[v6.1] WARNING in start_this_handle

0 views
Skip to first unread message

syzbot

unread,
Aug 17, 2026, 2:22:40 AM (yesterday) Aug 17
to syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: e4f7d8be268e Linux 6.1.182
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1080d949580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=3f883e5589b65d624e3e
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7cd9b1875376/disk-e4f7d8be.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4b5d35d18c31/vmlinux-e4f7d8be.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d5ee64c2af77/Image-e4f7d8be.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3f883e...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 5615 at include/linux/jbd2.h:1731 jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
WARNING: CPU: 1 PID: 5615 at include/linux/jbd2.h:1731 jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
WARNING: CPU: 1 PID: 5615 at include/linux/jbd2.h:1731 jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
WARNING: CPU: 1 PID: 5615 at include/linux/jbd2.h:1731 start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
Modules linked in:
CPU: 1 PID: 5615 Comm: syz.5.174 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
pc : jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
pc : jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
pc : start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
lr : jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
lr : jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
lr : jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
lr : start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
sp : ffff8000210d6f20
x29: ffff8000210d70b0 x28: 0000000010000000 x27: ffff0000dfad4764
x26: ffff70000421adf8 x25: ffff0000dfad40b8 x24: ffff8000210d6fc0
x23: ffff0000dfad47d8 x22: 1fffe0001bf5a930 x21: ffff0000dfad4100
x20: ffff0000dfad4000 x19: dfff800000000000 x18: 1fffe00033e7697e
x17: ffff80001537d000 x16: ffff8000082dd248 x15: ffff8000184cd000
x14: 0000000000000001 x13: 1fffe0001c0dc509 x12: 0000000000080000
x11: 000000000001b9c5 x10: ffff8000225ca000 x9 : ffff800008ebe118
x8 : 000000000001b9c6 x7 : ffff8000083c791c x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff800008ebdd3c
x2 : 0000000000000001 x1 : 0000000010000000 x0 : 0000000000000000
Call trace:
jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
jbd2__journal_start+0x288/0x530 fs/jbd2/transaction.c:520
jbd2_journal_start+0x3c/0x4c fs/jbd2/transaction.c:559
ocfs2_start_trans+0x398/0x6f4 fs/ocfs2/journal.c:376
ocfs2_mknod+0xd2c/0x218c fs/ocfs2/namei.c:361
ocfs2_create+0x19c/0x51c fs/ocfs2/namei.c:674
lookup_open fs/namei.c:3490 [inline]
open_last_lookups fs/namei.c:3558 [inline]
path_openat+0xda8/0x27a0 fs/namei.c:3788
do_filp_open+0x198/0x38c fs/namei.c:3818
do_sys_openat2+0x134/0x3fc fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__arm64_sys_openat+0x11c/0x150 fs/open.c:1347
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 127000
hardirqs last enabled at (126999): [<ffff8000083c750c>] seqcount_lockdep_reader_access include/linux/seqlock.h:104 [inline]
hardirqs last enabled at (126999): [<ffff8000083c750c>] timekeeping_get_delta kernel/time/timekeeping.c:254 [inline]
hardirqs last enabled at (126999): [<ffff8000083c750c>] timekeeping_get_ns+0x120/0x3b8 kernel/time/timekeeping.c:388
hardirqs last disabled at (127000): [<ffff800011b8c2bc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (126880): [<ffff800008031254>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (126878): [<ffff800008031220>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,
Aug 17, 2026, 3:14:32 AM (yesterday) Aug 17
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: e4f7d8be268e Linux 6.1.182
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15ccd6c6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=3f883e5589b65d624e3e
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ccd6c6580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17ccd6c6580000
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/b6f0f099b041/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=17722679580000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/84e0ce8bc3b0/mount_5.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3f883e...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 4435 at include/linux/jbd2.h:1731 jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
WARNING: CPU: 0 PID: 4435 at include/linux/jbd2.h:1731 jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
WARNING: CPU: 0 PID: 4435 at include/linux/jbd2.h:1731 jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
WARNING: CPU: 0 PID: 4435 at include/linux/jbd2.h:1731 start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
Modules linked in:
CPU: 0 PID: 4435 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
pc : jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
pc : jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
pc : start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
lr : jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
lr : jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
lr : jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
lr : start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
sp : ffff8000211d7360
x29: ffff8000211d74f0 x28: 0000000010000000 x27: ffff0000d1fba764
x26: ffff70000423ae80 x25: ffff0000d1fba0b8 x24: ffff8000211d7400
x23: ffff0000d1fba7d8 x22: 1fffe0001a3f7530 x21: ffff0000d1fba100
x20: ffff0000d1fba000 x19: dfff800000000000 x18: 1fffe00033e7277e
x17: ffff80001537d000 x16: ffff8000082dd248 x15: 000000000004ffff
x14: 0000000000000001 x13: 1fffe0001c0d9c79 x12: 0000000000000000
x11: ff00800008ebe118 x10: 0000000000000000 x9 : ffff800008ebe118
x8 : ffff0000d5a93800 x7 : ffff8000083c791c x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff800008ebdd3c
x2 : 0000000000000001 x1 : 0000000010000000 x0 : 0000000000000000
Call trace:
jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
jbd2__journal_start+0x288/0x530 fs/jbd2/transaction.c:520
jbd2_journal_start+0x3c/0x4c fs/jbd2/transaction.c:559
ocfs2_start_trans+0x398/0x6f4 fs/ocfs2/journal.c:376
ocfs2_shutdown_local_alloc+0x1a0/0x858 fs/ocfs2/localalloc.c:416
ocfs2_dismount_volume+0x1f4/0x95c fs/ocfs2/super.c:1882
ocfs2_put_super+0x108/0x390 fs/ocfs2/super.c:1609
generic_shutdown_super+0x138/0x32c fs/super.c:501
kill_block_super+0x78/0xe0 fs/super.c:1470
deactivate_locked_super+0xb4/0x128 fs/super.c:332
deactivate_super+0xe4/0x104 fs/super.c:363
cleanup_mnt+0x3a8/0x430 fs/namespace.c:1191
__cleanup_mnt+0x20/0x30 fs/namespace.c:1198
task_work_run+0x1f4/0x280 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
do_notify_resume+0x20f8/0x2c84 arch/arm64/kernel/signal.c:1151
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x98/0x128 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 160894
hardirqs last enabled at (160893): [<ffff8000083c750c>] seqcount_lockdep_reader_access include/linux/seqlock.h:104 [inline]
hardirqs last enabled at (160893): [<ffff8000083c750c>] timekeeping_get_delta kernel/time/timekeeping.c:254 [inline]
hardirqs last enabled at (160893): [<ffff8000083c750c>] timekeeping_get_ns+0x120/0x3b8 kernel/time/timekeeping.c:388
hardirqs last disabled at (160894): [<ffff800011b8c2bc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (160658): [<ffff800008031254>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (160656): [<ffff800008031220>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages