>> >> HEAD commit: fc033cf25e612e840e545f8d5ad2edd6ba613ed5 >> git tree: upstream >> Console output: https://drive.google.com/file/d/1-YGytaKuh9M4hI6x27YjsE0vSyRFngf5/view?usp=sharing >> Kernel config: https://drive.google.com/file/d/1n2sLNg-YcIgZqhhQqyMPTDWM_N1Pqz73/view?usp=sharing >> C reproducer: / >> Syzlang reproducer: / >> >> We found an issue in the __bh_read function at line 3086, where a >> slab-out-of-bounds error was reported. While the BUG_ON check ensures >> that bh is locked, I suspect it’s possible that bh might have been >> released prior to the call to __bh_read. This could result in accessing >> invalid memory, ultimately triggering the reported issue. > > Well, most likely the bh pointer has already been corrupted. Again, nobody > is likely to be able to debug this unless we have a reliable way to > reproduce this problem. Hi, Jan. We have obtained the reproducers of this issue for multi round testing. But, the crash location seems to vary. The crash log shows a possible deadlock occurring in “gfs2_trans_begin" in /fs/gfs2/trans.c, with duplicate registrations happening when attempting to register a "kobject." The links of these related files are at below: Log: https://drive.google.com/file/d/1MaRMA6WKz4e7fuDw-Yrb-Zw6GhXSIFsr/view?usp=sharing C repro: https://drive.google.com/file/d/1VdDFjW2XNDhxe9yjb01qLblDxJpQyxzh/view?usp=sharing Syz repro: https://drive.google.com/file/d/1sLGQnJb2-DCA6EsLia8SyOte0zKnlbF7/view?usp=sharing ——— Thanks, Kun Hu
