Forwarded: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page

[syzbot <syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] gfs2: fix hung task in gfs2_jhead_process_page
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master


filemap_get_folio() can return an ERR_PTR if the folio is not
present in the page cache. This can happen when a crafted or
corrupted GFS2 filesystem image is mounted and journal recovery
is triggered.

gfs2_jhead_process_page() calls filemap_get_folio() without
checking the return value, and passes the result directly to
folio_wait_locked(). When an ERR_PTR is passed to
folio_wait_locked(), the kernel task gets stuck in uninterruptible
sleep (state D) forever, triggering the hung task watchdog.

Fix this by checking the return value of filemap_get_folio().
If the folio is not found, record the error via filemap_set_wb_err()
so that gfs2_find_jhead() picks it up through filemap_check_wb_err()
and returns a proper error code to the caller. Without this,
gfs2_find_jhead() would return success despite the failure, leading
to further issues during mount such as duplicate kmem_cache creation.

Reported-by: syzbot+9013411dc43f3582823a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9013411dc43f3582823a
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
 fs/gfs2/lops.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 797931eb5845..a832904a09e3 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -467,6 +467,12 @@ static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,
 
 	folio = filemap_get_folio(jd->jd_inode->i_mapping, index);
 
+	if (IS_ERR(folio)) {
+		filemap_set_wb_err(jd->jd_inode->i_mapping, PTR_ERR(folio));
+		*done = true;
+		return;
+	}
+
 	folio_wait_locked(folio);
 	if (!folio_test_uptodate(folio))
 		*done = true;
-- 
2.43.0