[v6.1] kernel BUG in ocfs2_set_new_buffer_uptodate

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 7dc732d24ff7 Linux 6.1.123
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15043418580000
kernel config: https://syzkaller.appspot.com/x/.config?x=da1827eaa51b65c3
dashboard link: https://syzkaller.appspot.com/bug?extid=a9577fc38576062e5730
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b77a36eba7b4/disk-7dc732d2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f5334562da28/vmlinux-7dc732d2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f0a16f9a500c/Image-7dc732d2.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a9577f...@syzkaller.appspotmail.com

loop2: detected capacity change from 0 to 32768
ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode.
------------[ cut here ]------------
kernel BUG at fs/ocfs2/uptodate.c:509!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 5707 Comm: syz.2.176 Not tainted 6.1.123-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ocfs2_set_new_buffer_uptodate+0x14c/0x188 fs/ocfs2/uptodate.c:509
lr : ocfs2_set_new_buffer_uptodate+0x14c/0x188 fs/ocfs2/uptodate.c:509
sp : ffff800021697840
x29: ffff800021697840 x28: dfff800000000000 x27: ffff7000042d2f28
x26: 1ffff000042d2f76 x25: 0000000000000000 x24: ffff0000eecbebf0
x23: ffff0000c6814000 x22: ffff800021697980 x21: 0000000000000001
x20: ffff0000eefb7d98 x19: ffff0000eecbebf0 x18: 1fffe0003679bf76
x17: ffff800015a8d000 x16: ffff80001232d384 x15: ffff0001b3cdfbbc
x14: 1ffff00002b520b2 x13: dfff800000000000 x12: 0000000000080000
x11: 00000000000025c5 x10: ffff800023ff9000 x9 : ffff80000a04f094
x8 : 00000000000025c6 x7 : ffff800009f715d4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000831a13c
x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
ocfs2_set_new_buffer_uptodate+0x14c/0x188 fs/ocfs2/uptodate.c:509
ocfs2_group_add+0x2f8/0x116c fs/ocfs2/resize.c:499
ocfs2_ioctl+0x7e4/0xd08 fs/ocfs2/ioctl.c:887
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: a8c47bfd d50323bf d65f03c0 97928fd6 (d4210000)
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 7dc732d24ff7 Linux 6.1.123
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=1027eedf980000

kernel config: https://syzkaller.appspot.com/x/.config?x=da1827eaa51b65c3
dashboard link: https://syzkaller.appspot.com/bug?extid=a9577fc38576062e5730
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15f43418580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=106f39c4580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b77a36eba7b4/disk-7dc732d2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f5334562da28/vmlinux-7dc732d2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f0a16f9a500c/Image-7dc732d2.gz.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/ad0107a87271/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a9577f...@syzkaller.appspotmail.com

option from the mount to silence this warning.
=======================================================
ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.

------------[ cut here ]------------
kernel BUG at fs/ocfs2/uptodate.c:509!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:

CPU: 0 PID: 4289 Comm: syz-executor812 Not tainted 6.1.123-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ocfs2_set_new_buffer_uptodate+0x14c/0x188 fs/ocfs2/uptodate.c:509
lr : ocfs2_set_new_buffer_uptodate+0x14c/0x188 fs/ocfs2/uptodate.c:509

sp : ffff800020e77840
x29: ffff800020e77840 x28: dfff800000000000 x27: ffff7000041cef28
x26: 1ffff000041cef76 x25: 0000000000000000 x24: ffff0000deeb8830
x23: ffff0000d8070000 x22: ffff800020e77980 x21: 0000000000000001
x20: ffff0000e1956658 x19: ffff0000deeb8830 x18: ffff800020e774a0
x17: ffff800018b7b000 x16: ffff80001232d384 x15: ffff80001865bf80
x14: 00000000a6f87605 x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff80000a04f094
x8 : ffff0000d99f9bc0 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800018cb1cb0 x4 : 0000000000000008 x3 : ffff80000831a13c

x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
ocfs2_set_new_buffer_uptodate+0x14c/0x188 fs/ocfs2/uptodate.c:509
ocfs2_group_add+0x2f8/0x116c fs/ocfs2/resize.c:499
ocfs2_ioctl+0x7e4/0xd08 fs/ocfs2/ioctl.c:887
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: a8c47bfd d50323bf d65f03c0 97928fd6 (d4210000)
---[ end trace 0000000000000000 ]---


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.