WARNING in udf_truncate_extents

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: fa33f9094f36 Linux 4.14.268
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=165e7dc1700000
kernel config: https://syzkaller.appspot.com/x/.config?x=e337cd2bb5f49534
dashboard link: https://syzkaller.appspot.com/bug?extid=0168772252d9e1b17a46
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+016877...@syzkaller.appspotmail.com

FAT-fs (loop3): Unrecognized mount option "u(n5�1" or missing value
F2FS-fs (loop5): Unable to read 1th superblock
F2FS-fs (loop5): Unable to read 2th superblock
F2FS-fs (loop5): Unable to read 1th superblock
------------[ cut here ]------------
WARNING: CPU: 1 PID: 10193 at fs/udf/truncate.c:226 udf_truncate_extents+0x725/0x840 fs/udf/truncate.c:226
F2FS-fs (loop5): Unable to read 2th superblock
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 10193 Comm: syz-executor.4 Not tainted 4.14.268-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x44 kernel/panic.c:547
report_bug+0x208/0x250 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:udf_truncate_extents+0x725/0x840 fs/udf/truncate.c:226
RSP: 0018:ffff888051eaf880 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffff88808eb0a6f8 RCX: ffffc900097f2000
RDX: 0000000000040000 RSI: ffffffff82371e65 RDI: ffff88808eb0a600
RBP: ffff888051eaf968 R08: 00000000000000ff R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888051eaf928
R13: 0000000000000200 R14: ffff888051eaf8f8 R15: ffff8880b57b8800
udf_write_failed.isra.0+0x151/0x1a0 fs/udf/inode.c:172
udf_write_begin+0x7f/0xa0 fs/udf/inode.c:208
generic_perform_write+0x1c9/0x420 mm/filemap.c:3055
__generic_file_write_iter+0x227/0x590 mm/filemap.c:3180
udf_file_write_iter+0x284/0x470 fs/udf/file.c:169
call_write_iter include/linux/fs.h:1780 [inline]
aio_write+0x2ed/0x560 fs/aio.c:1553
io_submit_one fs/aio.c:1641 [inline]
do_io_submit+0x847/0x1570 fs/aio.c:1709
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f71a76aa049
RSP: 002b:00007f71a601f168 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1
RAX: ffffffffffffffda RBX: 00007f71a77bcf60 RCX: 00007f71a76aa049
RDX: 0000000020000540 RSI: 0000000000000045 RDI: 00007f71a77a0000
RBP: 00007f71a770408d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffcbab19d1f R14: 00007f71a601f300 R15: 0000000000022000
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: fa33f9094f36 Linux 4.14.268
git tree: linux-4.14.y

console output: https://syzkaller.appspot.com/x/log.txt?x=12aeda56700000

kernel config: https://syzkaller.appspot.com/x/.config?x=e337cd2bb5f49534
dashboard link: https://syzkaller.appspot.com/bug?extid=0168772252d9e1b17a46
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=177a0656700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12570ce6700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+016877...@syzkaller.appspotmail.com

attempt to access beyond end of device
loop0: rw=2049, want=3590, limit=2816
attempt to access beyond end of device
loop0: rw=2049, want=3690, limit=2816
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7988 at fs/udf/truncate.c:226 udf_truncate_extents+0x725/0x840 fs/udf/truncate.c:226

Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 7988 Comm: syz-executor245 Not tainted 4.14.268-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x44 kernel/panic.c:547
report_bug+0x208/0x250 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:udf_truncate_extents+0x725/0x840 fs/udf/truncate.c:226

RSP: 0018:ffff8880973f79b0 EFLAGS: 00010297
RAX: ffff888093d0e200 RBX: ffff88808df6d160 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000200 RDI: ffff88808df6d068
RBP: ffff8880973f7a98 R08: 00000000000000ff R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880973f7a58
R13: 0000000000000200 R14: ffff8880973f7a28 R15: ffff8880b39d21c0

udf_write_failed.isra.0+0x151/0x1a0 fs/udf/inode.c:172
udf_write_begin+0x7f/0xa0 fs/udf/inode.c:208
generic_perform_write+0x1c9/0x420 mm/filemap.c:3055
__generic_file_write_iter+0x227/0x590 mm/filemap.c:3180
udf_file_write_iter+0x284/0x470 fs/udf/file.c:169
call_write_iter include/linux/fs.h:1780 [inline]

new_sync_write fs/read_write.c:469 [inline]
__vfs_write+0x44c/0x630 fs/read_write.c:482
vfs_write+0x17f/0x4d0 fs/read_write.c:544
SYSC_write fs/read_write.c:590 [inline]
SyS_write+0xf2/0x210 fs/read_write.c:582
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7fa223950de9
RSP: 002b:00007ffd966295a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fa223950de9
RDX: 00000000fffffc41 RSI: 0000000020001440 RDI: 0000000000000007
RBP: 0000000000000000 R08: 00007fa2239bfec0 R09: 00007fa2239bfec0
R10: 00007fa2239bfec0 R11: 0000000000000246 R12: 00007ffd966295d0
R13: 00007ffd966295bc R14: 431bde82d7b634db R15: 0000000000000000