Hello,
syzbot found the following issue on:
HEAD commit: e4f7d8be268e Linux 6.1.182
git tree: linux-6.1.y
console output:
https://syzkaller.appspot.com/x/log.txt?x=1080d949580000
kernel config:
https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link:
https://syzkaller.appspot.com/bug?extid=3f883e5589b65d624e3e
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image:
https://storage.googleapis.com/syzbot-assets/7cd9b1875376/disk-e4f7d8be.raw.xz
vmlinux:
https://storage.googleapis.com/syzbot-assets/4b5d35d18c31/vmlinux-e4f7d8be.xz
kernel image:
https://storage.googleapis.com/syzbot-assets/d5ee64c2af77/Image-e4f7d8be.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by:
syzbot+3f883e...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5615 at include/linux/jbd2.h:1731 jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
WARNING: CPU: 1 PID: 5615 at include/linux/jbd2.h:1731 jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
WARNING: CPU: 1 PID: 5615 at include/linux/jbd2.h:1731 jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
WARNING: CPU: 1 PID: 5615 at include/linux/jbd2.h:1731 start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
Modules linked in:
CPU: 1 PID: 5615 Comm: syz.5.174 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
pc : jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
pc : jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
pc : start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
lr : jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
lr : jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
lr : jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
lr : start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
sp : ffff8000210d6f20
x29: ffff8000210d70b0 x28: 0000000010000000 x27: ffff0000dfad4764
x26: ffff70000421adf8 x25: ffff0000dfad40b8 x24: ffff8000210d6fc0
x23: ffff0000dfad47d8 x22: 1fffe0001bf5a930 x21: ffff0000dfad4100
x20: ffff0000dfad4000 x19: dfff800000000000 x18: 1fffe00033e7697e
x17: ffff80001537d000 x16: ffff8000082dd248 x15: ffff8000184cd000
x14: 0000000000000001 x13: 1fffe0001c0dc509 x12: 0000000000080000
x11: 000000000001b9c5 x10: ffff8000225ca000 x9 : ffff800008ebe118
x8 : 000000000001b9c6 x7 : ffff8000083c791c x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff800008ebdd3c
x2 : 0000000000000001 x1 : 0000000010000000 x0 : 0000000000000000
Call trace:
jbd2_journal_has_csum_v2or3 include/linux/jbd2.h:1730 [inline]
jbd2_descriptor_blocks_per_trans fs/jbd2/transaction.c:75 [inline]
jbd2_get_transaction fs/jbd2/transaction.c:112 [inline]
start_this_handle+0xae4/0x125c fs/jbd2/transaction.c:411
jbd2__journal_start+0x288/0x530 fs/jbd2/transaction.c:520
jbd2_journal_start+0x3c/0x4c fs/jbd2/transaction.c:559
ocfs2_start_trans+0x398/0x6f4 fs/ocfs2/journal.c:376
ocfs2_mknod+0xd2c/0x218c fs/ocfs2/namei.c:361
ocfs2_create+0x19c/0x51c fs/ocfs2/namei.c:674
lookup_open fs/namei.c:3490 [inline]
open_last_lookups fs/namei.c:3558 [inline]
path_openat+0xda8/0x27a0 fs/namei.c:3788
do_filp_open+0x198/0x38c fs/namei.c:3818
do_sys_openat2+0x134/0x3fc fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__arm64_sys_openat+0x11c/0x150 fs/open.c:1347
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 127000
hardirqs last enabled at (126999): [<ffff8000083c750c>] seqcount_lockdep_reader_access include/linux/seqlock.h:104 [inline]
hardirqs last enabled at (126999): [<ffff8000083c750c>] timekeeping_get_delta kernel/time/timekeeping.c:254 [inline]
hardirqs last enabled at (126999): [<ffff8000083c750c>] timekeeping_get_ns+0x120/0x3b8 kernel/time/timekeeping.c:388
hardirqs last disabled at (127000): [<ffff800011b8c2bc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (126880): [<ffff800008031254>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (126878): [<ffff800008031220>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup