[v6.1] WARNING in read_block_bitmap

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 28c695c365e1 Linux 6.1.150
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15cfad62580000
kernel config: https://syzkaller.appspot.com/x/.config?x=68aa5a3af1cb953a
dashboard link: https://syzkaller.appspot.com/bug?extid=4278b025fa75f41c8b4b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/16e807247bf6/disk-28c695c3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a2c735eaf8f9/vmlinux-28c695c3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/080f0096d6c9/Image-28c695c3.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4278b0...@syzkaller.appspotmail.com

------------[ cut here ]------------
block_group >= groups_count - block_group = 207715, groups_count = 1
WARNING: CPU: 0 PID: 5034 at fs/ext2/balloc.c:53 ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
WARNING: CPU: 0 PID: 5034 at fs/ext2/balloc.c:53 read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
Modules linked in:
CPU: 0 PID: 5034 Comm: syz.0.141 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
pc : read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
lr : ext2_get_group_desc fs/ext2/balloc.c:51 [inline]
lr : read_block_bitmap+0x1e8/0x754 fs/ext2/balloc.c:138
sp : ffff8000215973d0
x29: ffff800021597400 x28: dfff800000000000 x27: 1fffe0001e8350cf
x26: ffff0000f5620138 x25: ffff0000f4dce000 x24: 0000000000032b63
x23: dfff800000000000 x22: 0000000000000001 x21: ffff0000f41a8678
x20: ffff0000f41a8000 x19: 0000000000032b63 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082d22d4 x15: 0000000000000002
x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000080000
x11: 0000000000009497 x10: ffff8000218da000 x9 : 9ae487b4fef7a400
x8 : 9ae487b4fef7a400 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800021596e58 x4 : ffff8000151a4820 x3 : ffff80000852e3f8
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
ext2_free_blocks+0x28c/0xa3c fs/ext2/balloc.c:523
ext2_free_data fs/ext2/inode.c:1099 [inline]
__ext2_truncate_blocks+0x2a8/0xbc0 fs/ext2/inode.c:1190
ext2_truncate_blocks fs/ext2/inode.c:1259 [inline]
ext2_write_failed+0x1fc/0x270 fs/ext2/inode.c:65
ext2_direct_IO+0x160/0x1a0 fs/ext2/inode.c:938
generic_file_direct_write+0x31c/0x620 mm/filemap.c:3770
__generic_file_write_iter+0x1bc/0x37c mm/filemap.c:3930
generic_file_write_iter+0xb4/0x2b0 mm/filemap.c:4006
ext2_file_write_iter+0xc4/0x404 fs/ext2/file.c:179
call_write_iter include/linux/fs.h:2265 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x5ac/0x7c4 fs/read_write.c:584
ksys_write+0x120/0x210 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 96588
hardirqs last enabled at (96587): [<ffff800008308418>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261
hardirqs last disabled at (96588): [<ffff800011956c70>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (96546): [<ffff80000803092c>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (96544): [<ffff8000080308f8>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
block_group >= groups_count - block_group = 2, groups_count = 1
WARNING: CPU: 0 PID: 5034 at fs/ext2/balloc.c:53 ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
WARNING: CPU: 0 PID: 5034 at fs/ext2/balloc.c:53 read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
Modules linked in:
CPU: 0 PID: 5034 Comm: syz.0.141 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
pc : read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
lr : ext2_get_group_desc fs/ext2/balloc.c:51 [inline]
lr : read_block_bitmap+0x1e8/0x754 fs/ext2/balloc.c:138
sp : ffff8000215973d0
x29: ffff800021597400 x28: dfff800000000000 x27: 1fffe0001e8350cf
x26: ffff0000f5620138 x25: ffff0000f4dce000 x24: 0000000000000002
x23: dfff800000000000 x22: 0000000000000001 x21: ffff0000f41a8678
x20: ffff0000f41a8000 x19: 0000000000000002 x18: ffff800011abbcc0
x17: 1fffe00033ed797e x16: ffff8000082d22d4 x15: 0000000040000000
x14: 0000000000000002 x13: 1ffff00002a180b1 x12: 0000000000ff0100
x11: ff0080000a8935f4 x10: 0000000000000003 x9 : 9ae487b4fef7a400
x8 : 9ae487b4fef7a400 x7 : ffff800008251e10 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : ffff800011abd7c0 x0 : 0000000000000000
Call trace:
ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
ext2_free_blocks+0x28c/0xa3c fs/ext2/balloc.c:523
ext2_free_data fs/ext2/inode.c:1108 [inline]
__ext2_truncate_blocks+0x378/0xbc0 fs/ext2/inode.c:1190
ext2_truncate_blocks fs/ext2/inode.c:1259 [inline]
ext2_write_failed+0x1fc/0x270 fs/ext2/inode.c:65
ext2_direct_IO+0x160/0x1a0 fs/ext2/inode.c:938
generic_file_direct_write+0x31c/0x620 mm/filemap.c:3770
__generic_file_write_iter+0x1bc/0x37c mm/filemap.c:3930
generic_file_write_iter+0xb4/0x2b0 mm/filemap.c:4006
ext2_file_write_iter+0xc4/0x404 fs/ext2/file.c:179
call_write_iter include/linux/fs.h:2265 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x5ac/0x7c4 fs/read_write.c:584
ksys_write+0x120/0x210 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 96622
hardirqs last enabled at (96621): [<ffff800008251ea4>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1367 [inline]
hardirqs last enabled at (96621): [<ffff800008251ea4>] finish_lock_switch+0xb0/0x1c4 kernel/sched/core.c:5003
hardirqs last disabled at (96622): [<ffff800011956c70>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (96546): [<ffff80000803092c>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (96544): [<ffff8000080308f8>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19
---[ end trace 0000000000000000 ]---
EXT2-fs (loop0): error: ext2_new_inode: reserved inode or inode > inodes count - block_group = 0,inode=1


