On 11/14/24 12:38 PM, Dmitry Antipov wrote: > Syzbot has reported the following BUG: > > kernel BUG at fs/ocfs2/uptodate.c:509! > ... > Call Trace: > <TASK> > ? __die_body+0x5f/0xb0 > ? die+0x9e/0xc0 > ? do_trap+0x15a/0x3a0 > ? ocfs2_set_new_buffer_uptodate+0x145/0x160 > ? do_error_trap+0x1dc/0x2c0 > ? ocfs2_set_new_buffer_uptodate+0x145/0x160 > ? __pfx_do_error_trap+0x10/0x10 > ? handle_invalid_op+0x34/0x40 > ? ocfs2_set_new_buffer_uptodate+0x145/0x160 > ? exc_invalid_op+0x38/0x50 > ? asm_exc_invalid_op+0x1a/0x20 > ? ocfs2_set_new_buffer_uptodate+0x2e/0x160 > ? ocfs2_set_new_buffer_uptodate+0x144/0x160 > ? ocfs2_set_new_buffer_uptodate+0x145/0x160 > ocfs2_group_add+0x39f/0x15a0 > ? __pfx_ocfs2_group_add+0x10/0x10 > ? __pfx_lock_acquire+0x10/0x10 > ? mnt_get_write_access+0x68/0x2b0 > ? __pfx_lock_release+0x10/0x10 > ? rcu_read_lock_any_held+0xb7/0x160 > ? __pfx_rcu_read_lock_any_held+0x10/0x10 > ? smack_log+0x123/0x540 > ? mnt_get_write_access+0x68/0x2b0 > ? mnt_get_write_access+0x68/0x2b0 > ? mnt_get_write_access+0x226/0x2b0 > ocfs2_ioctl+0x65e/0x7d0 > ? __pfx_ocfs2_ioctl+0x10/0x10 > ? smack_file_ioctl+0x29e/0x3a0 > ? __pfx_smack_file_ioctl+0x10/0x10 > ? lockdep_hardirqs_on_prepare+0x43d/0x780 > ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 > ? __pfx_ocfs2_ioctl+0x10/0x10 > __se_sys_ioctl+0xfb/0x170 > do_syscall_64+0xf3/0x230 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > ... > </TASK> > > When 'ioctl(OCFS2_IOC_GROUP_ADD, ...)' has failed for the particular > inode in 'ocfs2_verify_group_and_input()', corresponding buffer head > remains cached and subsequent call to the same 'ioctl()' for the same > inode issues the BUG() in 'ocfs2_set_new_buffer_uptodate()' (trying > to cache the same buffer head of that inode). Fix this by uncaching > the buffer head with 'ocfs2_remove_from_cache()' on error path in > 'ocfs2_group_add()'. > > Reported-by: syzbot+453873f1588c2d75b447@xxxxxxxxxxxxxxxxxxxxxxxxx > Closes: https://syzkaller.appspot.com/bug?extid=453873f1588c2d75b447 > Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem") Seems the blame commit id should be: 7909f2bf8353 ("[PATCH 2/2] ocfs2: Implement group add for online resize") Cc: stable@xxxxxxxxxxxxxxx Reviewed-by: Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> > Signed-off-by: Dmitry Antipov <dmantipov@xxxxxxxxx> > --- > fs/ocfs2/resize.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/fs/ocfs2/resize.c b/fs/ocfs2/resize.c > index c4a4016d3866..b0733c08ed13 100644 > --- a/fs/ocfs2/resize.c > +++ b/fs/ocfs2/resize.c > @@ -574,6 +574,8 @@ int ocfs2_group_add(struct inode *inode, struct ocfs2_new_group_input *input) > ocfs2_commit_trans(osb, handle); > > out_free_group_bh: > + if (ret < 0) > + ocfs2_remove_from_cache(INODE_CACHE(inode), group_bh); > brelse(group_bh); > > out_unlock:
