[BUG] gfs2: WARNING in gfs2_check_blk_type

[BUG] gfs2: WARNING in gfs2_check_blk_type

[CJ]

Hi,


I am reporting a WARNING in the gfs2 block-type check, triggered by a syzkaller
reproducer that mounts a crafted gfs2 image.  The issue is reproducible with HEAD
commit cee9395acd8043be0644b25c34bfa86623f2b935 (v7.3-rc1, Linux 7.3.0-rc1).


The reproducer mounts a crafted gfs2 filesystem image on a loop device and then
resolves an inode through its file handle, which makes gfs2 look up the resource
group covering the block number encoded in the handle.


The console shows a WARNING at fs/gfs2/rgrp.c:2628 with RIP in
gfs2_check_blk_type, reached from gfs2_inode_lookup and gfs2_fh_to_dentry.  In the
original report the same warning was attributed to the inlined
gfs2_rbm_from_block at rgrp.c:279, which is the range computation inside this
function.


One possible cause is that the block number derived from the file handle and the
resource group bitmap is not validated against the resource group's real extent
before the block type is looked up, so a crafted handle or image makes the check
fail and warn.  This looks like a missing validity check on a computed block
number.  I am reporting the warning and the path as observed.


This appears to be a recurrence of the syzbot issue whose external id is
abcc0873d5857bc36f76.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer: https://pastebin.com/raw/Jw8bZXnU

console output: https://pastebin.com/raw/cC7v6E6b

kernel config: https://pastebin.com/raw/Z9JzbXbM


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian