[v6.1] kernel BUG in __ocfs2_flush_truncate_log

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 344a09659766 Linux 6.1.131
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14e18de4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=14d5dbae75afa499
dashboard link: https://syzkaller.appspot.com/bug?extid=9ff29b024b1d301f7588
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8c94453bbad3/disk-344a0965.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6bf26518c790/vmlinux-344a0965.xz
kernel image: https://storage.googleapis.com/syzbot-assets/424da9a470eb/Image-344a0965.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9ff29b...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/ocfs2/alloc.c:6004!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4307 Comm: syz-executor Not tainted 6.1.131-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __ocfs2_flush_truncate_log+0x102c/0x1260 fs/ocfs2/alloc.c:6004
lr : __ocfs2_flush_truncate_log+0x102c/0x1260 fs/ocfs2/alloc.c:6004
sp : ffff8000212c7560
x29: ffff8000212c7760 x28: 1fffe0001b0e91e5 x27: dfff800000000000
x26: ffff700004258ec4 x25: ffff0000f2c8d400 x24: ffff0000f50796b8
x23: ffff0000d8748f20 x22: ffff0000d8748f28 x21: 00000000ffffffff
x20: ffff0000d8748000 x19: ffff0000f9373a00 x18: ffff8000212c6d40
x17: ffff800018c58000 x16: ffff8000122dd0e4 x15: ffff800018738f80
x14: 1ffff00002b600b2 x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff800009eda11c
x8 : ffff0000d8a78000 x7 : ffff800009edb0f0 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082fd590
x2 : 0000000000000001 x1 : 00000000ffffffff x0 : 0000000000000000
Call trace:
__ocfs2_flush_truncate_log+0x102c/0x1260 fs/ocfs2/alloc.c:6004
ocfs2_flush_truncate_log+0x4c/0x6c fs/ocfs2/alloc.c:6069
ocfs2_sync_fs+0x110/0x31c fs/ocfs2/super.c:402
sync_filesystem+0x1a0/0x218 fs/sync.c:66
generic_shutdown_super+0x70/0x328 fs/super.c:474
kill_block_super+0x70/0xdc fs/super.c:1470
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x240/0x2f0 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
do_notify_resume+0x2080/0x2cb8 arch/arm64/kernel/signal.c:1132
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 17fffeec 97986abb d4210000 97986ab9 (d4210000)
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 344a09659766 Linux 6.1.131
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=16c2643f980000

kernel config: https://syzkaller.appspot.com/x/.config?x=14d5dbae75afa499
dashboard link: https://syzkaller.appspot.com/bug?extid=9ff29b024b1d301f7588
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15ce4198580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17dd4de4580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8c94453bbad3/disk-344a0965.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6bf26518c790/vmlinux-344a0965.xz
kernel image: https://storage.googleapis.com/syzbot-assets/424da9a470eb/Image-344a0965.gz.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/726fc766374c/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=14cfd24c580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9ff29b...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at fs/ocfs2/alloc.c:6004!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:

CPU: 0 PID: 4326 Comm: syz-executor239 Not tainted 6.1.131-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __ocfs2_flush_truncate_log+0x102c/0x1260 fs/ocfs2/alloc.c:6004
lr : __ocfs2_flush_truncate_log+0x102c/0x1260 fs/ocfs2/alloc.c:6004

sp : ffff8000211f7560
x29: ffff8000211f7760 x28: 1fffe000187af9e5 x27: dfff800000000000
x26: ffff70000423eec4 x25: ffff0000cb06cc00 x24: ffff0000ead30878
x23: ffff0000c3d7cf20 x22: ffff0000c3d7cf28 x21: 00000000ffffffff
x20: ffff0000c3d7c000 x19: ffff0000e83d5a00 x18: 1fffe00036798576
x17: ffff800015afd000 x16: ffff8000122dd0e4 x15: ffff0001b3cc2bbc

x14: 1ffff00002b600b2 x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff800009eda11c

x8 : ffff0000c9d40000 x7 : ffff800009edb0f0 x6 : 0000000000000000

x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082fd590
x2 : 0000000000000001 x1 : 00000000ffffffff x0 : 0000000000000000
Call trace:
__ocfs2_flush_truncate_log+0x102c/0x1260 fs/ocfs2/alloc.c:6004
ocfs2_flush_truncate_log+0x4c/0x6c fs/ocfs2/alloc.c:6069
ocfs2_sync_fs+0x110/0x31c fs/ocfs2/super.c:402
sync_filesystem+0x1a0/0x218 fs/sync.c:66
generic_shutdown_super+0x70/0x328 fs/super.c:474
kill_block_super+0x70/0xdc fs/super.c:1470
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x240/0x2f0 kernel/task_work.c:203
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
do_notify_resume+0x2080/0x2cb8 arch/arm64/kernel/signal.c:1132
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 17fffeec 97986abb d4210000 97986ab9 (d4210000)
---[ end trace 0000000000000000 ]---


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.