linux-kernel - [PATCH] gfs2: prevent sysfs duplicate name warning on mount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260109090451.1464893-2-wangjinchao600@gmail.com>
Date: Fri,  9 Jan 2026 17:04:45 +0800
From: Jinchao Wang <wangjinchao600@...il.com>
To: Andreas Gruenbacher <agruenba@...hat.com>,
	gfs2@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Cc: Jinchao Wang <wangjinchao600@...il.com>,
	syzbot+092ef2e75c24d23f33c4@...kaller.appspotmail.com
Subject: [PATCH] gfs2: prevent sysfs duplicate name warning on mount

When mounting a GFS2 filesystem with a locktable name that already
exists in the gfs2_kset, kobject_init_and_add() triggers a WARN()
and a stack trace. This can be reproduced by a user attempting to
mount two different images using the same fsid/locktable name.

Check for the existence of the kobject using kset_find_obj() before
attempting registration. If a collision is detected, return -EBUSY
with an error message instead of allowing the kobject core to
generate a stack dump.

Reported-by: syzbot+092ef2e75c24d23f33c4@...kaller.appspotmail.com
Signed-off-by: Jinchao Wang <wangjinchao600@...il.com>
---
Note: During testing with syzkaller, I noticed that after this fix
prevents the sysfs WARN, a secondary "withdraw" warning still occurs
in the GFS2 cleanup path. I believe this is a separate issue.

 fs/gfs2/sys.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index 7051db9dbea0..06035e3d5829 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -720,6 +720,21 @@ int gfs2_sys_fs_add(struct gfs2_sbd *sdp)
 	sprintf(ro, "RDONLY=%d", sb_rdonly(sb));
 	sprintf(spectator, "SPECTATOR=%d", sdp->sd_args.ar_spectator ? 1 : 0);
 
+	/*
+	 * Check for existence because kobject_init_and_add() warns
+	 * with a dump_stack() if the name exists
+	 */
+	if (gfs2_kset) {
+		struct kobject *existing = kset_find_obj(gfs2_kset, sdp->sd_table_name);
+
+		if (existing) {
+			kobject_put(existing);
+			fs_err(sdp, "fsid %s: sysfs entry already exists\n",
+			       sdp->sd_table_name);
+				return -EBUSY;
+			}
+	}
+
 	init_completion(&sdp->sd_kobj_unregister);
 	sdp->sd_kobj.kset = gfs2_kset;
 	error = kobject_init_and_add(&sdp->sd_kobj, &gfs2_ktype, NULL,
-- 
2.43.0