ci2 starts bisection 2026-11-12 15:57:15.041034651 +0000 UTC m=+117.717716914 bisecting cause commit starting from 9d66f26fefacebfeed15de31c1123451a17ff119 building syzkaller on 8d68b303f501bf94495f2df32cf54aa7d98a15ff ensuring issue is reproducible on original commit 9d66f26fefacebfeed15de31c1123451a17ff119 testing commit 9d66f26fefacebfeed15de31c1123451a17ff119 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: f4480572b5836ddd9c555a02601228a0f5722e662181b6c43b108d117ea7ed3b all runs: crashed: general protection fault in jbd2_journal_file_inode representative crash: general protection fault in jbd2_journal_file_inode, types: [DoS] check whether we can drop unnecessary instrumentation disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed testing commit 9d66f26fefacebfeed15de31c1123451a17ff119 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: d200b2c420412356dfebd960e3b0c9ff0c5958ac9a1e266486c3ab33d31c31a7 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] the bug reproduces without the instrumentation disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed kconfig minimization: base=4206 full=8517 leaves diff=2102 split chunks (needed=false): <2102> split chunk #0 of len 2102 into 5 parts testing without sub-chunk 1/5 disabling configs for [kasan locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit 9d66f26fefacebfeed15de31c1123451a17ff119 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: b4c5fd904ef1841334f58d8974976ec259d3df0aaf29499cb72bb61c83eb1abf all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning kasan], they are not needed testing commit 9d66f26fefacebfeed15de31c1123451a17ff119 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 75fa8523e08628d833331754912b6094c72dc0943f4a84597c298565c96d6f5c all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed testing commit 9d66f26fefacebfeed15de31c1123451a17ff119 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 8b762cdebe00bcdd7028e33a5d4e86eb03810b7f94fd3970bd3aabef3b87c188 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [hang memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed testing commit 9d66f26fefacebfeed15de31c1123451a17ff119 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: b53fe1c5bf1bd85f6d2b61720f5df2383616c5b175ac197a8ee59987803d4885 all runs: OK false negative chance: 0.000 testing without sub-chunk 5/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning kasan locking], they are not needed testing commit 9d66f26fefacebfeed15de31c1123451a17ff119 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 3cef492eade688d4ff134cc33dfa49fa0c3f16e9f15bbd6f520e16d774608783 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] the chunk can be dropped minimized to 421 configs; suspects: [AF_RXRPC ATM BT BT_BREDR BT_HIDP BXT_WC_PMIC_OPREGION CFG80211 DAX DIBS DLM DMABUF_HEAPS DRM DVB_CORE ENCRYPTED_KEYS EXTCON GPIOLIB GUEST_PERF_EVENTS HAVE_CLK HID_NVIDIA_SHIELD HID_PLAYSTATION HID_SENSOR_HUB HID_SMARTJOYPLUS HID_STEAM HID_THRUSTMASTER IIO INFINIBAND INFINIBAND_ADDR_TRANS INFINIBAND_IPOIB INFINIBAND_USER_ACCESS INFINIBAND_VIRT_DMA INPUT_TABLET INPUT_TOUCHSCREEN INTEL_SCU_IPC INTEL_SOC_PMIC_BXTWC IP_SCTP L2TP LEDS_CLASS_MULTICOLOR LIBNVDIMM MAC80211 MEDIA_COMMON_OPTIONS MEDIA_DIGITAL_TV_SUPPORT MEDIA_PLATFORM_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_DLN2 MFD_INTEL_PMC_BXT MFD_MT6360 MFD_MT6370 MFD_RETU MMC MTD MTD_UBI NETFILTER_CONNCOUNT NET_IPGRE_DEMUX NLS_CODEPAGE_850 NLS_CODEPAGE_852 NLS_CODEPAGE_855 NLS_CODEPAGE_857 NLS_CODEPAGE_860 NLS_CODEPAGE_861 NLS_CODEPAGE_862 NLS_CODEPAGE_863 NLS_CODEPAGE_864 NLS_CODEPAGE_865 NLS_CODEPAGE_866 NLS_CODEPAGE_869 NLS_CODEPAGE_874 NLS_CODEPAGE_932 NLS_CODEPAGE_936 NLS_CODEPAGE_949 NLS_CODEPAGE_950 NLS_ISO8859_13 NLS_ISO8859_14 NLS_ISO8859_15 NLS_ISO8859_2 NLS_ISO8859_3 NLS_ISO8859_4 NLS_ISO8859_5 NLS_ISO8859_6 NLS_ISO8859_7 NLS_ISO8859_8 NLS_ISO8859_9 NLS_KOI8_R NLS_KOI8_U NLS_MAC_CELTIC NLS_MAC_CENTEURO NLS_MAC_CROATIAN NLS_MAC_CYRILLIC NLS_MAC_GAELIC NLS_MAC_GREEK NLS_MAC_ICELAND NLS_MAC_INUIT NLS_MAC_ROMAN NLS_MAC_ROMANIAN NLS_MAC_TURKISH NLS_UCS2_UTILS NOZOMI NTFS3_FS NTFS3_FS_POSIX_ACL NTFS3_LZX_XPRESS NULL_TTY NUMA_EMU NUMA_KEEP_MEMINFO NVDIMM_DAX NVDIMM_KEYS NVDIMM_PFN NVIDIA_SHIELD_FF NVME_CORE NVME_FABRICS NVME_FC NVME_MULTIPATH NVME_RDMA NVME_TARGET NVME_TARGET_FC NVME_TARGET_FCLOOP NVME_TARGET_LOOP NVME_TARGET_RDMA NVME_TARGET_TCP NVME_TCP N_GSM N_HDLC OCFS2_DEBUG_FS OCFS2_FS OCFS2_FS_O2CB OCFS2_FS_STATS OCFS2_FS_USERSPACE_CLUSTER OF_GPIO OF_PMEM OMFS_FS OPENVSWITCH OPTEE_STATIC_PROTMEM_POOL ORANGEFS_FS OSF_PARTITION OVERLAY_FS OVERLAY_FS_DEBUG OVERLAY_FS_INDEX OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW OVERLAY_FS_REDIRECT_DIR PACKET_DIAG PAGE_IDLE_FLAG PAGE_REPORTING PARPORT PARPORT_NOT_PC PARTITION_ADVANCED PCCARD PCCARD_NONSTATIC PCIEAER PCI_ENDPOINT PCI_IOV PCMCIA PCMCIA_LOAD_CIS PERCPU_STATS PERF_GUEST_MEDIATED_PMU PERSISTENT_KEYRINGS PHONET PHY_CPCAP_USB PHY_GOOGLE_USB PHY_QCOM_USB_HS PHY_QCOM_USB_HSIC PHY_SAMSUNG_USB2 PHY_TUSB1210 PKCS7_TEST_KEY PKCS8_PRIVATE_KEY_PARSER PLAYSTATION_FF PLFXLC PMIC_OPREGION PM_CLK PM_OPP PNFS_BLOCK_LAYOUT POSIX_AUX_CLOCKS