syzbot


kernel BUG in ext4_ext_insert_extent

Status: premoderation: reported syz repro on 2026/02/13 16:13
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+9d9d8d8b6ce244be271a@syzkaller.appspotmail.com
First crash: 3d10h, last: 3d07h
Bug presence (2)
Date Name Commit Repro Result
2026/02/14 lts (merge base) e50b81c50fcb syz [report] kernel BUG in ext4_ext_insert_extent
2026/02/14 upstream (ToT) f50822fd8675 syz [report] kernel BUG in ext4_ext_insert_extent
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in ext4_ext_insert_extent (2) ext4 -1 C done 36 11d 311d 0/29 upstream: reported C repro on 2025/04/11 16:16
android-54 kernel BUG in ext4_ext_insert_extent -1 1 1484d 1484d 0/2 auto-closed as invalid on 2022/05/24 20:39
upstream kernel BUG in ext4_ext_insert_extent ext4 -1 1 1810d 1806d 0/29 auto-closed as invalid on 2021/06/02 20:11
android-5-15 kernel BUG in ext4_ext_insert_extent origin:upstream -1 C 3 8d18h 8d18h 0/2 upstream: reported C repro on 2026/02/08 07:52
android-5-10 kernel BUG in ext4_ext_insert_extent -1 syz error 3 59d 146d 0/2 premoderation: reported syz repro on 2025/09/23 22:42

Sample crash report:
------------[ cut here ]------------
kernel BUG at fs/ext4/extents.c:2142!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8049 Comm: syz.0.300 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:ext4_ext_insert_extent+0x4790/0x47d0 fs/ext4/extents.c:2142
Code: ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c c6 e8 ff ff 4c 89 f7 e8 21 5a d1 ff e9 b9 e8 ff ff e8 97 2c 8c ff 0f 0b e8 90 2c 8c ff <0f> 0b e8 89 2c 8c ff 0f 0b 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 40
RSP: 0018:ffffc90003896440 EFLAGS: 00010293
RAX: ffffffff81e53f80 RBX: ffff888136dbb400 RCX: ffff8881192c5100
RDX: 0000000000000000 RSI: 0000000000000011 RDI: 0000000000000011
RBP: ffffc900038965f0 R08: ffff88813687fd27 R09: 1ffff11026d0ffa4
R10: dffffc0000000000 R11: ffffed1026d0ffa5 R12: 0000000000000011
R13: ffff888136ae0cd8 R14: ffff888136dbb43c R15: 0000000000000011
FS:  00007ff7aa9d46c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffecb6d1f6d CR3: 000000010d447000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ext4_ext_map_blocks+0x1869/0x61d0 fs/ext4/extents.c:4361
 ext4_map_blocks+0x9d8/0x1b70 fs/ext4/inode.c:679
 _ext4_get_block+0x1ea/0x540 fs/ext4/inode.c:822
 ext4_get_block_unwritten+0x2e/0x100 fs/ext4/inode.c:855
 ext4_block_write_begin+0x594/0x1280 fs/ext4/inode.c:1124
 ext4_write_begin+0x600/0xf90 fs/ext4/ext4_jbd2.h:-1
 ext4_da_write_begin+0x3e7/0x8c0 fs/ext4/inode.c:3001
 generic_perform_write+0x32d/0x740 mm/filemap.c:3903
 ext4_buffered_write_iter+0x367/0x630 fs/ext4/file.c:285
 ext4_file_write_iter+0x191/0x1500 fs/ext4/file.c:-1
 __kernel_write_iter+0x296/0x660 fs/read_write.c:517
 dump_emit_page fs/coredump.c:886 [inline]
 dump_user_range+0x40b/0x660 fs/coredump.c:913
 elf_core_dump+0x2b52/0x3060 fs/binfmt_elf.c:2354
 do_coredump+0x15d3/0x2240 fs/coredump.c:760
 get_signal+0x11db/0x1520 kernel/signal.c:2877
 arch_do_signal_or_restart+0xd1/0x1140 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:316
 irqentry_exit+0x12/0x40 kernel/entry/common.c:419
 exc_page_fault+0x5e/0xb0 arch/x86/mm/fault.c:1525
 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7ff7a9b9bf79
Code: Unable to access opcode bytes at 0x7ff7a9b9bf4f.
RSP: 002b:00007ff7aa9d3fd8 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 00007ff7a9e15fa0 RCX: 00007ff7a9b9bf79
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000a000
RBP: 00007ff7a9c327e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007ff7a9e16038 R14: 00007ff7a9e15fa0 R15: 00007ffecb6cf748
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ext4_ext_insert_extent+0x4790/0x47d0 fs/ext4/extents.c:2142
Code: ff 44 89 f1 80 e1 07 fe c1 38 c1 0f 8c c6 e8 ff ff 4c 89 f7 e8 21 5a d1 ff e9 b9 e8 ff ff e8 97 2c 8c ff 0f 0b e8 90 2c 8c ff <0f> 0b e8 89 2c 8c ff 0f 0b 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 40
RSP: 0018:ffffc90003896440 EFLAGS: 00010293
RAX: ffffffff81e53f80 RBX: ffff888136dbb400 RCX: ffff8881192c5100
RDX: 0000000000000000 RSI: 0000000000000011 RDI: 0000000000000011
RBP: ffffc900038965f0 R08: ffff88813687fd27 R09: 1ffff11026d0ffa4
R10: dffffc0000000000 R11: ffffed1026d0ffa5 R12: 0000000000000011
R13: ffff888136ae0cd8 R14: ffff888136dbb43c R15: 0000000000000011
FS:  00007ff7aa9d46c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f76ac3e41b8 CR3: 000000010d447000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/13 19:21 android14-6.1 edbe3e111301 1e62d198 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-android-6-1 kernel BUG in ext4_ext_insert_extent
2026/02/13 16:12 android14-6.1 edbe3e111301 6a673c50 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-android-6-1 kernel BUG in ext4_ext_insert_extent
* Struck through repros no longer work on HEAD.