kernel BUG in ext4_split_extent_at

Status: upstream: reported C repro on 2026/03/11 06:35
Reported-by: syzbot+2bca6fe615e588a77cb9@syzkaller.appspotmail.com
First crash: 153d, last: 137d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2026/07/13 upstream (ToT) a13c140cc289 C Failed due to an error; will retry later
▶ ▼ Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in ext4_split_extent_at ext4 -1 1 1645d 1641d 0/29 auto-closed as invalid on 2022/06/08 01:32
android-5-10 kernel BUG in ext4_split_extent_at -1 syz, C error error 25 93d 1159d 0/2 upstream: reported C repro on 2023/06/09 00:07
upstream kernel BUG in ext4_split_extent_at (2) ext4 -1 syz, C error done 3 960d 1155d 25/29 fixed on 2024/01/30 15:47
android-6-1 kernel BUG in ext4_split_extent_at (3) -1 2 138d 155d 0/2 auto-obsoleted due to no activity on 2026/06/24 18:09
android-6-1 kernel BUG in ext4_split_extent_at missing-backport origin:upstream -1 syz, C error error 1 698d 1159d 0/2 auto-obsoleted due to no activity on 2024/12/21 09:12
android-6-1 kernel BUG in ext4_split_extent_at (2) origin:lts -1 syz, C done 1 392d 392d 0/2 auto-obsoleted due to no activity on 2025/10/22 23:15
upstream kernel BUG in ext4_split_extent_at (3) ext4 -1 3 396d 411d 0/29 auto-obsoleted due to no activity on 2025/10/19 20:03
android-5-15 kernel BUG in ext4_split_extent_at origin:upstream missing-backport -1 syz, C error error 12 11d 439d 0/2 upstream: reported C repro on 2025/05/29 02:28

Sample crash report:
EXT4-fs error (device loop2): ext4_mb_release_inode_pa:4890: group 0, free 0, pa_free 1
------------[ cut here ]------------
kernel BUG at fs/ext4/extents.c:3190!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4715 Comm: syz.2.60 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/26/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ext4_split_extent_at+0xc38/0xc7c fs/ext4/extents.c:3190
lr : ext4_split_extent_at+0xc38/0xc7c fs/ext4/extents.c:3190
sp : ffff800021df6b40
x29: ffff800021df6c40 x28: 0000000000000011 x27: 000000000000000a
x26: 000000000000001b x25: ffff0000f7cca436 x24: ffff0000e9e402b0
x23: ffff7000043bed7c x22: ffff0000f7cca434 x21: 0000000000000031
x20: ffff0000f7cca430 x19: 000000000000000a x18: ffff800011b8bf60
x17: 1fffe00033ea877e x16: ffff8000082d7ca0 x15: 0000000000000000
x14: 0000000000000002 x13: 1fffe0001e609748 x12: 0000000000ff0100
x11: ff00800008d32a30 x10: 0000000000000000 x9 : ffff800008d32a30
x8 : ffff0000d9929bc0 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 000000004000043b x4 : 0000000000000010 x3 : 0000000000000031
x2 : ffff800021df6e80 x1 : 000000000000001b x0 : 0000000000000031
Call trace:
 ext4_split_extent_at+0xc38/0xc7c fs/ext4/extents.c:3190
 ext4_split_extent+0x300/0x430 fs/ext4/extents.c:3391
 ext4_split_convert_extents fs/ext4/extents.c:3721 [inline]
 ext4_ext_handle_unwritten_extents fs/ext4/extents.c:3882 [inline]
 ext4_ext_map_blocks+0x10b4/0x56f4 fs/ext4/extents.c:4237
 ext4_map_blocks+0x860/0x1778 fs/ext4/inode.c:679
 mpage_map_one_extent fs/ext4/inode.c:2434 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2487 [inline]
 ext4_writepages+0xdbc/0x28b4 fs/ext4/inode.c:2855
 do_writepages+0x2b0/0x504 mm/page-writeback.c:2491
 filemap_fdatawrite_wbc+0x124/0x174 mm/filemap.c:388
 __filemap_fdatawrite_range mm/filemap.c:421 [inline]
 file_write_and_wait_range+0x11c/0x1f4 mm/filemap.c:774
 ext4_sync_file+0x210/0xc70 fs/ext4/fsync.c:151
 vfs_fsync_range+0x168/0x188 fs/sync.c:188
 generic_write_sync include/linux/fs.h:2962 [inline]
 ext4_buffered_write_iter+0x47c/0x528 fs/ext4/file.c:292
 ext4_file_write_iter+0x18c/0x1574 fs/ext4/file.c:-1
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x3ec/0x7f0 fs/read_write.c:584
 ksys_pwrite64 fs/read_write.c:699 [inline]
 __do_sys_pwrite64 fs/read_write.c:709 [inline]
 __se_sys_pwrite64 fs/read_write.c:706 [inline]
 __arm64_sys_pwrite64+0x174/0x20c fs/read_write.c:706
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b4 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x130 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1503e0 97eecb6b 17ffff05 97dde223 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/11 10:04 linux-6.1.y f2ddafa93a25 86914af9 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 kernel BUG in ext4_split_extent_at
2026/03/26 21:19 linux-6.1.y 1989cd3d56e2 766b6434 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ext4_split_extent_at
2026/03/11 06:34 linux-6.1.y f2ddafa93a25 86914af9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ext4_split_extent_at
* Struck through repros no longer work on HEAD.