[syzbot] [block?] kernel BUG in bio_chain

[syzbot] [block?] kernel BUG in bio_chain

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    b2c27842ba85 Add linux-next specific files for 20251203
git tree:       linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1688d2b4580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=caadf525b0ab8d17
dashboard link: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13dd5512580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=158d7512580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1168b2ea1fd1/disk-b2c27842.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2c3066faf780/vmlinux-b2c27842.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f6693abe374d/bzImage-b2c27842.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/caedad91e176/mount_0.gz
  fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=118d7512580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com

gfs2: fsid=syz:syz.0: jid=0, already locked for use
gfs2: fsid=syz:syz.0: jid=0: Looking at journal...
------------[ cut here ]------------
kernel BUG at block/bio.c:342!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 912 Comm: kworker/1:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: gfs2_recovery gfs2_recover_func
RIP: 0010:bio_chain+0xee/0x100 block/bio.c:342
Code: 43 1c 5b 41 5c 41 5d 41 5e 41 5f 5d e9 1b e1 f2 06 cc 89 f9 80 e1 07 fe c1 38 c1 7c cf e8 aa fc bd fd eb c8 e8 d3 a8 57 fd 90 <0f> 0b e8 cb a8 57 fd 90 0f 0b 0f 1f 84 00 00 00 00 00 90 90 90 90
RSP: 0018:ffffc90003d07540 EFLAGS: 00010293
RAX: ffffffff846a0a5d RBX: ffff8880207223c0 RCX: ffff888025b49e80
RDX: 0000000000000000 RSI: ffff8880207223c0 RDI: ffff888020722500
RBP: 0000000000002004 R08: ffffffff8476a450 R09: ffffffff8df419e0
R10: dffffc0000000000 R11: ffffed10040e4487 R12: dffffc0000000000
R13: 1ffff110040e44a8 R14: ffff888020722500 R15: ffff888020722540
FS:  0000000000000000(0000) GS:ffff888125f49000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff5e0f43000 CR3: 0000000073e76000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 gfs2_chain_bio fs/gfs2/lops.c:487 [inline]
 gfs2_find_jhead+0x627/0xe40 fs/gfs2/lops.c:549
 gfs2_recover_func+0x5f5/0x1c90 fs/gfs2/recovery.c:459
 process_one_work+0x93a/0x15a0 kernel/workqueue.c:3261
 process_scheduled_works kernel/workqueue.c:3344 [inline]
 worker_thread+0x9b0/0xee0 kernel/workqueue.c:3425
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bio_chain+0xee/0x100 block/bio.c:342
Code: 43 1c 5b 41 5c 41 5d 41 5e 41 5f 5d e9 1b e1 f2 06 cc 89 f9 80 e1 07 fe c1 38 c1 7c cf e8 aa fc bd fd eb c8 e8 d3 a8 57 fd 90 <0f> 0b e8 cb a8 57 fd 90 0f 0b 0f 1f 84 00 00 00 00 00 90 90 90 90
RSP: 0018:ffffc90003d07540 EFLAGS: 00010293
RAX: ffffffff846a0a5d RBX: ffff8880207223c0 RCX: ffff888025b49e80
RDX: 0000000000000000 RSI: ffff8880207223c0 RDI: ffff888020722500
RBP: 0000000000002004 R08: ffffffff8476a450 R09: ffffffff8df419e0
R10: dffffc0000000000 R11: ffffed10040e4487 R12: dffffc0000000000
R13: 1ffff110040e44a8 R14: ffff888020722500 R15: ffff888020722540
FS:  0000000000000000(0000) GS:ffff888125f49000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563e2b893950 CR3: 0000000026910000 CR4: 00000000003526f0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [block?] kernel BUG in bio_chain

[Edward Adam Davis]

#syz test

diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 97ebe457c00a..2de334034c74 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -484,6 +484,10 @@ static struct bio *gfs2_chain_bio(struct bio *prev, unsigned int nr_iovecs)
 	new = bio_alloc(prev->bi_bdev, nr_iovecs, prev->bi_opf, GFP_NOIO);
 	bio_clone_blkg_association(new, prev);
 	new->bi_iter.bi_sector = bio_end_sector(prev);
+	new->bi_end_io = prev->bi_end_io;
+	new->bi_private = prev->bi_private;
+	prev->bi_end_io = NULL;
+	prev->bi_private = NULL;
 	bio_chain(prev, new);
 	submit_bio(prev);
 	return new;

Re: [syzbot] [block?] kernel BUG in bio_chain

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

SYZFAIL: failed to recv rpc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)


