[syzbot] [ocfs2?] kernel BUG in ocfs2_refcount_cal_cow_clusters

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f79e772258df Merge tag 'media/v6.18-1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=151d1ee2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7f967f2c97bd611a
dashboard link: https://syzkaller.appspot.com/bug?extid=6fdd8fa3380730a4b22c
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16e84458580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=163c9214580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f79e7722.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9d29501fc412/vmlinux-f79e7722.xz
kernel image: https://storage.googleapis.com/syzbot-assets/773691b45948/bzImage-f79e7722.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2a53f186d930/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=12731092580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6fdd8f...@syzkaller.appspotmail.com

option from the mount to silence this warning.
=======================================================
ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
------------[ cut here ]------------
kernel BUG at fs/ocfs2/refcounttree.c:2678!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5498 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:ocfs2_refcount_cal_cow_clusters+0x12a1/0x12b0 fs/ocfs2/refcounttree.c:2678
Code: 94 6d 8d ba 69 0a 00 00 48 c7 c1 a0 40 8b 8b 4c 8b 4c 24 30 e8 00 51 10 00 90 0f 0b e8 d8 83 17 fe 90 0f 0b e8 d0 83 17 fe 90 <0f> 0b 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90
RSP: 0018:ffffc90002bbf5e0 EFLAGS: 00010293
RAX: ffffffff83a70250 RBX: 1ffff1100863069a RCX: ffff888000bdc900
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002bbf7a8 R08: 00000000ffffffff R09: ffffc90002bbf85c
R10: 00000000fffffffc R11: 0000000000000000 R12: 0000000000000000
R13: 1ffff1100863069a R14: ffff8880431834d0 R15: 0000000000000000
FS: 0000555579608500(0000) GS:ffff88808d969000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000000b000 CR3: 000000004f2d3000 CR4: 0000000000352ef0
Call Trace:
<TASK>
ocfs2_refcount_cow_hunk fs/ocfs2/refcounttree.c:3385 [inline]
ocfs2_refcount_cow+0x31f/0xc90 fs/ocfs2/refcounttree.c:3467
ocfs2_prepare_inode_for_write fs/ocfs2/file.c:2340 [inline]
ocfs2_file_write_iter+0xe28/0x1d10 fs/ocfs2/file.c:2451
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f386f58eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffecc491f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f386f7e5fa0 RCX: 00007f386f58eec9
RDX: 000000000000001c RSI: 0000200000000100 RDI: 0000000000000005
RBP: 00007f386f611f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f386f7e5fa0 R14: 00007f386f7e5fa0 R15: 0000000000000003
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ocfs2_refcount_cal_cow_clusters+0x12a1/0x12b0 fs/ocfs2/refcounttree.c:2678
Code: 94 6d 8d ba 69 0a 00 00 48 c7 c1 a0 40 8b 8b 4c 8b 4c 24 30 e8 00 51 10 00 90 0f 0b e8 d8 83 17 fe 90 0f 0b e8 d0 83 17 fe 90 <0f> 0b 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90
RSP: 0018:ffffc90002bbf5e0 EFLAGS: 00010293
RAX: ffffffff83a70250 RBX: 1ffff1100863069a RCX: ffff888000bdc900
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002bbf7a8 R08: 00000000ffffffff R09: ffffc90002bbf85c
R10: 00000000fffffffc R11: 0000000000000000 R12: 0000000000000000
R13: 1ffff1100863069a R14: ffff8880431834d0 R15: 0000000000000000
FS: 0000555579608500(0000) GS:ffff88808d969000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000000b000 CR3: 000000004f2d3000 CR4: 0000000000352ef0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] ocfs2: fix stale extent map cache during COW operations
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

The extent map cache can become stale during COW operations, causing
ocfs2_refcount_cal_cow_clusters() to see an outdated extent state.

The problem occurs when:
1. ocfs2_get_clusters() reads and caches an extent with OCFS2_EXT_REFCOUNTED
2. ocfs2_refcount_cow_hunk() performs COW, clearing the REFCOUNTED flag
3. The extent map cache still contains the stale REFCOUNTED flag
4. Subsequent access on the same extent via the cache gets incorrect flags,
triggering BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED))

Fix by clearing the extent map cache at the start of COW operations.
This ensures that ocfs2_get_clusters() always reads fresh extent data
from disk during COW instead of using stale cached data.

Reported-by: syzbot+6fdd8f...@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <Karti...@gmail.com>
---
fs/ocfs2/refcounttree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 267b50e8e42e..3804e62ffcdb 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -3451,7 +3451,7 @@ int ocfs2_refcount_cow(struct inode *inode,
int ret = 0;
u32 p_cluster, num_clusters;
unsigned int ext_flags;
-
+ ocfs2_extent_map_trunc(inode, 0);
while (write_len) {
ret = ocfs2_get_clusters(inode, cpos, &p_cluster,
&num_clusters, &ext_flags);
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+6fdd8f...@syzkaller.appspotmail.com
Tested-by: syzbot+6fdd8f...@syzkaller.appspotmail.com

Tested on:

commit: 0d97f206 Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11d6da7c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d6fcded704acad42

dashboard link: https://syzkaller.appspot.com/bug?extid=6fdd8fa3380730a4b22c
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=16948542580000

Note: testing is done by a robot and is best-effort only.

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH v2] ocfs2: clear extent cache after moving/defragmenting extents

Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

The extent map cache can become stale when extents are moved or
defragmented, causing subsequent operations to see outdated extent
flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:
1. copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
2. ioctl(FITRIM) triggers ocfs2_move_extents()
3. __ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
4. ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent()
which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
5. The extent map cache is not invalidated after the move
6. Later write() operations read stale cached flags (0x2) but disk has
updated flags (0x0), causing a mismatch
7. BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag
operation in __ocfs2_move_extents_range(). This ensures subsequent
operations read fresh extent data from disk.

Reported-by: syzbot+6fdd8f...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=2959889e1f6e216585ce522f7e8bc002b46ad9e7
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---
fs/ocfs2/move_extents.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
index 86f2631e6360..10923bf7c8b8 100644
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -867,6 +867,11 @@ static int __ocfs2_move_extents_range(struct buffer_head *di_bh,
mlog_errno(ret);
goto out;
}
+ /*
+ * Invalidate extent cache after moving/defragging to prevent
+ * stale cached data with outdated extent flags.
+ */
+ ocfs2_extent_map_trunc(inode, cpos);

context->clusters_moved += alloc_size;
next:
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+6fdd8f...@syzkaller.appspotmail.com
Tested-by: syzbot+6fdd8f...@syzkaller.appspotmail.com

Tested on:

commit: ec714e37 Merge tag 'perf-tools-for-v6.18-1-2025-10-08'..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1480ba7c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7a19be70789ed377

dashboard link: https://syzkaller.appspot.com/bug?extid=6fdd8fa3380730a4b22c
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=13ca1304580000