linux-kernel - [BUG] kernel BUG in ext4_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAOU40uAhBkaPaL3rFn1ukLOM-GOu1uggbgiHpgbeewHsbMZjGA@mail.gmail.com>
Date: Wed, 14 Jan 2026 15:49:36 +0800
From: Xianying Wang <wangxianying546@...il.com>
To: tytso@....edu
Cc: adilger.kernel@...ger.ca, linux-ext4@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: [BUG] kernel BUG in ext4_do_writepages

Hi,

I am reporting a kernel BUG triggered in the ext4 writeback path,
reproducible with a syzkaller-generated workload on v6.18.0-rc7 and
v6.17.0.

The crash may caused by a violated internal assumption in
ext4_do_writepages() . During writeback, the code reaches a path that
assumes the inode is not using journaled data, but
ext4_should_journal_data(inode) evaluates to true, triggering a
BUG_ON() and crashing the kernel.

The BUG is triggered at:

: ext4_do_writepages()

specifically at the assertion:

BUG_ON(ext4_should_journal_data(inode));

>From code inspection, ext4_do_writepages() contains earlier logic to
handle journaled-data inodes by disabling mapping (mpd->can_map = 0).
However, later in the function, the code unconditionally asserts that
journaled data must not be in effect. This suggests an internal state
inconsistency: either the inode metadata indicates journaled data
unexpectedly, or the writeback state (mpd) allows the control flow to
reach a path that is incompatible with journaled data inodes.

This can be reproduced on:

HEAD commit:

v6.18-rc7: ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d

v6.17.0: e5f0a698b34ed76002dc5cff3804a61c80233a7a

report: https://pastebin.com/raw/t7sKi2aU

console output v6.18-rc7 :https://pastebin.com/raw/a88x4vQt

console output v6.17.0: https://pastebin.com/raw/s3cfkbmC

kernel config : https://pastebin.com/raw/1grwrT16

C reproducer :https://pastebin.com/raw/0nLHxWck

Let me know if you need more details or testing.

Best regards,

Xianying