Received-SPF: pass (google.com: domain of linux-kernel+bounces-198188-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
From: Hillf Danton <hdanton@sina.com>
To: syzbot <syzbot+d34c2a269ed512c531b0@syzkaller.appspotmail.com>
Cc: linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [gfs2?] BUG: corrupted list in gfs2_fill_super
Date: Sun,  2 Jun 2024 17:50:24 +0800
Message-Id: <20240602095024.3791-1-hdanton@sina.com>
In-Reply-To: <0000000000002501960619e2366b@google.com>
References: 
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

On Sat, 01 Jun 2024 23:20:21 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    9d99040b1bc8 Add linux-next specific files for 20240529
> git tree:       linux-next
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=100817e6980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git  master

--- x/fs/gfs2/ops_fstype.c
+++ y/fs/gfs2/ops_fstype.c
@@ -1137,6 +1137,7 @@ static int gfs2_fill_super(struct super_
 	struct gfs2_sbd *sdp;
 	struct gfs2_holder mount_gh;
 	int error;
+	int destroyed = 0;
 
 	sdp = init_sbd(sb);
 	if (!sdp) {
@@ -1301,6 +1302,7 @@ fail_locking:
 fail_lm:
 	complete_all(&sdp->sd_journal_ready);
 	gfs2_gl_hash_clear(sdp);
+	destroyed = 1;
 	gfs2_lm_unmount(sdp);
 fail_debug:
 	gfs2_delete_debugfs_file(sdp);
@@ -1308,7 +1310,8 @@ fail_debug:
 fail_delete_wq:
 	destroy_workqueue(sdp->sd_delete_wq);
 fail_glock_wq:
-	destroy_workqueue(sdp->sd_glock_wq);
+	if (!destroyed)
+		destroy_workqueue(sdp->sd_glock_wq);
 fail_free:
 	free_sbd(sdp);
 	sb->s_fs_info = NULL;
--