[v5.15] kernel BUG in ocfs2_write_cluster_by_desc
8 views
Skip to first unread message
syzbot
Jun 29, 2025, 7:33:27 PM6/29/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 3dea0e7f549e Linux 5.15.186
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1429488c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=918afca6cf85eccf
dashboard link: https://syzkaller.appspot.com/bug?extid=c2b7126d949451e476cf
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b4e974189c3a/disk-3dea0e7f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/922e99f38be2/vmlinux-3dea0e7f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/59456f23f37e/bzImage-3dea0e7f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c2b712...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/ocfs2/aops.c:1181!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4410 Comm: syz.4.12 Not tainted 5.15.186-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1181 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1cda/0x1d00 fs/ocfs2/aops.c:1242
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 61 a5 a2 8b ba 80 04 00 00 48 c7 c1 80 81 47 8a e8 ed 77 19 00 0f 0b e8 26 de 62 fe <0f> 0b e8 1f de 62 fe 0f 0b e8 18 de 62 fe 0f 0b e8 11 de 62 fe 0f
RSP: 0000:ffffc900034bee60 EFLAGS: 00010283
RAX: ffffffff8314e4ea RBX: ffff888023366014 RCX: 0000000000080000
RDX: ffffc9000f226000 RSI: 000000000000e867 RDI: 000000000000e868
RBP: ffffc900034bf190 R08: dffffc0000000000 R09: ffffed100bd370e5
R10: ffffed100bd370e5 R11: 1ffff1100bd370e4 R12: ffff888060628000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888023366014
FS: 00007f057f1c86c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0576e2b000 CR3: 000000005b918000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ocfs2_write_begin_nolock+0x3057/0x4180 fs/ocfs2/aops.c:1818
ocfs2_write_begin+0x1ab/0x300 fs/ocfs2/aops.c:1905
generic_perform_write+0x2aa/0x530 mm/filemap.c:3785
__generic_file_write_iter+0x25f/0x4e0 mm/filemap.c:3912
ocfs2_file_write_iter+0x1578/0x1cf0 fs/ocfs2/file.c:2472
call_write_iter include/linux/fs.h:2172 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x712/0xd00 fs/read_write.c:594
ksys_pwrite64 fs/read_write.c:701 [inline]
__do_sys_pwrite64 fs/read_write.c:711 [inline]
__se_sys_pwrite64 fs/read_write.c:708 [inline]
__x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f0581381929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f057f1c8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00007f05815a9080 RCX: 00007f0581381929
RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000005
RBP: 00007f0581403b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000008000c61 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f05815a9080 R15: 00007fffc5796fe8
</TASK>
Modules linked in:
---[ end trace bba04d2dd914a0ec ]---
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1181 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1cda/0x1d00 fs/ocfs2/aops.c:1242
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 61 a5 a2 8b ba 80 04 00 00 48 c7 c1 80 81 47 8a e8 ed 77 19 00 0f 0b e8 26 de 62 fe <0f> 0b e8 1f de 62 fe 0f 0b e8 18 de 62 fe 0f 0b e8 11 de 62 fe 0f
RSP: 0000:ffffc900034bee60 EFLAGS: 00010283
RAX: ffffffff8314e4ea RBX: ffff888023366014 RCX: 0000000000080000
RDX: ffffc9000f226000 RSI: 000000000000e867 RDI: 000000000000e868
RBP: ffffc900034bf190 R08: dffffc0000000000 R09: ffffed100bd370e5
R10: ffffed100bd370e5 R11: 1ffff1100bd370e4 R12: ffff888060628000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888023366014
FS: 00007f057f1c86c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff2a883fc8 CR3: 000000005b918000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 3dea0e7f549e Linux 5.15.186
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1429488c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=918afca6cf85eccf
dashboard link: https://syzkaller.appspot.com/bug?extid=c2b7126d949451e476cf
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b4e974189c3a/disk-3dea0e7f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/922e99f38be2/vmlinux-3dea0e7f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/59456f23f37e/bzImage-3dea0e7f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c2b712...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/ocfs2/aops.c:1181!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4410 Comm: syz.4.12 Not tainted 5.15.186-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1181 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1cda/0x1d00 fs/ocfs2/aops.c:1242
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 61 a5 a2 8b ba 80 04 00 00 48 c7 c1 80 81 47 8a e8 ed 77 19 00 0f 0b e8 26 de 62 fe <0f> 0b e8 1f de 62 fe 0f 0b e8 18 de 62 fe 0f 0b e8 11 de 62 fe 0f
RSP: 0000:ffffc900034bee60 EFLAGS: 00010283
RAX: ffffffff8314e4ea RBX: ffff888023366014 RCX: 0000000000080000
RDX: ffffc9000f226000 RSI: 000000000000e867 RDI: 000000000000e868
RBP: ffffc900034bf190 R08: dffffc0000000000 R09: ffffed100bd370e5
R10: ffffed100bd370e5 R11: 1ffff1100bd370e4 R12: ffff888060628000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888023366014
FS: 00007f057f1c86c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0576e2b000 CR3: 000000005b918000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ocfs2_write_begin_nolock+0x3057/0x4180 fs/ocfs2/aops.c:1818
ocfs2_write_begin+0x1ab/0x300 fs/ocfs2/aops.c:1905
generic_perform_write+0x2aa/0x530 mm/filemap.c:3785
__generic_file_write_iter+0x25f/0x4e0 mm/filemap.c:3912
ocfs2_file_write_iter+0x1578/0x1cf0 fs/ocfs2/file.c:2472
call_write_iter include/linux/fs.h:2172 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x712/0xd00 fs/read_write.c:594
ksys_pwrite64 fs/read_write.c:701 [inline]
__do_sys_pwrite64 fs/read_write.c:711 [inline]
__se_sys_pwrite64 fs/read_write.c:708 [inline]
__x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f0581381929
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f057f1c8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00007f05815a9080 RCX: 00007f0581381929
RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000005
RBP: 00007f0581403b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000008000c61 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f05815a9080 R15: 00007fffc5796fe8
</TASK>
Modules linked in:
---[ end trace bba04d2dd914a0ec ]---
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1181 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1cda/0x1d00 fs/ocfs2/aops.c:1242
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 61 a5 a2 8b ba 80 04 00 00 48 c7 c1 80 81 47 8a e8 ed 77 19 00 0f 0b e8 26 de 62 fe <0f> 0b e8 1f de 62 fe 0f 0b e8 18 de 62 fe 0f 0b e8 11 de 62 fe 0f
RSP: 0000:ffffc900034bee60 EFLAGS: 00010283
RAX: ffffffff8314e4ea RBX: ffff888023366014 RCX: 0000000000080000
RDX: ffffc9000f226000 RSI: 000000000000e867 RDI: 000000000000e868
RBP: ffffc900034bf190 R08: dffffc0000000000 R09: ffffed100bd370e5
R10: ffffed100bd370e5 R11: 1ffff1100bd370e4 R12: ffff888060628000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888023366014
FS: 00007f057f1c86c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff2a883fc8 CR3: 000000005b918000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jul 12, 2025, 7:13:31 AM7/12/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 2f693b607545 Linux 5.15.187
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=176610f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ffb429fe3ba39a3c
dashboard link: https://syzkaller.appspot.com/bug?extid=c2b7126d949451e476cf
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ab7bd4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11eac18c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/129cdeb1c037/disk-2f693b60.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f163e8700a20/vmlinux-2f693b60.xz
kernel image: https://storage.googleapis.com/syzbot-assets/22c8c0cbe264/Image-2f693b60.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/cd77d0ad37ae/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=11897e8c580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c2b712...@syzkaller.appspotmail.com
option from the mount to silence this warning.
=======================================================
ocfs2: Mounting device (7,0) on (node local, slot 0) with writeback data mode.
Modules linked in:
CPU: 0 PID: 4189 Comm: syz.0.16 Not tainted 5.15.187-syzkaller #0
pc : ocfs2_write_cluster fs/ocfs2/aops.c:1181 [inline]
pc : ocfs2_write_cluster_by_desc+0x17b8/0x17e4 fs/ocfs2/aops.c:1242
lr : ocfs2_write_cluster fs/ocfs2/aops.c:1181 [inline]
lr : ocfs2_write_cluster_by_desc+0x17b8/0x17e4 fs/ocfs2/aops.c:1242
sp : ffff80001fe46be0
x29: ffff80001fe46f00 x28: ffff0000dbf6a030 x27: dfff800000000000
x26: ffff0000dbf6a028 x25: ffff80001fe46d20 x24: ffff0000ee874178
x23: 0000000000000004 x22: 0000000000000000 x21: ffff0000ee8741a0
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082d6448 x15: 00000000fffffffc
x14: 0000000000ff0100 x13: 1ffff0000283006b x12: 0000000000ff0100
x11: 0000000000000000 x10: 0000000000000000 x9 : ffff800009c172d8
x8 : ffff0000d42b1b40 x7 : ffff800009c57600 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082d655c
x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
ocfs2_write_cluster fs/ocfs2/aops.c:1181 [inline]
ocfs2_write_cluster_by_desc+0x17b8/0x17e4 fs/ocfs2/aops.c:1242
ocfs2_write_begin_nolock+0x2724/0x3764 fs/ocfs2/aops.c:1818
ocfs2_write_begin+0x1b4/0x30c fs/ocfs2/aops.c:1905
generic_perform_write+0x204/0x480 mm/filemap.c:3785
__generic_file_write_iter+0x23c/0x454 mm/filemap.c:3912
ocfs2_file_write_iter+0x12e0/0x1b84 fs/ocfs2/file.c:2472
ksys_write+0x120/0x210 fs/read_write.c:647
__do_sys_write fs/read_write.c:659 [inline]
__se_sys_write fs/read_write.c:656 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:656
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 52809002 9405f302 d4210000 97a18be5 (d4210000)
---[ end trace fc6fa0033733bbaa ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 2f693b607545 Linux 5.15.187
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=176610f0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ffb429fe3ba39a3c
dashboard link: https://syzkaller.appspot.com/bug?extid=c2b7126d949451e476cf
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13ab7bd4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11eac18c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/129cdeb1c037/disk-2f693b60.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f163e8700a20/vmlinux-2f693b60.xz
kernel image: https://storage.googleapis.com/syzbot-assets/22c8c0cbe264/Image-2f693b60.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/cd77d0ad37ae/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=11897e8c580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c2b712...@syzkaller.appspotmail.com
=======================================================
ocfs2: Mounting device (7,0) on (node local, slot 0) with writeback data mode.
------------[ cut here ]------------
kernel BUG at fs/ocfs2/aops.c:1181!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
kernel BUG at fs/ocfs2/aops.c:1181!
