linux-kernel - Re: [syzbot] [ocfs2?] kernel BUG in __ocfs2_move_extents

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <68fb5dd7.050a0220.346f24.00c1.GAE@google.com>
Date: Fri, 24 Oct 2025 04:07:03 -0700
From: syzbot <syzbot+f2107d999290b8166267@...kaller.appspotmail.com>
To: dmantipov@...dex.ru, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [ocfs2?] kernel BUG in __ocfs2_move_extents_range

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in __ocfs2_move_extents_range

------------[ cut here ]------------
kernel BUG at fs/ocfs2/suballoc.c:1396!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 UID: 0 PID: 7437 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : ocfs2_block_group_set_bits+0x780/0x8ec fs/ocfs2/suballoc.c:1396
lr : ocfs2_block_group_set_bits+0x780/0x8ec fs/ocfs2/suballoc.c:1396
sp : ffff8000a13571a0
x29: ffff8000a1357260 x28: ffff0000dcf1cfb8 x27: ffff0000ca040000
x26: ffff0000db626630 x25: ffff0000c6fcb000 x24: 1ffff0001426ae40
x23: ffff0000c6fcb00c x22: dfff800000000000 x21: 0000000000000002
x20: 00000000000000ff x19: 0000000000000000 x18: 1fffe00033970070
x17: ffff80008ed4d000 x16: ffff80008a937600 x15: 0000000000000001
x14: 0000000000000000 x13: 00000000fffffffc x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : ffff0000d6fe8000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 00000000000000ff x4 : 0000000000000001 x3 : ffff0000e115c0e8
x2 : ffff0000c6fcb000 x1 : 0000000000000002 x0 : 00000000000000ff
Call trace:
 ocfs2_block_group_set_bits+0x780/0x8ec fs/ocfs2/suballoc.c:1396
 ocfs2_move_extent fs/ocfs2/move_extents.c:693 [inline]
 __ocfs2_move_extents_range+0x20ec/0x2abc fs/ocfs2/move_extents.c:866
 ocfs2_move_extents+0x314/0x7ec fs/ocfs2/move_extents.c:933
 ocfs2_ioctl_move_extents+0x448/0x614 fs/ocfs2/move_extents.c:1065
 ocfs2_ioctl+0x1c4/0x738 fs/ocfs2/ioctl.c:946
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:893
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:735
 el0t_64_sync_handler+0x90/0xfc arch/arm64/kernel/entry-common.c:754
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
Code: 17ffffa8 979ad94a d4210000 979ad948 (d4210000) 
---[ end trace 0000000000000000 ]---


Tested on:

commit:         4fc43deb Linux 6.12.55
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-6.12.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16e193e2580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=4c2423b3cd696bce
dashboard link: https://syzkaller.appspot.com/bug?extid=f2107d999290b8166267
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17582d2f980000