Re: [syzbot] [gfs2?] kernel BUG in gfs2_quota_cleanup (3)
shaurya <[email protected]>
| Newsgroups | dev.linux.lists.gfs2,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
0001-gfs2-allow-quota-cleanup-when-filesystem-is-withdraw.patch
(text/x-patch, 1.9 KB)
From cb1658e55b1727dcb662f7cb9f287adf46bfe917 Mon Sep 17 00:00:00 2001 From: Shaurya Rane <[email protected]> Date: Sat, 29 Nov 2025 15:38:18 +0530 Subject: [PATCH] gfs2: allow quota cleanup when filesystem is withdrawing gfs2_quota_cleanup() triggers a kernel BUG when called while the journal is still marked live, SDF_NORECOVERY is not set, and the filesystem is in the process of withdrawing. This can occur during filesystem reconfigure operations when a withdraw is triggered during gfs2_make_fs_ro(). The withdraw process clears SDF_JOURNAL_LIVE in signal_our_withdraw(), but there's a race window where gfs2_quota_cleanup() can be reached before this happens during the gfs2_make_fs_ro() -> gfs2_quota_cleanup() call path. Add a check for gfs2_withdrawing_or_withdrawn() to the BUG_ON condition to allow quota cleanup to proceed safely during a withdraw. This is safe because: 1. The withdraw process handles cleanup gracefully 2. gfs2_quota_cleanup() already skips entries with active references 3. The function waits for references to drain via wait_event_timeout() Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=af4d53576692f8956fd6 Fixes: 71733b492200 ("gfs2: fix kernel BUG in gfs2_quota_cleanup") Signed-off-by: Shaurya Rane <[email protected]> --- fs/gfs2/quota.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c index 2298e06797ac..4ae07c6cee98 100644 --- a/fs/gfs2/quota.c +++ b/fs/gfs2/quota.c @@ -1517,7 +1517,8 @@ void gfs2_quota_cleanup(struct gfs2_sbd *sdp) int count; BUG_ON(!test_bit(SDF_NORECOVERY, &sdp->sd_flags) && - test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)); + !gfs2_withdrawing_or_withdrawn(sdp) && + test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)); spin_lock(&qd_lock); list_for_each_entry(qd, &sdp->sd_quota_list, qd_list) { -- 2.34.1