Modules linked in:
CPU: 0 PID: 4189 Comm: syz.0.16 Not tainted 5.15.187-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ocfs2_write_cluster fs/ocfs2/aops.c:1181 [inline]
pc : ocfs2_write_cluster_by_desc+0x17b8/0x17e4 fs/ocfs2/aops.c:1242
lr : ocfs2_write_cluster fs/ocfs2/aops.c:1181 [inline]
lr : ocfs2_write_cluster_by_desc+0x17b8/0x17e4 fs/ocfs2/aops.c:1242
sp : ffff80001fe46be0
x29: ffff80001fe46f00 x28: ffff0000dbf6a030 x27: dfff800000000000
x26: ffff0000dbf6a028 x25: ffff80001fe46d20 x24: ffff0000ee874178
x23: 0000000000000004 x22: 0000000000000000 x21: ffff0000ee8741a0
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082d6448 x15: 00000000fffffffc
x14: 0000000000ff0100 x13: 1ffff0000283006b x12: 0000000000ff0100
x11: 0000000000000000 x10: 0000000000000000 x9 : ffff800009c172d8
x8 : ffff0000d42b1b40 x7 : ffff800009c57600 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082d655c
x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
ocfs2_write_cluster fs/ocfs2/aops.c:1181 [inline]
ocfs2_write_cluster_by_desc+0x17b8/0x17e4 fs/ocfs2/aops.c:1242
ocfs2_write_begin_nolock+0x2724/0x3764 fs/ocfs2/aops.c:1818
ocfs2_write_begin+0x1b4/0x30c fs/ocfs2/aops.c:1905
generic_perform_write+0x204/0x480 mm/filemap.c:3785
__generic_file_write_iter+0x23c/0x454 mm/filemap.c:3912
ocfs2_file_write_iter+0x12e0/0x1b84 fs/ocfs2/file.c:2472
call_write_iter include/linux/fs.h:2172 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x7c8/0xa2c fs/read_write.c:594
new_sync_write fs/read_write.c:507 [inline]
ksys_write+0x120/0x210 fs/read_write.c:647
__do_sys_write fs/read_write.c:659 [inline]
__se_sys_write fs/read_write.c:656 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:656
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: 52809002 9405f302 d4210000 97a18be5 (d4210000)
---[ end trace fc6fa0033733bbaa ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Jul 21, 2025, 6:19:37 PM7/21/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: d96eb99e2f0e Linux 6.6.99
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16d0f722580000
kernel config: https://syzkaller.appspot.com/x/.config?x=bfd82343ac39d3b
dashboard link: https://syzkaller.appspot.com/bug?extid=54ff8aa6d02ea5047e2e
disk image: https://storage.googleapis.com/syzbot-assets/11b332f11d00/disk-d96eb99e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8a063193b98f/vmlinux-d96eb99e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b36214b822e5/bzImage-d96eb99e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+54ff8a...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/ocfs2/aops.c:1180!
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 48 ae 62 8c ba 7f 04 00 00 48 c7 c1 c0 8a e9 8a e8 82 3a 1a 00 0f 0b e8 3b e5 39 fe <0f> 0b e8 34 e5 39 fe 0f 0b e8 2d e5 39 fe 0f 0b e8 26 e5 39 fe 0f
RSP: 0018:ffffc900043be540 EFLAGS: 00010293
RAX: ffffffff834bb0f5 RBX: ffff88802e82e014 RCX: ffff88805f3e1e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900043be870 R08: ffff88805ebc1563 R09: 1ffff1100bd782ac
R10: dffffc0000000000 R11: ffffed100bd782ad R12: ffff888020fa0000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88802e82e014
FS: 00007f2c541f16c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
Call Trace:
<TASK>
ocfs2_write_begin_nolock+0x2fcb/0x4190 fs/ocfs2/aops.c:1817
ocfs2_write_begin+0x1bc/0x310 fs/ocfs2/aops.c:1904
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4016
ocfs2_file_write_iter+0x1582/0x1d00 fs/ocfs2/file.c:2468
__kernel_write_iter+0x274/0x670 fs/read_write.c:517
dump_emit_page fs/coredump.c:957 [inline]
dump_user_range+0x3f6/0x800 fs/coredump.c:984
elf_core_dump+0x3114/0x36e0 fs/binfmt_elf.c:2184
do_coredump+0x1755/0x2480 fs/coredump.c:833
get_signal+0x1133/0x1400 kernel/signal.c:2888
arch_do_signal_or_restart+0x96/0x780 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315
exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 002b:0000200000000088 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f2c535b5fa0 RCX: 00007f2c5338e9a9
RDX: 0000200000000100 RSI: 0000200000000080 RDI: 0000000004000000
RBP: 00007f2c53410d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f2c535b5fa0 R15: 00007ffc743ddde8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1180 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 48 ae 62 8c ba 7f 04 00 00 48 c7 c1 c0 8a e9 8a e8 82 3a 1a 00 0f 0b e8 3b e5 39 fe <0f> 0b e8 34 e5 39 fe 0f 0b e8 2d e5 39 fe 0f 0b e8 26 e5 39 fe 0f
