_ON_ONCE(!test_bit(SDF_NORECOVERY, &sdp->sd_flags) &&
+		     test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags));

 	spin_lock(&qd_lock);
 	list_for_each_entry(qd, &sdp->sd_quota_list, qd_list) {
-- 
2.34.1