syzbot


BUG: sleeping function called from invalid context in gfs2_withdraw

Status: upstream: reported on 2025/07/30 20:12
Reported-by: syzbot+3cdbdd888aae950489a5@syzkaller.appspotmail.com
First crash: 148d, last: 20d
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 BUG: sleeping function called from invalid context in gfs2_withdraw 5 1 59d 59d 0/3 upstream: reported on 2025/10/27 10:36
linux-6.1 BUG: sleeping function called from invalid context in gfs2_withdraw origin:upstream 5 C error 17 1d21h 277d 0/3 upstream: reported C repro on 2025/03/23 18:44
upstream BUG: sleeping function called from invalid context in gfs2_withdraw gfs2 5 C error done 182 717d 837d 25/29 fixed on 2024/03/20 11:33
upstream BUG: sleeping function called from invalid context in gfs2_withdraw (2) gfs2 5 24 23d 103d 0/29 upstream: reported on 2025/09/13 22:07

Sample crash report:
loop3: rw=1, sector=3112, nr_sectors = 5336 limit=0
gfs2: fsid=syz:syz.0: Error 10 writing to journal, jid=0
gfs2: fsid=syz:syz.0: fatal: I/O error(s)
gfs2: fsid=syz:syz.0: about to withdraw this file system
BUG: sleeping function called from invalid context at fs/gfs2/util.c:159
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5919, name: gfs2_logd/syz:s
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
3 locks held by gfs2_logd/syz:s/5919:
 #0: ffff888026b59060 (&sdp->sd_log_flush_lock){++++}-{3:3}, at: gfs2_log_flush+0x104/0x24b0 fs/gfs2/log.c:1042
 #1: ffff888026b58e88 (&sdp->sd_log_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #1: ffff888026b58e88 (&sdp->sd_log_lock){+.+.}-{2:2}, at: gfs2_log_lock fs/gfs2/log.h:32 [inline]
 #1: ffff888026b58e88 (&sdp->sd_log_lock){+.+.}-{2:2}, at: gfs2_flush_revokes+0x52/0x80 fs/gfs2/log.c:814
 #2: ffff888026b59248 (&sdp->sd_freeze_mutex){+.+.}-{3:3}, at: signal_our_withdraw fs/gfs2/util.c:152 [inline]
 #2: ffff888026b59248 (&sdp->sd_freeze_mutex){+.+.}-{3:3}, at: gfs2_withdraw+0x41d/0x13b0 fs/gfs2/util.c:333
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 5919 Comm: gfs2_logd/syz:s Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 __might_resched+0x491/0x610 kernel/sched/core.c:10208
 signal_our_withdraw fs/gfs2/util.c:157 [inline]
 gfs2_withdraw+0x46b/0x13b0 fs/gfs2/util.c:333
 gfs2_ail1_empty+0x7be/0x850 fs/gfs2/log.c:377
 gfs2_flush_revokes+0x5c/0x80 fs/gfs2/log.c:815
 revoke_lo_before_commit+0x2c/0x5f0 fs/gfs2/lops.c:867
 lops_before_commit fs/gfs2/lops.h:42 [inline]
 gfs2_log_flush+0xb84/0x24b0 fs/gfs2/log.c:1102
 gfs2_logd+0x2f8/0xf70 fs/gfs2/log.c:1319
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
BUG: scheduling while atomic: gfs2_logd/syz:s/5919/0x00000002
3 locks held by gfs2_logd/syz:s/5919:
 #0: ffff888026b59060 (&sdp->sd_log_flush_lock){++++}-{3:3}, at: gfs2_log_flush+0x104/0x24b0 fs/gfs2/log.c:1042
 #1: ffff888026b58e88 (&sdp->sd_log_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #1: ffff888026b58e88 (&sdp->sd_log_lock){+.+.}-{2:2}, at: gfs2_log_lock fs/gfs2/log.h:32 [inline]
 #1: ffff888026b58e88 (&sdp->sd_log_lock){+.+.}-{2:2}, at: gfs2_flush_revokes+0x52/0x80 fs/gfs2/log.c:814
 #2: ffff888026b59248 (&sdp->sd_freeze_mutex){+.+.}-{3:3}, at: signal_our_withdraw fs/gfs2/util.c:152 [inline]
 #2: ffff888026b59248 (&sdp->sd_freeze_mutex){+.+.}-{3:3}, at: gfs2_withdraw+0x41d/0x13b0 fs/gfs2/util.c:333
Modules linked in:
Preemption disabled at:
[<0000000000000000>] 0x0

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/05 12:12 linux-6.6.y 4791134e4aeb d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
2025/11/10 20:55 linux-6.6.y 0a805b6ea8cd 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
2025/10/23 13:13 linux-6.6.y f231f248323d c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
2025/09/11 11:38 linux-6.6.y fe9731e10004 fdeaa69b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
2025/08/10 17:38 linux-6.6.y 3a8ababb8b6a 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
2025/08/10 17:36 linux-6.6.y 3a8ababb8b6a 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
2025/08/10 17:36 linux-6.6.y 3a8ababb8b6a 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
2025/07/30 20:26 linux-6.6.y dbcb8d8e4163 f8f2b4da .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
2025/07/30 20:24 linux-6.6.y dbcb8d8e4163 f8f2b4da .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
2025/07/30 20:16 linux-6.6.y dbcb8d8e4163 f8f2b4da .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
2025/07/30 20:12 linux-6.6.y dbcb8d8e4163 f8f2b4da .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan BUG: sleeping function called from invalid context in gfs2_withdraw
* Struck through repros no longer work on HEAD.