Warning: Permanently added '10.128.1.220' (ED25519) to the list of known hosts.
2025/12/08 06:08:45 parsed 1 programs
[   80.568471][ T5835] cgroup: Unknown subsys name 'net'
[   80.737895][ T5835] cgroup: Unknown subsys name 'cpuset'
[   80.747550][ T5835] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   82.378701][ T5835] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   85.176358][ T5846] chnl_net:caif_netlink_parms(): no params data found
[   85.252037][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state
[   85.259854][ T5846] bridge0: port 1(bridge_slave_0) entered disabled state
[   85.267947][ T5846] bridge_slave_0: entered allmulticast mode
[   85.275836][ T5846] bridge_slave_0: entered promiscuous mode
[   85.285305][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state
[   85.292659][ T5846] bridge0: port 2(bridge_slave_1) entered disabled state
[   85.301042][ T5846] bridge_slave_1: entered allmulticast mode
[   85.308395][ T5846] bridge_slave_1: entered promiscuous mode
[   85.339609][ T5846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   85.351781][ T5846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   85.383521][ T5846] team0: Port device team_slave_0 added
[   85.391461][ T5846] team0: Port device team_slave_1 added
[   85.418135][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_0
[   85.426158][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   85.452312][ T5846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   85.465292][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_1
[   85.472528][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   85.499953][ T5846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   85.542273][ T5846] hsr_slave_0: entered promiscuous mode
[   85.549470][ T5846] hsr_slave_1: entered promiscuous mode
[   85.698098][ T5846] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   85.710372][ T5846] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   85.720791][ T5846] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   85.731671][ T5846] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   85.763570][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state
[   85.771157][ T5846] bridge0: port 2(bridge_slave_1) entered forwarding state
[   85.779469][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state
[   85.786758][ T5846] bridge0: port 1(bridge_slave_0) entered forwarding state
[   85.841622][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0
[   85.861268][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[   85.871035][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[   85.888626][ T5846] 8021q: adding VLAN 0 to HW filter on device team0
[   85.902665][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state
[   85.910991][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state
[   85.926919][   T12] bridge0: port 2(bridge_slave_1) entered blocking state
[   85.934428][   T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[   86.106940][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0
[   86.148700][ T5846] veth0_vlan: entered promiscuous mode
[   86.161121][ T5846] veth1_vlan: entered promiscuous mode
[   86.190643][ T5846] veth0_macvtap: entered promiscuous mode
[   86.201565][ T5846] veth1_macvtap: entered promiscuous mode
[   86.221704][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0
[   86.238028][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1
[   86.255901][ T1167] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   86.267532][ T1167] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   86.282145][ T1167] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   86.291809][ T1167] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   86.358097][ T5846] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   86.499947][ T1130] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.579593][ T1130] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.653786][ T1130] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.773456][ T1130] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   86.920449][  T980] cfg80211: failed to load regulatory.db
[   88.255927][   T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   88.269511][   T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   88.278235][   T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   88.286903][   T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   88.295498][   T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   88.606147][   T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   88.618956][   T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   88.649294][ T3455] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   88.658849][ T3455] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   89.147456][ T1130] bridge_slave_1: left allmulticast mode
[   89.153339][ T1130] bridge_slave_1: left promiscuous mode
[   89.162769][ T1130] bridge0: port 2(bridge_slave_1) entered disabled state
[   89.198441][ T1130] bridge_slave_0: left allmulticast mode
[   89.208602][ T1130] bridge_slave_0: left promiscuous mode
[   89.214467][ T1130] bridge0: port 1(bridge_slave_0) entered disabled state