RSP: 0018:ffffc900043be540 EFLAGS: 00010293
RAX: ffffffff834bb0f5 RBX: ffff88802e82e014 RCX: ffff88805f3e1e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900043be870 R08: ffff88805ebc1563 R09: 1ffff1100bd782ac
R10: dffffc0000000000 R11: ffffed100bd782ad R12: ffff888020fa0000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88802e82e014
FS: 00007f2c541f16c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
syzbot found the following issue on:
HEAD commit: d96eb99e2f0e Linux 6.6.99
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16d0f722580000
kernel config: https://syzkaller.appspot.com/x/.config?x=bfd82343ac39d3b
dashboard link: https://syzkaller.appspot.com/bug?extid=54ff8aa6d02ea5047e2e
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/11b332f11d00/disk-d96eb99e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8a063193b98f/vmlinux-d96eb99e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b36214b822e5/bzImage-d96eb99e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
------------[ cut here ]------------
kernel BUG at fs/ocfs2/aops.c:1180!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6842 Comm: syz.6.195 Not tainted 6.6.99-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1180 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 48 ae 62 8c ba 7f 04 00 00 48 c7 c1 c0 8a e9 8a e8 82 3a 1a 00 0f 0b e8 3b e5 39 fe <0f> 0b e8 34 e5 39 fe 0f 0b e8 2d e5 39 fe 0f 0b e8 26 e5 39 fe 0f
RSP: 0018:ffffc900043be540 EFLAGS: 00010293
RAX: ffffffff834bb0f5 RBX: ffff88802e82e014 RCX: ffff88805f3e1e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900043be870 R08: ffff88805ebc1563 R09: 1ffff1100bd782ac
R10: dffffc0000000000 R11: ffffed100bd782ad R12: ffff888020fa0000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88802e82e014
FS: 00007f2c541f16c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f18ccbffd58 CR3: 000000002f9ee000 CR4: 00000000003526f0
Call Trace:
<TASK>
ocfs2_write_begin_nolock+0x2fcb/0x4190 fs/ocfs2/aops.c:1817
ocfs2_write_begin+0x1bc/0x310 fs/ocfs2/aops.c:1904
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4016
ocfs2_file_write_iter+0x1582/0x1d00 fs/ocfs2/file.c:2468
__kernel_write_iter+0x274/0x670 fs/read_write.c:517
dump_emit_page fs/coredump.c:957 [inline]
dump_user_range+0x3f6/0x800 fs/coredump.c:984
elf_core_dump+0x3114/0x36e0 fs/binfmt_elf.c:2184
do_coredump+0x1755/0x2480 fs/coredump.c:833
get_signal+0x1133/0x1400 kernel/signal.c:2888
arch_do_signal_or_restart+0x96/0x780 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315
exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 002b:0000200000000088 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f2c535b5fa0 RCX: 00007f2c5338e9a9
RDX: 0000200000000100 RSI: 0000200000000080 RDI: 0000000004000000
RBP: 00007f2c53410d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f2c535b5fa0 R15: 00007ffc743ddde8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1180 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 48 ae 62 8c ba 7f 04 00 00 48 c7 c1 c0 8a e9 8a e8 82 3a 1a 00 0f 0b e8 3b e5 39 fe <0f> 0b e8 34 e5 39 fe 0f 0b e8 2d e5 39 fe 0f 0b e8 26 e5 39 fe 0f
RSP: 0018:ffffc900043be540 EFLAGS: 00010293
RAX: ffffffff834bb0f5 RBX: ffff88802e82e014 RCX: ffff88805f3e1e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900043be870 R08: ffff88805ebc1563 R09: 1ffff1100bd782ac
R10: dffffc0000000000 R11: ffffed100bd782ad R12: ffff888020fa0000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88802e82e014
FS: 00007f2c541f16c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f18ccbffd58 CR3: 000000002f9ee000 CR4: 00000000003526f0
syzbot
Jul 25, 2025, 7:32:35 PM7/25/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: dbcb8d8e4163 Linux 6.6.100
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=174a0034580000
kernel config: https://syzkaller.appspot.com/x/.config?x=293251cfa8d8100
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d0b56817a2c3/disk-dbcb8d8e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f0d646b2f7fa/vmlinux-dbcb8d8e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1e0b752a5011/bzImage-dbcb8d8e.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2a3bbfcdb479/mount_2.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=147d50a2580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+54ff8a...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/ocfs2/aops.c:1180!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 6008 Comm: syz.2.18 Not tainted 6.6.100-syzkaller #0
RSP: 0018:ffffc900036d6540 EFLAGS: 00010293
RAX: ffffffff834bb3e5 RBX: ffff888078cf0014 RCX: ffff88806d8abc00
R10: dffffc0000000000 R11: ffffed100baf02ad R12: ffff88807d59c000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888078cf0014
FS: 000055557d7d5500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000004000000
RBP: 00007f97c5a10d69 R08: 0000000000000000 R09: 0000000000000000
RSP: 0018:ffffc900036d6540 EFLAGS: 00010293
RAX: ffffffff834bb3e5 RBX: ffff888078cf0014 RCX: ffff88806d8abc00
R10: dffffc0000000000 R11: ffffed100baf02ad R12: ffff88807d59c000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888078cf0014
FS: 000055557d7d5500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
HEAD commit: dbcb8d8e4163 Linux 6.6.100
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=174a0034580000
kernel config: https://syzkaller.appspot.com/x/.config?x=293251cfa8d8100
dashboard link: https://syzkaller.appspot.com/bug?extid=54ff8aa6d02ea5047e2e
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13f3fb82580000
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d0b56817a2c3/disk-dbcb8d8e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f0d646b2f7fa/vmlinux-dbcb8d8e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1e0b752a5011/bzImage-dbcb8d8e.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2a3bbfcdb479/mount_2.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=147d50a2580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+54ff8a...@syzkaller.appspotmail.com
------------[ cut here ]------------
kernel BUG at fs/ocfs2/aops.c:1180!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1180 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 74 ac 62 8c ba 7f 04 00 00 48 c7 c1 40 8b e9 8a e8 82 3a 1a 00 0f 0b e8 9b e1 39 fe <0f> 0b e8 94 e1 39 fe 0f 0b e8 8d e1 39 fe 0f 0b e8 86 e1 39 fe 0f
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1180 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
RSP: 0018:ffffc900036d6540 EFLAGS: 00010293
RAX: ffffffff834bb3e5 RBX: ffff888078cf0014 RCX: ffff88806d8abc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900036d6870 R08: ffff88805d781563 R09: 1ffff1100baf02ac
R10: dffffc0000000000 R11: ffffed100baf02ad R12: ffff88807d59c000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888078cf0014
FS: 000055557d7d5500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00001ffffffffec0 CR3: 000000007ba1c000 CR4: 00000000003506e0
Call Trace:
<TASK>
ocfs2_write_begin_nolock+0x2fcb/0x4190 fs/ocfs2/aops.c:1817
ocfs2_write_begin+0x1bc/0x310 fs/ocfs2/aops.c:1904
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4016
ocfs2_file_write_iter+0x1582/0x1d00 fs/ocfs2/file.c:2468
__kernel_write_iter+0x274/0x670 fs/read_write.c:517
dump_emit_page fs/coredump.c:957 [inline]
dump_user_range+0x3f6/0x800 fs/coredump.c:984
elf_core_dump+0x3114/0x36e0 fs/binfmt_elf.c:2184
do_coredump+0x1755/0x2480 fs/coredump.c:833
get_signal+0x1133/0x1400 kernel/signal.c:2888
arch_do_signal_or_restart+0x96/0x780 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315
exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 002b:0000200000000088 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f97c5bb5fa0 RCX: 00007f97c598e9a9
<TASK>
ocfs2_write_begin_nolock+0x2fcb/0x4190 fs/ocfs2/aops.c:1817
ocfs2_write_begin+0x1bc/0x310 fs/ocfs2/aops.c:1904
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4016
ocfs2_file_write_iter+0x1582/0x1d00 fs/ocfs2/file.c:2468
__kernel_write_iter+0x274/0x670 fs/read_write.c:517
dump_emit_page fs/coredump.c:957 [inline]
dump_user_range+0x3f6/0x800 fs/coredump.c:984
elf_core_dump+0x3114/0x36e0 fs/binfmt_elf.c:2184
do_coredump+0x1755/0x2480 fs/coredump.c:833
get_signal+0x1133/0x1400 kernel/signal.c:2888
arch_do_signal_or_restart+0x96/0x780 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315
exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x0
Code: Unable to access opcode bytes at 0xffffffffffffffd6.
RSP: 002b:0000200000000088 EFLAGS: 00010217
RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000004000000
RBP: 00007f97c5a10d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f97c5bb5fa0 R14: 00007f97c5bb5fa0 R15: 0000000000000006
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1180 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 74 ac 62 8c ba 7f 04 00 00 48 c7 c1 40 8b e9 8a e8 82 3a 1a 00 0f 0b e8 9b e1 39 fe <0f> 0b e8 94 e1 39 fe 0f 0b e8 8d e1 39 fe 0f 0b e8 86 e1 39 fe 0f
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1180 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
RSP: 0018:ffffc900036d6540 EFLAGS: 00010293
RAX: ffffffff834bb3e5 RBX: ffff888078cf0014 RCX: ffff88806d8abc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900036d6870 R08: ffff88805d781563 R09: 1ffff1100baf02ac
R10: dffffc0000000000 R11: ffffed100baf02ad R12: ffff88807d59c000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff888078cf0014
FS: 000055557d7d5500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9e89d7e000 CR3: 000000007ba1c000 CR4: 00000000003506e0
syzbot
Sep 29, 2025, 3:58:33 AM9/29/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 147338df3487 Linux 6.6.108
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16ad2ae2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=54ff8aa6d02ea5047e2e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=155b8334580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140beae2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/23d0a7436789/disk-147338df.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5658c8bd0cce/vmlinux-147338df.xz
kernel image: https://storage.googleapis.com/syzbot-assets/be243abccdbe/bzImage-147338df.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/c544198560d6/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=114f0942580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+54ff8a...@syzkaller.appspotmail.com
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RSP: 0018:ffffc900034a6ec0 EFLAGS: 00010293
RAX: ffffffff834c2605 RBX: ffff88802d132014 RCX: ffff888077febc00
R10: dffffc0000000000 R11: ffffed100bcaf805 R12: ffff88807b2d0000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88802d132014
FS: 0000555567dd0500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x43b/0x940 fs/read_write.c:584
ksys_write+0x147/0x250 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc7add8eec9
RAX: ffffffffffffffda RBX: 00007fc7adfe5fa0 RCX: 00007fc7add8eec9
RDX: 0000000000032600 RSI: 0000200000000100 RDI: 0000000000000004
RBP: 00007fc7ade11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc7adfe5fa0 R14: 00007fc7adfe5fa0 R15: 0000000000000003
RSP: 0018:ffffc900034a6ec0 EFLAGS: 00010293
RAX: ffffffff834c2605 RBX: ffff88802d132014 RCX: ffff888077febc00
R10: dffffc0000000000 R11: ffffed100bcaf805 R12: ffff88807b2d0000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88802d132014
FS: 0000555567dd0500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
HEAD commit: 147338df3487 Linux 6.6.108
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16ad2ae2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=54ff8aa6d02ea5047e2e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=155b8334580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140beae2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/23d0a7436789/disk-147338df.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5658c8bd0cce/vmlinux-147338df.xz
kernel image: https://storage.googleapis.com/syzbot-assets/be243abccdbe/bzImage-147338df.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/c544198560d6/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=114f0942580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+54ff8a...@syzkaller.appspotmail.com
option from the mount to silence this warning.