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 28c695c365e1 Linux 6.1.150
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=12ce3562580000

kernel config: https://syzkaller.appspot.com/x/.config?x=68aa5a3af1cb953a
dashboard link: https://syzkaller.appspot.com/bug?extid=4278b025fa75f41c8b4b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14f78b12580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10218d62580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/16e807247bf6/disk-28c695c3.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a2c735eaf8f9/vmlinux-28c695c3.xz
kernel image: https://storage.googleapis.com/syzbot-assets/080f0096d6c9/Image-28c695c3.gz.xz

mounted in repro #1: https://storage.googleapis.com/syzbot-assets/6ef5cbe2154d/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=10f78b12580000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/683f15625925/mount_5.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=142e4934580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4278b0...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 512
EXT2-fs (loop0): warning: mounting ext3 filesystem as ext2

------------[ cut here ]------------
block_group >= groups_count - block_group = 207715, groups_count = 1

WARNING: CPU: 0 PID: 4514 at fs/ext2/balloc.c:53 ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
WARNING: CPU: 0 PID: 4514 at fs/ext2/balloc.c:53 read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
Modules linked in:
CPU: 0 PID: 4514 Comm: syz.0.17 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
pc : read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
lr : ext2_get_group_desc fs/ext2/balloc.c:51 [inline]
lr : read_block_bitmap+0x1e8/0x754 fs/ext2/balloc.c:138

sp : ffff800020d673d0
x29: ffff800020d67400 x28: dfff800000000000 x27: 1fffe0001b6d04cf
x26: ffff0000e93907a8 x25: ffff0000d328a800 x24: 0000000000032b63
x23: dfff800000000000 x22: 0000000000000001 x21: ffff0000db682678
x20: ffff0000db682000 x19: 0000000000032b63 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082d22d4 x15: 0000000000000000
x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000ff0100
x11: ff00800008191ca8 x10: 0000000000000000 x9 : e3916bda88bd5500
x8 : e3916bda88bd5500 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800020d66e58 x4 : ffff8000151a4820 x3 : ffff80000852e3f8

irq event stamp: 8046
hardirqs last enabled at (8045): [<ffff800008308418>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261
hardirqs last disabled at (8046): [<ffff800011956c70>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (8004): [<ffff80000803092c>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32
softirqs last disabled at (8002): [<ffff8000080308f8>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19

---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
block_group >= groups_count - block_group = 2, groups_count = 1

WARNING: CPU: 1 PID: 4514 at fs/ext2/balloc.c:53 ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
WARNING: CPU: 1 PID: 4514 at fs/ext2/balloc.c:53 read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
Modules linked in:
CPU: 1 PID: 4514 Comm: syz.0.17 Tainted: G W syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
pc : read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
lr : ext2_get_group_desc fs/ext2/balloc.c:51 [inline]
lr : read_block_bitmap+0x1e8/0x754 fs/ext2/balloc.c:138

sp : ffff800020d673d0
x29: ffff800020d67400 x28: dfff800000000000 x27: 1fffe0001b6d04cf
x26: ffff0000e93907a8 x25: ffff0000d328a800 x24: 0000000000000002
x23: dfff800000000000 x22: 0000000000000001 x21: ffff0000db682678
x20: ffff0000db682000 x19: 0000000000000002 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082d22d4 x15: 0000000000000000
x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000ff0100
x11: ff00800008191ca8 x10: 0000000000000000 x9 : e3916bda88bd5500
x8 : e3916bda88bd5500 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800020d66e58 x4 : ffff8000151a4820 x3 : ffff800008311cf4

x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000
Call trace:
ext2_get_group_desc fs/ext2/balloc.c:-1 [inline]
read_block_bitmap+0x1ec/0x754 fs/ext2/balloc.c:138
ext2_free_blocks+0x28c/0xa3c fs/ext2/balloc.c:523

ext2_free_data fs/ext2/inode.c:1108 [inline]
__ext2_truncate_blocks+0x378/0xbc0 fs/ext2/inode.c:1190
ext2_truncate_blocks fs/ext2/inode.c:1259 [inline]
ext2_write_failed+0x1fc/0x270 fs/ext2/inode.c:65
ext2_direct_IO+0x160/0x1a0 fs/ext2/inode.c:938
generic_file_direct_write+0x31c/0x620 mm/filemap.c:3770
__generic_file_write_iter+0x1bc/0x37c mm/filemap.c:3930
generic_file_write_iter+0xb4/0x2b0 mm/filemap.c:4006
ext2_file_write_iter+0xc4/0x404 fs/ext2/file.c:179
call_write_iter include/linux/fs.h:2265 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x5ac/0x7c4 fs/read_write.c:584
ksys_write+0x120/0x210 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

irq event stamp: 8184
hardirqs last enabled at (8183): [<ffff800008308418>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261
hardirqs last disabled at (8184): [<ffff800011956c70>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (8162): [<ffff8000081a967c>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (8162): [<ffff8000081a967c>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (8049): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630

---[ end trace 0000000000000000 ]---


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.