[   89.471176][ T1130] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   89.482915][ T1130] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   89.493918][ T1130] bond0 (unregistering): Released all slaves
[   89.606581][ T1130] hsr_slave_0: left promiscuous mode
[   89.614935][ T1130] hsr_slave_1: left promiscuous mode
[   89.621473][ T1130] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   89.629576][ T1130] batman_adv: batadv0: Removing interface: batadv_slave_0
[   89.639972][ T1130] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   89.648991][ T1130] batman_adv: batadv0: Removing interface: batadv_slave_1
[   89.678051][ T1130] veth1_macvtap: left promiscuous mode
[   89.683876][ T1130] veth0_macvtap: left promiscuous mode
[   89.695563][ T1130] veth1_vlan: left promiscuous mode
[   89.701061][ T1130] veth0_vlan: left promiscuous mode
[   90.151748][ T1130] team0 (unregistering): Port device team_slave_1 removed
[   90.180639][ T1130] team0 (unregistering): Port device team_slave_0 removed
2025/12/08 06:08:58 executed programs: 0
[   91.531760][ T5151] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   91.542382][ T5151] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   91.555029][ T5151] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   91.575161][ T5151] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   91.583559][ T5151] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   92.038753][ T5975] chnl_net:caif_netlink_parms(): no params data found
[   92.337812][ T5975] bridge0: port 1(bridge_slave_0) entered blocking state
[   92.353902][ T5975] bridge0: port 1(bridge_slave_0) entered disabled state
[   92.361276][ T5975] bridge_slave_0: entered allmulticast mode
[   92.370465][ T5975] bridge_slave_0: entered promiscuous mode
[   92.390146][ T5975] bridge0: port 2(bridge_slave_1) entered blocking state
[   92.400511][ T5975] bridge0: port 2(bridge_slave_1) entered disabled state
[   92.409232][ T5975] bridge_slave_1: entered allmulticast mode
[   92.419786][ T5975] bridge_slave_1: entered promiscuous mode
[   92.498010][ T5975] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   92.510867][ T5975] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   92.553735][ T5975] team0: Port device team_slave_0 added
[   92.562693][ T5975] team0: Port device team_slave_1 added
[   92.606007][ T5975] batman_adv: batadv0: Adding interface: batadv_slave_0
[   92.613249][ T5975] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.640999][ T5975] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   92.654890][ T5975] batman_adv: batadv0: Adding interface: batadv_slave_1
[   92.661922][ T5975] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   92.689373][ T5975] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   92.812894][ T5975] hsr_slave_0: entered promiscuous mode
[   92.835971][ T5975] hsr_slave_1: entered promiscuous mode
[   93.511142][ T5975] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   93.527073][ T5975] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   93.539458][ T5975] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   93.552749][ T5975] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   93.636218][   T52] Bluetooth: hci0: command tx timeout
[   93.674308][ T5975] 8021q: adding VLAN 0 to HW filter on device bond0
[   93.699493][ T5975] 8021q: adding VLAN 0 to HW filter on device team0
[   93.713279][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state
[   93.721106][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state
[   93.749309][ T1167] bridge0: port 2(bridge_slave_1) entered blocking state
[   93.756886][ T1167] bridge0: port 2(bridge_slave_1) entered forwarding state
[   94.005681][ T5975] 8021q: adding VLAN 0 to HW filter on device batadv0
[   94.073867][ T5975] veth0_vlan: entered promiscuous mode
[   94.089021][ T5975] veth1_vlan: entered promiscuous mode
[   94.135082][ T5975] veth0_macvtap: entered promiscuous mode
[   94.148238][ T5975] veth1_macvtap: entered promiscuous mode
[   94.177415][ T5975] batman_adv: batadv0: Interface activated: batadv_slave_0
[   94.196611][ T5975] batman_adv: batadv0: Interface activated: batadv_slave_1
[   94.214009][ T1130] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   94.222880][ T1130] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   94.257357][ T1130] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   94.283049][ T1130] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   94.334841][   T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   94.342899][   T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   94.399046][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   94.408247][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3183255281=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at d6526ea3e
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d6526ea3e6ad9081c902859bbb80f9f840377cb4\"
/usr/bin/ld: /tmp/ccCOMUne.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit:         82bcd04d Add linux-next specific files for 20251208
git tree:       linux-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=a94030c847137a18
dashboard link: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=122fd21a580000

