[BUG] gfs2: task hung in gfs2_glock_wait during umount

[ZW Tang]

Hi,

I am reporting a hung task issue triggered by a syzkaller reproducer on
Linux 7.2-rc3.

The reproducer mounts a crafted GFS2 image with syz_mount_image$gfs2.
During cleanup, syz-executor gets stuck in the umount path. The task
remains blocked for more than 142 seconds while doing a path lookup for
umount, and the stack shows that it is waiting in gfs2_glock_wait() via
gfs2_glock_nq() and __gfs2_lookup().

This looks like a potential GFS2 glock state / lookup teardown issue
triggered by a crafted GFS2 image during unmount, rather than a generic
VFS or scheduler problem.

Reproducer:
syz reproducer: https://pastebin.com/raw/V8BAF98m
kernel config: https://pastebin.com/raw/GYQ6Gtrs
console output: https://pastebin.com/raw/4sM18pxc


Kernel:
HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full) (QEMU Ubuntu 24.10)

Crash log excerpt:

INFO: task syz-executor:10343 blocked for more than 142 seconds.
Not tainted 7.2.0-rc3 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task state stack:23336 pid:10343 tgid:10343 ppid:1 task_flags:0x400140
flags:0x00080002

Call Trace:
<TASK>
__schedule+0x294f/0x8050
schedule+0xd2/0x260
bit_wait+0x15/0xe0
__wait_on_bit+0xc9/0x190
out_of_line_wait_on_bit+0xd7/0x110
gfs2_glock_wait+0xaf/0x240
gfs2_glock_nq+0xadc/0x1ca0
__gfs2_lookup+0x105/0x290
__lookup_slow+0x15f/0x340
lookup_slow+0x51/0x80
path_lookupat.isra.0+0x619/0xbb0
filename_lookup+0x213/0x480
user_path_at+0x40/0x60
ksys_umount+0xb7/0x130
__x64_sys_umount+0x54/0x80
do_syscall_64+0xc4/0x7a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>

Locks held at the time include the directory inode mutex:

1 lock held by syz-executor/10343:
#0: ffff888055af0e00 (&type->i_mutex_dir_key#7){.+.+}-{4:4}, at:
lookup_slow+0x43/0x80

The reproducer uses a crafted GFS2 image and mount options including
lockproto_nolock, errors_withdraw, quota, locktable, and other GFS2
options. The task then hangs while umount performs a lookup and GFS2
tries to acquire or wait for a glock.


Thanks