[v6.1] kernel BUG in unrefer_xattr_datum

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 347385861c50 Linux 6.1.84
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1073aaa9180000
kernel config: https://syzkaller.appspot.com/x/.config?x=c6572e59ce99583c
dashboard link: https://syzkaller.appspot.com/bug?extid=14e507361b4189f571bd
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/101d17869fc3/disk-34738586.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1fd47dc155f3/vmlinux-34738586.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3a82e916ef21/Image-34738586.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+14e507...@syzkaller.appspotmail.com

jffs2: argh. node added in wrong place at 0x0001e03c(2)
jffs2: nextblock 0x0001d000, expected at 0001f000
------------[ cut here ]------------
kernel BUG at fs/jffs2/xattr.c:411!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4565 Comm: syz-executor.3 Not tainted 6.1.84-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : unrefer_xattr_datum+0x3a8/0x3ac fs/jffs2/xattr.c:411
lr : unrefer_xattr_datum+0x3a8/0x3ac fs/jffs2/xattr.c:411
sp : ffff80001f3a75f0
x29: ffff80001f3a7600 x28: 1fffe000193f6203 x27: 1fffe000193f6208
x26: dfff800000000000 x25: 1fffe000193f6204 x24: ffff0000c9fb1020
x23: 0000000000000001 x22: ffff0000c9fb1018 x21: ffff0000cee7a000
x20: ffff0000c9fb1000 x19: ffff0000cee7a638 x18: 1fffe0003686b776
x17: ffff80001583d000 x16: ffff800008305ec4 x15: ffff0001b435bbbc
x14: 000000001215233c x13: 000000009bea1494 x12: 0000000000040000
x11: 000000000000370a x10: ffff8000210a9000 x9 : ffff80000975e118
x8 : 000000000000370b x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0000c9fb1018 x1 : 0000000000000001 x0 : 00000000000000ff
Call trace:
unrefer_xattr_datum+0x3a8/0x3ac fs/jffs2/xattr.c:411
do_jffs2_setxattr+0xde0/0x1158
jffs2_trusted_setxattr+0x4c/0x64 fs/jffs2/xattr_trusted.c:33
__vfs_setxattr+0x388/0x3a4 fs/xattr.c:182
__vfs_setxattr_noperm+0x110/0x528 fs/xattr.c:216
__vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:277
vfs_setxattr+0x1a8/0x344 fs/xattr.c:309
do_setxattr fs/xattr.c:594 [inline]
setxattr+0x230/0x294 fs/xattr.c:617
path_setxattr+0x17c/0x258 fs/xattr.c:636
__do_sys_setxattr fs/xattr.c:652 [inline]
__se_sys_setxattr fs/xattr.c:648 [inline]
__arm64_sys_setxattr+0xbc/0xd8 fs/xattr.c:648
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1803e0 97c86927 17ffff47 97b67474 (d4210000)
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 347385861c50 Linux 6.1.84
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=14d1d5e3180000

kernel config: https://syzkaller.appspot.com/x/.config?x=c6572e59ce99583c
dashboard link: https://syzkaller.appspot.com/bug?extid=14e507361b4189f571bd
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16965f19180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=177f01d3180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/101d17869fc3/disk-34738586.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1fd47dc155f3/vmlinux-34738586.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3a82e916ef21/Image-34738586.gz.xz

mounted in repro #1: https://storage.googleapis.com/syzbot-assets/f15463b260af/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/6bf7f87c8cc1/mount_4.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+14e507...@syzkaller.appspotmail.com

jffs2: nextblock 0x0001d000, expected at 0001f000
------------[ cut here ]------------
kernel BUG at fs/jffs2/xattr.c:411!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:

CPU: 0 PID: 4236 Comm: syz-executor631 Not tainted 6.1.84-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : unrefer_xattr_datum+0x3a8/0x3ac fs/jffs2/xattr.c:411
lr : unrefer_xattr_datum+0x3a8/0x3ac fs/jffs2/xattr.c:411

sp : ffff80001dda75f0
x29: ffff80001dda7600 x28: 1fffe0001b0f3803 x27: 1fffe0001b0f3808
x26: dfff800000000000 x25: 1fffe0001b0f3804 x24: ffff0000d879c020
x23: 0000000000000001 x22: ffff0000d879c018 x21: ffff0000d56c2000
x20: ffff0000d879c000 x19: ffff0000d56c2638 x18: ffff80001dda68a0
x17: ffff8000188cc000 x16: ffff800008305ec4 x15: ffff800008ae5c40
x14: ffff800008ae8068 x13: ffff800008062674 x12: 0000000000000003
x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff80000975e118
x8 : ffff0000d8769bc0 x7 : ffff800008062464 x6 : ffff800008062674
x5 : ffff0000d894c758 x4 : ffff80001dda7350 x3 : 0000000000000000
x2 : ffff0000d879c018 x1 : 0000000000000001 x0 : 00000000000000ff

Call trace:
unrefer_xattr_datum+0x3a8/0x3ac fs/jffs2/xattr.c:411
do_jffs2_setxattr+0xde0/0x1158
jffs2_trusted_setxattr+0x4c/0x64 fs/jffs2/xattr_trusted.c:33
__vfs_setxattr+0x388/0x3a4 fs/xattr.c:182
__vfs_setxattr_noperm+0x110/0x528 fs/xattr.c:216
__vfs_setxattr_locked+0x1ec/0x218 fs/xattr.c:277
vfs_setxattr+0x1a8/0x344 fs/xattr.c:309
do_setxattr fs/xattr.c:594 [inline]
setxattr+0x230/0x294 fs/xattr.c:617
path_setxattr+0x17c/0x258 fs/xattr.c:636

__do_sys_lsetxattr fs/xattr.c:659 [inline]
__se_sys_lsetxattr fs/xattr.c:655 [inline]
__arm64_sys_lsetxattr+0xbc/0xd8 fs/xattr.c:655

__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1803e0 97c86927 17ffff47 97b67474 (d4210000)
---[ end trace 0000000000000000 ]---


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.