[PATCH Next] gfs2: update end and prev bio for chain bio

[Edward Adam Davis]

The bios are created and initialized using gfs2_log_alloc_bio() in
gfs2_find_jhead(), which sets bi_end_io and bi_private. When the I/O
request is too large and needs to be split into multiple bios and
submitted as a chain, the bug reported by syzbot [1] is triggered.

When we need to submit multiple bios in a chain, we need to pass the
bi_end_io and bi_private of the previous bio to the end bio to ensure
that the multiple bios are correctly assembled into a submission chain.

[1]
kernel BUG at block/bio.c:342!
Call Trace:
 gfs2_chain_bio fs/gfs2/lops.c:487 [inline]
 gfs2_find_jhead+0x627/0xe40 fs/gfs2/lops.c:549
 gfs2_recover_func+0x5f5/0x1c90 fs/gfs2/recovery.c:459

Fixes: 8a157e0a0aa5 ("gfs2: Fix use of bio_chain")
Reported-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 fs/gfs2/lops.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 97ebe457c00a..2de334034c74 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -484,6 +484,10 @@ static struct bio *gfs2_chain_bio(struct bio *prev, unsigned int nr_iovecs)
 	new = bio_alloc(prev->bi_bdev, nr_iovecs, prev->bi_opf, GFP_NOIO);
 	bio_clone_blkg_association(new, prev);
 	new->bi_iter.bi_sector = bio_end_sector(prev);
+	new->bi_end_io = prev->bi_end_io;
+	new->bi_private = prev->bi_private;
+	prev->bi_end_io = NULL;
+	prev->bi_private = NULL;
 	bio_chain(prev, new);
 	submit_bio(prev);
 	return new;
-- 
2.43.0

Re: [PATCH Next] gfs2: update end and prev bio for chain bio

[Andreas Gruenbacher]

Hello,

On Mon, Dec 8, 2025 at 7:12 AM Edward Adam Davis <eadavis@qq.com> wrote:
> The bios are created and initialized using gfs2_log_alloc_bio() in
> gfs2_find_jhead(), which sets bi_end_io and bi_private. When the I/O
> request is too large and needs to be split into multiple bios and
> submitted as a chain, the bug reported by syzbot [1] is triggered.
>
> When we need to submit multiple bios in a chain, we need to pass the
> bi_end_io and bi_private of the previous bio to the end bio to ensure
> that the multiple bios are correctly assembled into a submission chain.
>
> [1]
> kernel BUG at block/bio.c:342!
> Call Trace:
>  gfs2_chain_bio fs/gfs2/lops.c:487 [inline]
>  gfs2_find_jhead+0x627/0xe40 fs/gfs2/lops.c:549
>  gfs2_recover_func+0x5f5/0x1c90 fs/gfs2/recovery.c:459
>
> Fixes: 8a157e0a0aa5 ("gfs2: Fix use of bio_chain")
> Reported-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
>  fs/gfs2/lops.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
> index 97ebe457c00a..2de334034c74 100644
> --- a/fs/gfs2/lops.c
> +++ b/fs/gfs2/lops.c
> @@ -484,6 +484,10 @@ static struct bio *gfs2_chain_bio(struct bio *prev, unsigned int nr_iovecs)
>         new = bio_alloc(prev->bi_bdev, nr_iovecs, prev->bi_opf, GFP_NOIO);
>         bio_clone_blkg_association(new, prev);
>         new->bi_iter.bi_sector = bio_end_sector(prev);
> +       new->bi_end_io = prev->bi_end_io;
> +       new->bi_private = prev->bi_private;
> +       prev->bi_end_io = NULL;
> +       prev->bi_private = NULL;
>         bio_chain(prev, new);
>         submit_bio(prev);
>         return new;
> --
> 2.43.0
>

thanks for this patch, it looks correct. However, the underlying
problem is that bi_end_io and bi_private are set too early, and if we
change the code to set those fields before submitting the bio, we
won't need this hack in gfs2_chain_bio().

I have pushed patches doing that onto for-next:

  https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git/log/?h=for-next

Does this work for you?

Thanks,
Andreas

Re: [PATCH Next] gfs2: update end and prev bio for chain bio

[Edward Adam Davis]

On Fri, 12 Dec 2025 13:47:40 +0100, Andreas Gruenbacher <agruenba@redhat.com> wrote:
> On Mon, Dec 8, 2025 at 7:12 AM Edward Adam Davis <eadavis@qq.com> wrote:
> > The bios are created and initialized using gfs2_log_alloc_bio() in
> > gfs2_find_jhead(), which sets bi_end_io and bi_private. When the I/O
> > request is too large and needs to be split into multiple bios and
> > submitted as a chain, the bug reported by syzbot [1] is triggered.
> >
> > When we need to submit multiple bios in a chain, we need to pass the
> > bi_end_io and bi_private of the previous bio to the end bio to ensure
> > that the multiple bios are correctly assembled into a submission chain.
> >
> > [1]
> > kernel BUG at block/bio.c:342!
> > Call Trace:
> >  gfs2_chain_bio fs/gfs2/lops.c:487 [inline]
> >  gfs2_find_jhead+0x627/0xe40 fs/gfs2/lops.c:549
> >  gfs2_recover_func+0x5f5/0x1c90 fs/gfs2/recovery.c:459
> >
> > Fixes: 8a157e0a0aa5 ("gfs2: Fix use of bio_chain")
> > Reported-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
> > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > ---
> >  fs/gfs2/lops.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
> > index 97ebe457c00a..2de334034c74 100644
> > --- a/fs/gfs2/lops.c
> > +++ b/fs/gfs2/lops.c
> > @@ -484,6 +484,10 @@ static struct bio *gfs2_chain_bio(struct bio *prev, unsigned int nr_iovecs)
> >         new = bio_alloc(prev->bi_bdev, nr_iovecs, prev->bi_opf, GFP_NOIO);
> >         bio_clone_blkg_association(new, prev);
> >         new->bi_iter.bi_sector = bio_end_sector(prev);
> > +       new->bi_end_io = prev->bi_end_io;
> > +       new->bi_private = prev->bi_private;
> > +       prev->bi_end_io = NULL;
> > +       prev->bi_private = NULL;
> >         bio_chain(prev, new);
> >         submit_bio(prev);
> >         return new;
> > --
> > 2.43.0
> >
> 
> thanks for this patch, it looks correct. However, the underlying
> problem is that bi_end_io and bi_private are set too early, and if we
> change the code to set those fields before submitting the bio, we
> won't need this hack in gfs2_chain_bio().
> 
> I have pushed patches doing that onto for-next:
> 
>   https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git/log/?h=for-next
> 
> Does this work for you?
I think it's work for me.

