Re: [syzbot] [ocfs2?] kernel BUG in __ocfs2_move_extents_range

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+f2107d...@syzkaller.appspotmail.com
Tested-by: syzbot+f2107d...@syzkaller.appspotmail.com

Tested on:

commit: 552c5071 Merge tag 'vfio-v6.18-rc3' of https://github...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=13c6ce7c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f9a2ca2a8964bd4a
dashboard link: https://syzkaller.appspot.com/bug?extid=f2107d999290b8166267
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=11ac4614580000

Note: testing is done by a robot and is best-effort only.

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in __ocfs2_move_extents_range

ocfs2: Mounting device (7,0) on (node local, slot 0) with writeback data mode.
------------[ cut here ]------------
kernel BUG at fs/ocfs2/suballoc.c:1365!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 7289 Comm: syz.0.17 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO BTYPE=--)
pc : ocfs2_block_group_set_bits+0x44c/0x70c fs/ocfs2/suballoc.c:1365
lr : ocfs2_block_group_set_bits+0x444/0x70c fs/ocfs2/suballoc.c:1365
sp : ffffff80cb35f950
x29: ffffff80cb35f980 x28: dfffffd000000000
x27: 1ffffff019f28001 x26: 0000000000000002
x25: ffffff80e95b4d38 x24: ffffff80cf94000c
x23: ffffff80cf940000 x22: 0000000000000168
x21: 0000000000000001 x20: ffffff80da545e80
x19: dfffffd000000000 x18: ffffffd01197d7ac
x17: 00000000fffffffc x16: 0000000000ff0100
x15: ffffffffffffffff x14: ffffff80ca764f80
x13: ffffffd01dd9b000 x12: 0000000000000000
x11: 0000000000ff0100 x10: 0000000000000000
x9 : ffffff80ca764f80 x8 : ffffffd01198f8a8
x7 : 0000000000000000 x6 : ffffffd010c7ba54
x5 : 0000000000000168 x4 : 0000000000000001
x3 : ffffff80da545e80 x2 : ffffff80cf940000
x1 : 0000000000000002 x0 : ffffffd01bc8af10
Call trace:
ocfs2_block_group_set_bits+0x44c/0x70c fs/ocfs2/suballoc.c:1365
ocfs2_move_extent fs/ocfs2/move_extents.c:695 [inline]
__ocfs2_move_extents_range+0x1e74/0x27ec fs/ocfs2/move_extents.c:868
ocfs2_move_extents+0x2b0/0x750 fs/ocfs2/move_extents.c:935
ocfs2_ioctl_move_extents+0x3b0/0x55c fs/ocfs2/move_extents.c:1067
ocfs2_ioctl+0x2ac/0x10c8 fs/ocfs2/ioctl.c:946
vfs_ioctl fs/ioctl.c:48 [inline]
__do_sys_ioctl fs/ioctl.c:753 [inline]
__se_sys_ioctl fs/ioctl.c:739 [inline]
__arm64_sys_ioctl+0x148/0x1c0 fs/ioctl.c:739
__invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
el0_svc_common+0x1b8/0x480 arch/arm64/kernel/syscall.c:155
do_el0_svc+0x54/0x134 arch/arm64/kernel/syscall.c:194
el0_svc+0x1c/0x28 arch/arm64/kernel/entry-common.c:365
el0_sync_handler+0xc4/0xd8 arch/arm64/kernel/entry-common.c:381
el0_sync+0x168/0x180 arch/arm64/kernel/entry.S:689
Code: 95bd6322 97aad992 f00517c0 913c4000 (d4210000)
---[ end trace f4492e09a8a518f9 ]---


Tested on:

commit: d3d0b4e2 Linux 5.10.245
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-5.10.y
console output: https://syzkaller.appspot.com/x/log.txt?x=141c2d2f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=37e065cc9b6362d

dashboard link: https://syzkaller.appspot.com/bug?extid=f2107d999290b8166267
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64

patch: https://syzkaller.appspot.com/x/patch.diff?x=11982d2f980000

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in __ocfs2_move_extents_range

ocfs2: Mounting device (7,0) on (node local, slot 0) with writeback data mode.
------------[ cut here ]------------

kernel BUG at fs/ocfs2/suballoc.c:1363!

Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:

CPU: 1 PID: 5427 Comm: syz.0.17 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025

pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ocfs2_block_group_set_bits+0x510/0x6c4 fs/ocfs2/suballoc.c:1363
lr : ocfs2_block_group_set_bits+0x510/0x6c4 fs/ocfs2/suballoc.c:1363
sp : ffffffc0216171e0
x29: ffffffc021617260 x28: ffffffb8042c2e7c x27: ffffff80df71a740
x26: 0000000000000002 x25: ffffff80e53bc00c x24: ffffff80f209cfb8
x23: dfffffc000000000 x22: 0000000000000168 x21: 0000000000000001
x20: 1ffffff8042c2e40 x19: ffffff80e53bc000 x18: ffffffc011b0fe20
x17: 1ffffff033e18d7e x16: ffffffc0082d0900 x15: 0000000000000000
x14: 00000000fffffffc x13: 0000000000ff0100 x12: 0000000000ff0100
x11: ff00004009c64374 x10: 0000000000000000 x9 : ffffffc009c64374
x8 : ffffff80d06f5340 x7 : 0000000000000000 x6 : ffffffc008dc3fcc
x5 : 0000000000000168 x4 : 0000000000000001 x3 : ffffff80df71a740
x2 : ffffff80e53bc000 x1 : 0000000000000002 x0 : 0000000000000168
Call trace:
ocfs2_block_group_set_bits+0x510/0x6c4 fs/ocfs2/suballoc.c:1363
ocfs2_move_extent fs/ocfs2/move_extents.c:693 [inline]
__ocfs2_move_extents_range+0x208c/0x2aac fs/ocfs2/move_extents.c:866
ocfs2_move_extents+0x314/0x7e0 fs/ocfs2/move_extents.c:933
ocfs2_ioctl_move_extents+0x420/0x5ec fs/ocfs2/move_extents.c:1065
ocfs2_ioctl+0x204/0xaf4 fs/ocfs2/ioctl.c:930
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 17ffff5e 97a116fd d4210000 97a116fb (d4210000)
---[ end trace 0000000000000000 ]---


Tested on:

commit: 8e6e2188 Linux 6.1.157
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15719be2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=848478f4029d639b

dashboard link: https://syzkaller.appspot.com/bug?extid=f2107d999290b8166267
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64

patch: https://syzkaller.appspot.com/x/patch.diff?x=16b69be2580000

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in __ocfs2_move_extents_range

------------[ cut here ]------------
kernel BUG at fs/ocfs2/suballoc.c:1396!

Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:

CPU: 1 UID: 0 PID: 7437 Comm: syz.0.17 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025

pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ocfs2_block_group_set_bits+0x780/0x8ec fs/ocfs2/suballoc.c:1396
lr : ocfs2_block_group_set_bits+0x780/0x8ec fs/ocfs2/suballoc.c:1396
sp : ffff8000a13571a0
x29: ffff8000a1357260 x28: ffff0000dcf1cfb8 x27: ffff0000ca040000
x26: ffff0000db626630 x25: ffff0000c6fcb000 x24: 1ffff0001426ae40
x23: ffff0000c6fcb00c x22: dfff800000000000 x21: 0000000000000002
x20: 00000000000000ff x19: 0000000000000000 x18: 1fffe00033970070
x17: ffff80008ed4d000 x16: ffff80008a937600 x15: 0000000000000001
x14: 0000000000000000 x13: 00000000fffffffc x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : ffff0000d6fe8000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 00000000000000ff x4 : 0000000000000001 x3 : ffff0000e115c0e8
x2 : ffff0000c6fcb000 x1 : 0000000000000002 x0 : 00000000000000ff
Call trace:
ocfs2_block_group_set_bits+0x780/0x8ec fs/ocfs2/suballoc.c:1396
ocfs2_move_extent fs/ocfs2/move_extents.c:693 [inline]
__ocfs2_move_extents_range+0x20ec/0x2abc fs/ocfs2/move_extents.c:866
ocfs2_move_extents+0x314/0x7ec fs/ocfs2/move_extents.c:933
ocfs2_ioctl_move_extents+0x448/0x614 fs/ocfs2/move_extents.c:1065
ocfs2_ioctl+0x1c4/0x738 fs/ocfs2/ioctl.c:946
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl fs/ioctl.c:893 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:735
el0t_64_sync_handler+0x90/0xfc arch/arm64/kernel/entry-common.c:754
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
Code: 17ffffa8 979ad94a d4210000 979ad948 (d4210000)

---[ end trace 0000000000000000 ]---


Tested on:

commit: 4fc43deb Linux 6.12.55
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.12.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16e193e2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4c2423b3cd696bce

dashboard link: https://syzkaller.appspot.com/bug?extid=f2107d999290b8166267
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64

patch: https://syzkaller.appspot.com/x/patch.diff?x=17582d2f980000