=======================================================
ocfs2: Mounting device (7,0) on (node local, slot 0) with writeback data mode.
=======================================================
ocfs2: Mounting device (7,0) on (node local, slot 0) with writeback data mode.
------------[ cut here ]------------
kernel BUG at fs/ocfs2/aops.c:1180!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 5945 Comm: syz.0.17 Not tainted syzkaller #0
kernel BUG at fs/ocfs2/aops.c:1180!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1180 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 8a d7 62 8c ba 7f 04 00 00 48 c7 c1 40 94 e9 8a e8 72 3b 1a 00 0f 0b e8 9b 71 39 fe <0f> 0b e8 94 71 39 fe 0f 0b e8 8d 71 39 fe 0f 0b e8 86 71 39 fe 0f
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
RSP: 0018:ffffc900034a6ec0 EFLAGS: 00010293
RAX: ffffffff834c2605 RBX: ffff88802d132014 RCX: ffff888077febc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900034a71f0 R08: ffff88805e57c023 R09: 1ffff1100bcaf804
R10: dffffc0000000000 R11: ffffed100bcaf805 R12: ffff88807b2d0000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88802d132014
FS: 0000555567dd0500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f94c03909c0 CR3: 000000007744b000 CR4: 00000000003506e0
Call Trace:
<TASK>
ocfs2_write_begin_nolock+0x2fcb/0x4190 fs/ocfs2/aops.c:1817
ocfs2_write_begin+0x1bc/0x310 fs/ocfs2/aops.c:1904
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4016
ocfs2_file_write_iter+0x1582/0x1d00 fs/ocfs2/file.c:2468
call_write_iter include/linux/fs.h:2018 [inline]
<TASK>
ocfs2_write_begin_nolock+0x2fcb/0x4190 fs/ocfs2/aops.c:1817
ocfs2_write_begin+0x1bc/0x310 fs/ocfs2/aops.c:1904
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4016
ocfs2_file_write_iter+0x1582/0x1d00 fs/ocfs2/file.c:2468
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x43b/0x940 fs/read_write.c:584
ksys_write+0x147/0x250 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc7add8eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc3f53d7e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fc7adfe5fa0 RCX: 00007fc7add8eec9
RDX: 0000000000032600 RSI: 0000200000000100 RDI: 0000000000000004
RBP: 00007fc7ade11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc7adfe5fa0 R14: 00007fc7adfe5fa0 R15: 0000000000000003
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1180 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
Code: 4c 8b 03 48 8d bc 24 10 02 00 00 48 c7 c6 8a d7 62 8c ba 7f 04 00 00 48 c7 c1 40 94 e9 8a e8 72 3b 1a 00 0f 0b e8 9b 71 39 fe <0f> 0b e8 94 71 39 fe 0f 0b e8 8d 71 39 fe 0f 0b e8 86 71 39 fe 0f
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ocfs2_write_cluster fs/ocfs2/aops.c:1180 [inline]
RIP: 0010:ocfs2_write_cluster_by_desc+0x1c75/0x1ca0 fs/ocfs2/aops.c:1241
RSP: 0018:ffffc900034a6ec0 EFLAGS: 00010293
RAX: ffffffff834c2605 RBX: ffff88802d132014 RCX: ffff888077febc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900034a71f0 R08: ffff88805e57c023 R09: 1ffff1100bcaf804
R10: dffffc0000000000 R11: ffffed100bcaf805 R12: ffff88807b2d0000
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88802d132014
FS: 0000555567dd0500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f94c03909c0 CR3: 000000007744b000 CR4: 00000000003506e0
Reply all
Reply to author
Forward
0 new messages