Re: [syzbot] [gfs2?] WARNING in rgblk_free (2)

On 12/01/2026 15:49, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    54e82e93ca93 Merge tag 'core_urgent_for_v6.19_rc4' of git:..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1216e5fa580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=513255d80ab78f2b
> dashboard link: https://syzkaller.appspot.com/bug?extid=3e2c95229d1ab81a0bfd
> compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11b4bc3a580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1015b922580000
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-54e82e93.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/f3befb5f53a4/vmlinux-54e82e93.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/92820ca1dbd8/bzImage-54e82e93.xz
> mounted in repro: https://storage.googleapis.com/syzbot-assets/074df7c33445/mount_0.gz
>   fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=10da39fc580000)
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
> 
> gfs2: fsid=syz:syz.0: first mount done, others may mount
> gfs2: fsid=syz:syz.0: found 1 quota changes
> ------------[ cut here ]------------
> WARNING: fs/gfs2/rgrp.c:2267 at rgblk_free+0x136/0x750 fs/gfs2/rgrp.c:2267, CPU#0: syz.0.17/5483

The test is scribbling on an rindex entry's ri_data0.

#syz test

--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -871,11 +871,15 @@ static int rgd_insert(struct gfs2_rgrpd *rgd)
                                                  rd_node);
 
                parent = *newn;
-               if (rgd->rd_addr < cur->rd_addr)
+               if (rgd->rd_addr < cur->rd_addr) {
+                       if (rgd->rd_data0 + rgd->rd_data > cur->rd_addr)
+                               return -EUCLEAN;
                        newn = &((*newn)->rb_left);
-               else if (rgd->rd_addr > cur->rd_addr)
+               } else if (rgd->rd_addr > cur->rd_addr) {
+                       if (rgd->rd_addr < cur->rd_data0)
+                               return -EUCLEAN;
                        newn = &((*newn)->rb_right);
-               else
+               } else
                        return -EEXIST;
        }
 
@@ -944,7 +948,8 @@ static int read_rindex_entry(struct gfs2_inode *ip)
                return 0;
        }
 
-       error = 0; /* someone else read in the rgrp; free it and ignore it */
+       if (error == -EEXIST)
+               error = 0; /* someone else read in the rgrp; free it and ignore it */
 fail_glock:
        gfs2_glock_put(rgd->rd_gl);