Hello! On Wed 08-01-25 12:08:56, Kun Hu wrote: > >> HEAD commit: fc033cf25e612e840e545f8d5ad2edd6ba613ed5 > >> git tree: upstream > >> Console output: https://drive.google.com/file/d/1-YGytaKuh9M4hI6x27YjsE0vSyRFngf5/view?usp=sharing > >> Kernel config: https://drive.google.com/file/d/1n2sLNg-YcIgZqhhQqyMPTDWM_N1Pqz73/view?usp=sharing > >> C reproducer: / > >> Syzlang reproducer: / > >> > >> We found an issue in the __bh_read function at line 3086, where a > >> slab-out-of-bounds error was reported. While the BUG_ON check ensures > >> that bh is locked, I suspect it’s possible that bh might have been > >> released prior to the call to __bh_read. This could result in accessing > >> invalid memory, ultimately triggering the reported issue. > > > > Well, most likely the bh pointer has already been corrupted. Again, nobody > > is likely to be able to debug this unless we have a reliable way to > > reproduce this problem. > > We have obtained the reproducers of this issue for multi round testing. > But, the crash location seems to vary. The crash log shows a possible > deadlock occurring in “gfs2_trans_begin" in /fs/gfs2/trans.c, with > duplicate registrations happening when attempting to register a > "kobject." OK. Checking the syzlang reproducer the same comment as for other filesystem bugs applies - please run with CONFIG_BLK_DEV_WRITE_MOUNTED disabled to rule out corruption of a filesystem while it is mounted. Honza -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR
