Re: [PATCH] vfs: show filesystem name at dump_inode()

[Mateusz Guzik]

On Mon, Aug 11, 2025 at 8:50 AM Tetsuo Handa
<penguin-kernel@xxxxxxxxxxxxxxxxxxx> wrote:
>
> Commit 8b17e540969a ("vfs: add initial support for CONFIG_DEBUG_VFS") added
> dump_inode(), but dump_inode() currently reports only raw pointer address.
> Comment says that adding a proper inode dumping routine is a TODO.
>
> However, syzkaller concurrently tests multiple filesystems, and several
> filesystems started calling dump_inode() due to hitting VFS_BUG_ON_INODE()
> added by commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
> before a proper inode dumping routine is implemented.
>
> Show filesystem name at dump_inode() so that we can find which filesystem
> has passed an invalid mode to may_open() from syzkaller's crash reports.
>
> Link: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
> Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
> ---
>  fs/inode.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/inode.c b/fs/inode.c
> index 01ebdc40021e..8a60aec94245 100644
> --- a/fs/inode.c
> +++ b/fs/inode.c
> @@ -2914,7 +2914,7 @@ EXPORT_SYMBOL(mode_strip_sgid);
>   */
>  void dump_inode(struct inode *inode, const char *reason)
>  {
> -       pr_warn("%s encountered for inode %px", reason, inode);
> +       pr_warn("%s encountered for inode %px (%s)\n", reason, inode, inode->i_sb->s_type->name);
>  }
>
>  EXPORT_SYMBOL(dump_inode);
> --
> 2.50.1

Better printing is a TODO in part because the routine must not trip
over arbitrarily bogus state, in this case notably that's unset
->i_sb.

See mm/debug.c:dump_vmg for an example.

I could swear one of the dumping routines in mm was using something
special to deref pointers without tripping over it either, but now I
can't find it.

All that said, I suggest this direction:
diff --git a/fs/inode.c b/fs/inode.c
index 01ebdc40021e..113fcb8da983 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -2914,7 +2914,9 @@ EXPORT_SYMBOL(mode_strip_sgid);
  */
 void dump_inode(struct inode *inode, const char *reason)
 {
-       pr_warn("%s encountered for inode %px", reason, inode);
+       struct super_block *sb = inode->i_sb; /* will be careful deref later */
+
+       pr_warn("%s encountered for inode %px [fs %s]", reason, inode,
sb ? sb->s_type->name : "NOT SET");
 }

 EXPORT_SYMBOL(dump_inode);

Can't do a proper submission at the moment and I'm not going to argue
about authorship should this land. :)

-- 
Mateusz Guzik <mjguzik gmail.com>