BR,
Edward

Re: [PATCH Next] gfs2: update end and prev bio for chain bio

[Andreas Gruenbacher]

On Sun, Dec 14, 2025 at 3:18 AM Edward Adam Davis <eadavis@qq.com> wrote:
> On Fri, 12 Dec 2025 13:47:40 +0100, Andreas Gruenbacher <agruenba@redhat.com> wrote:
> > On Mon, Dec 8, 2025 at 7:12 AM Edward Adam Davis <eadavis@qq.com> wrote:
> > > The bios are created and initialized using gfs2_log_alloc_bio() in
> > > gfs2_find_jhead(), which sets bi_end_io and bi_private. When the I/O
> > > request is too large and needs to be split into multiple bios and
> > > submitted as a chain, the bug reported by syzbot [1] is triggered.
> > >
> > > When we need to submit multiple bios in a chain, we need to pass the
> > > bi_end_io and bi_private of the previous bio to the end bio to ensure
> > > that the multiple bios are correctly assembled into a submission chain.
> > >
> > > [1]
> > > kernel BUG at block/bio.c:342!
> > > Call Trace:
> > >  gfs2_chain_bio fs/gfs2/lops.c:487 [inline]
> > >  gfs2_find_jhead+0x627/0xe40 fs/gfs2/lops.c:549
> > >  gfs2_recover_func+0x5f5/0x1c90 fs/gfs2/recovery.c:459
> > >
> > > Fixes: 8a157e0a0aa5 ("gfs2: Fix use of bio_chain")
> > > Reported-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
> > > Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> > > ---
> > >  fs/gfs2/lops.c | 4 ++++
> > >  1 file changed, 4 insertions(+)
> > >
> > > diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
> > > index 97ebe457c00a..2de334034c74 100644
> > > --- a/fs/gfs2/lops.c
> > > +++ b/fs/gfs2/lops.c
> > > @@ -484,6 +484,10 @@ static struct bio *gfs2_chain_bio(struct bio *prev, unsigned int nr_iovecs)
> > >         new = bio_alloc(prev->bi_bdev, nr_iovecs, prev->bi_opf, GFP_NOIO);
> > >         bio_clone_blkg_association(new, prev);
> > >         new->bi_iter.bi_sector = bio_end_sector(prev);
> > > +       new->bi_end_io = prev->bi_end_io;
> > > +       new->bi_private = prev->bi_private;
> > > +       prev->bi_end_io = NULL;
> > > +       prev->bi_private = NULL;
> > >         bio_chain(prev, new);
> > >         submit_bio(prev);
> > >         return new;
> > > --
> > > 2.43.0
> > >
> >
> > thanks for this patch, it looks correct. However, the underlying
> > problem is that bi_end_io and bi_private are set too early, and if we
> > change the code to set those fields before submitting the bio, we
> > won't need this hack in gfs2_chain_bio().
> >
> > I have pushed patches doing that onto for-next:
> >
> >   https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git/log/?h=for-next
> >
> > Does this work for you?
>
> I think it's work for me.

It turns out that commit 8a157e0a0aa5 ("gfs2: Fix use of bio_chain")
was bad and needed to be reverted. This means that patch "gfs2: Set
bio->{bi_private,bi_end_ino} late" has been dropped from for-next as
well.

Thanks,
Andreas

Forwarded:

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: 
Author: agruenba@redhat.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git
4daba9379bbd702c63459f54ef448746bfeab42d

Re: [syzbot] [block?] kernel BUG in bio_chain

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com
Tested-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com

Tested on:

commit:         4daba937 gfs2: Set bio->{bi_private,bi_end_ino} late
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git
console output: https://syzkaller.appspot.com/x/log.txt?x=136931c2580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=99d71abfdad271f0
dashboard link: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.