linux-kernel - Re: [syzbot] [exfat?] [ocfs2?] kernel BUG in link_path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAGudoHG-16TCj3+nMseN9RVeybEPm4WTHn2Xqmek6Hc6k+=e0Q@mail.gmail.com>
Date: Thu, 4 Dec 2025 12:58:28 +0100
From: Mateusz Guzik <mjguzik@...il.com>
To: syzbot <syzbot+d222f4b7129379c3d5bc@...kaller.appspotmail.com>
Cc: brauner@...nel.org, jack@...e.cz, jlbec@...lplan.org, 
	joseph.qi@...ux.alibaba.com, linkinjeon@...nel.org, 
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org, mark@...heh.com, 
	ocfs2-devel@...ts.linux.dev, sj1557.seo@...sung.com, 
	syzkaller-bugs@...glegroups.com, viro@...iv.linux.org.uk
Subject: Re: [syzbot] [exfat?] [ocfs2?] kernel BUG in link_path_walk

On Thu, Dec 4, 2025 at 12:56 PM syzbot
<syzbot+d222f4b7129379c3d5bc@...kaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> kernel BUG in link_path_walk
>
> VFS_BUG_ON_INODE(d_can_lookup(_dentry) && !S_ISDIR(_dentry->d_inode->i_mode)) encountered for inode ffff888074eca4f8
> fs ocfs2 mode 100000 opflags 0x2 flags 0x20 state 0x0 count 2

note the patch at hand made sure to avoid transient states by taking a
lock on the dentry:
+       struct dentry *_dentry = nd->path.dentry;
+       struct inode *_inode = READ_ONCE(_dentry->d_inode);
+       if (!d_can_lookup(_dentry) || !_inode || !S_ISDIR(_inode->i_mode)) {
+               spin_lock(&_dentry->d_lock);
+               VFS_BUG_ON_INODE(d_can_lookup(_dentry) &&
!S_ISDIR(_dentry->d_inode->i_mode), _dentry->d_inode);
+               spin_unlock(&_dentry->d_lock);
+       }

So the state *is* indeed bogus and this is most likely something ocfs2-internal.

I'm buggering off this report.