[BUG] ocfs2: WARNING in ocfs2_journal_toggle_dirty on unmount

[CJ <firefly0158@163.com>]

Hi,


I am reporting a WARNING in the ocfs2 journal teardown path, triggered by a
syzkaller reproducer that mounts a crafted ocfs2 image.  The issue is
reproducible with HEAD commit cee9395acd8043be0644b25c34bfa86623f2b935
(v7.3-rc1, Linux 7.3.0-rc1).


The reproducer mounts a crafted ocfs2 image on a loop device and then unmounts
it.  The mount succeeds; the failure happens during unmount, when
ocfs2_dismount_volume shuts the journal down.


The console shows "WARNING: fs/ocfs2/journal.c:1029 at
ocfs2_journal_toggle_dirty+0x32c/0x3a0", reached from
ocfs2_journal_shutdown and then ocfs2_dismount_volume.  The warning fires while
the teardown is trying to toggle the journal dirty flag on a handle that the
log has already stopped.


On the kernel where this was first reported the same site was a BUG() at
fs/ocfs2/journal.c:973; on v7.3-rc1 it is reported as a WARNING at line 1029
instead, so the invariant still holds but the consequence has been downgraded.
Because the failure class differs between the two reports, I am describing this
as the same invariant rather than claiming a byte-for-byte identical splat.
One possible cause is that the crafted image leaves the on-disk journal
superblock state inconsistent with the in-memory journal, so the toggle is
attempted after the journal has been marked stopped.  I am reporting the
reproduction; if the downgraded warning is the intended outcome for a corrupt
image, please disregard this.


This appears to be a recurrence of the syzbot issue whose external id is
3aba35f80970c6e536b2.  It remains reproducible on v7.3-rc1.


Reproducer:


syz reproducer: https://pastebin.com/raw/Zev3Pr6Z
console output: https://pastebin.com/raw/jEDLm4Pj
kernel config: https://pastebin.com/raw/GvCKrhjZ


Kernel:


HEAD commit: cee9395acd8043be0644b25c34bfa86623f2b935
git tree: upstream (linux.git), tested through the v7.3-rc1 annotated tag object
           e5e04726cdd043e309677071ab1b65a4b18f422b
kernel version: 7.3.0-rc1 #1 PREEMPT(full)
tested tag: v7.3-rc1 (Linux 7.3-rc1, 2026-08-30)


Let me know if you need more details or testing.


Best regards,
Changjian