kernel BUG in ocfs2_remove_extent

Status: upstream: reported C repro on 2025/08/11 12:06
Bug presence: origin:upstream
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+8abfb36e428abc49ae66@syzkaller.appspotmail.com
First crash: 348d, last: 191d
Fix bisection: the issue occurs on the latest tested release (bisect log)
Crash: kernel BUG in ocfs2_remove_extent (log)
Repro: C syz .config
  
▶ ▼ Bug presence (3)
Date Name Commit Repro Result
2025/12/21 linux-6.1.y (ToT) 50cbba13faa2 C [report] possible deadlock in ocfs2_get_system_file_inode
2025/09/21 upstream (ToT) f975f08c2e89 C [report] kernel BUG in ocfs2_remove_extent
2025/12/21 upstream (ToT) 9094662f6707 C Didn't crash
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 kernel BUG in ocfs2_remove_extent origin:upstream -1 syz error 8 14d 327d 0/3 upstream: reported syz repro on 2025/09/02 01:23
linux-6.6 kernel BUG in ocfs2_remove_extent origin:upstream missing-backport -1 C done 14 196d 321d 0/2 upstream: reported C repro on 2025/09/07 12:51
upstream kernel BUG in ocfs2_remove_extent ocfs2 -1 C error done 56 230d 420d 0/29 auto-obsoleted due to no activity on 2026/02/15 15:07
▶ ▼ Fix bisection attempts (7)
Created Duration User Patch Repo Result
2026/07/10 07:40 2h56m fix candidate upstream OK (0) job log
2026/05/24 12:22 12m fix candidate upstream error job log
2026/03/27 06:30 1m fix candidate upstream error job log
2026/02/24 03:08 1m fix candidate upstream error job log
2026/01/23 03:29 1m fix candidate upstream error job log
2025/12/03 19:27 2h02m bisect fix linux-6.1.y OK (0) job log log
2025/10/14 22:49 1h47m bisect fix linux-6.1.y OK (0) job log log

Sample crash report:
------------[ cut here ]------------
kernel BUG at fs/ocfs2/alloc.c:5574!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4614 Comm: syz.2.19 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ocfs2_remove_extent+0x1b14/0x1d0c fs/ocfs2/alloc.c:5574
lr : ocfs2_remove_extent+0x1b14/0x1d0c fs/ocfs2/alloc.c:5574
sp : ffff800021a96340
x29: ffff800021a96640 x28: ffff0000f63144d4 x27: 1fffe0001ec6289a
x26: ffff800021a96ad8 x25: dfff800000000000 x24: 0000000000000002
x23: 0000000000000001 x22: 0000000000000000 x21: 0000000000000000
x20: ffff0000d4524910 x19: ffff0000d4524900 x18: ffff800011abbcc0
x17: ffff8000181f9000 x16: ffff8000082d22d4 x15: 0000000000000000
x14: 00000000fffffffc x13: 0000000000ff0100 x12: 0000000000ff0100
x11: ff00800009cbbb78 x10: 0000000000000000 x9 : ffff800009cbbb78
x8 : ffff0000c8571bc0 x7 : ffff8000081ce214 x6 : ffff8000081a18b4
x5 : ffff0000f1986410 x4 : ffff800021a96540 x3 : ffff800009cad91c
x2 : 0000000000000000 x1 : 0000000000000001 x0 : 0000000000000002
Call trace:
 ocfs2_remove_extent+0x1b14/0x1d0c fs/ocfs2/alloc.c:5574
 ocfs2_remove_btree_range+0xc58/0x11c4 fs/ocfs2/alloc.c:5771
 ocfs2_commit_truncate+0x820/0x1864 fs/ocfs2/alloc.c:7354
 ocfs2_truncate_for_delete fs/ocfs2/inode.c:623 [inline]
 ocfs2_wipe_inode fs/ocfs2/inode.c:790 [inline]
 ocfs2_delete_inode fs/ocfs2/inode.c:1079 [inline]
 ocfs2_evict_inode+0xe0c/0x3d20 fs/ocfs2/inode.c:1216
 evict+0x3c8/0x810 fs/inode.c:705
 iput_final fs/inode.c:1834 [inline]
 iput+0x764/0x7f4 fs/inode.c:1860
 ocfs2_dentry_iput+0x1d4/0x2d4 fs/ocfs2/dcache.c:418
 dentry_unlink_inode+0x348/0x438 fs/dcache.c:403
 __dentry_kill+0x320/0x598 fs/dcache.c:611
 dentry_kill+0xc8/0x248 fs/dcache.c:-1
 dput+0x238/0x454 fs/dcache.c:918
 __fput+0x480/0x7c0 fs/file_table.c:328
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1ec/0x270 kernel/task_work.c:203
 exit_task_work include/linux/task_work.h:39 [inline]
 do_exit+0x54c/0x19a8 kernel/exit.c:880
 do_group_exit+0x194/0x22c kernel/exit.c:1022
 get_signal+0x11d0/0x1310 kernel/signal.c:2871
 do_signal arch/arm64/kernel/signal.c:1081 [inline]
 do_notify_resume+0x290/0x2b0c arch/arm64/kernel/signal.c:1134
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_da+0xb4/0x154 arch/arm64/kernel/entry-common.c:516
 el0t_64_sync_handler+0x90/0xf0 arch/arm64/kernel/entry-common.c:658
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: aa1a03e0 97b06b6f 17fffe9a 979f97f1 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/07 05:04 linux-6.1.y 28c695c365e1 d291dd2d .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-1-kasan-arm64 kernel BUG in ocfs2_remove_extent
2025/08/11 14:17 linux-6.1.y 3594f306da12 32a0e5ed .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-1-kasan kernel BUG in ocfs2_remove_extent
2025/12/13 19:28 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan kernel BUG in ocfs2_remove_extent
2025/08/11 12:06 linux-6.1.y 3594f306da12 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan kernel BUG in ocfs2_remove_extent
2026/01/15 13:40 linux-6.1.y bec0e10ee67e d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ocfs2_remove_extent
2026/01/03 14:53 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ocfs2_remove_extent
2025/11/02 16:51 linux-6.1.y f6e38ae624cf 2c50b6a9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ocfs2_remove_extent
2025/10/27 07:16 linux-6.1.y 8e6e2188d949 c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ocfs2_remove_extent
2025/09/07 04:07 linux-6.1.y 28c695c365e1 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in ocfs2_remove_extent
* Struck through repros no longer work on HEAD.