PPP PPPOATM PPPOE PPPOE_HASH_BITS_1 PPPOL2TP PPPOX PPP_ASYNC PPP_BSDCOMP PPP_DEFLATE PPP_FILTER PPP_MPPE PPP_MULTILINK PPP_SYNC_TTY PPTP PREEMPT PREEMPT_NOTIFIERS PREEMPT_RT PROC_CHILDREN PSAMPLE PSI PSTORE PSTORE_COMPRESS QCOM_QMI_HELPERS QNX4FS_FS QNX6FS_FS QRTR QRTR_TUN RADIO_ADAPTERS RADIO_SHARK RADIO_SHARK2 RADIO_TEA575X RAID6_PQ RAID6_PQ_ARCH RAID_ATTRS RC_ATI_REMOTE RC_CORE RC_DEVICES RC_XBOX_DVD RDMA_RXE RDMA_SIW RDS RDS_RDMA RDS_TCP REALTEK_AUTOPM REED_SOLOMON REED_SOLOMON_DEC8 REGMAP REGMAP_I2C REGMAP_IRQ REGMAP_MMIO REGMAP_SPI REGULATOR REGULATOR_FIXED_VOLTAGE REGULATOR_TWL4030 RESET_CONTROLLER RFKILL RFKILL_INPUT RFKILL_LEDS RMI4_2D_SENSOR RMI4_CORE RMI4_F03 RMI4_F03_SERIO RMI4_F11 RMI4_F12 RMI4_F30 RMI4_F3A ROMFS_BACKED_BY_BOTH ROMFS_FS ROMFS_ON_BLOCK ROMFS_ON_MTD RSEQ_SLICE_EXTENSION RTC_DRV_HID_SENSOR_TIME RXKAD SCHED_CORE SCSI_FC_ATTRS SCSI_HPSA SCSI_ISCSI_ATTRS SCSI_LOGGING SCSI_NETLINK SCSI_SAS_ATA SCSI_SAS_ATTRS SCSI_SAS_LIBSAS SCSI_SCAN_ASYNC SCSI_SRP_ATTRS SCSI_UFSHCD SCSI_UFSHCD_PCI SCSI_UFS_BSG SCSI_UFS_FAULT_INJECTION SCTP_DEFAULT_COOKIE_HMAC_SHA256 SECONDARY_TRUSTED_KEYRING SECURITY_INFINIBAND SECURITY_NETWORK_XFRM SECURITY_SMACK_NETFILTER SENSORS_AQUACOMPUTER_D5NEXT SENSORS_CORSAIR_CPRO SENSORS_CORSAIR_PSU SENSORS_GIGABYTE_WATERFORCE SENSORS_NZXT_KRAKEN2 SENSORS_NZXT_SMART2 SENSORS_POWERZ SERIAL_DEV_BUS SERIAL_DEV_CTRL_TTYPORT SERIAL_MCTRL_GPIO SGI_PARTITION SIGNATURE SIGNED_PE_FILE_VERIFICATION SKB_DECRYPTED SLHC SLIP SLIP_COMPRESSED SLIP_MODE_SLIP6 SLIP_SMART SMARTJOYPLUS_FF SMBDIRECT SMBFS SMB_SERVER SMC SMC_DIAG SMSC_PHY SMS_SDIO_DRV SMS_SIANO_DEBUGFS SMS_SIANO_MDTV SMS_SIANO_RC SMS_USB_DRV SND SND_ALOOP SND_BCD2000 SND_CTL_FAST_LOOKUP SND_CTL_LED SND_DEBUG SND_DMA_SGBUF SND_DRIVERS SND_DUMMY SND_HDA SND_HDA_CODEC_ANALOG SND_HDA_CODEC_CA0110 SND_HDA_CODEC_CA0132 SND_HDA_CODEC_CIRRUS SND_HDA_CODEC_CMEDIA SND_HDA_CODEC_CONEXANT SND_HDA_CODEC_HDMI SND_HDA_CODEC_REALTEK SND_HDA_CODEC_SI3054 SND_HDA_CODEC_SIGMATEL SND_HDA_CODEC_VIA SND_HDA_CORE SND_HDA_GENERIC SND_HDA_GENERIC_LEDS SND_HDA_HWDEP SND_HDA_INPUT_BEEP SND_HDA_INTEL SND_HDA_PATCH_LOADER SND_HDA_RECONFIG SND_HRTIMER SND_HWDEP SND_INTEL_DSP_CONFIG SND_INTEL_NHLT SND_INTEL_SOUNDWIRE_ACPI SND_JACK SND_JACK_INPUT_DEV SND_MIXER_OSS SND_OSSEMUL SND_PCI SND_PCM SND_PCMCIA SND_PCM_OSS SND_PCM_OSS_PLUGINS SND_PCM_TIMER SND_PCM_XRUN_DEBUG SND_PROC_FS SND_RAWMIDI SND_SEQUENCER SND_SEQUENCER_OSS SND_SEQ_DEVICE SND_SEQ_DUMMY SND_SEQ_HRTIMER_DEFAULT SND_SEQ_MIDI SND_SEQ_MIDI_EVENT SND_SEQ_VIRMIDI SND_SOC SND_SOC_I2C_AND_SPI SND_SOC_SDCA_OPTIONAL SND_TIMER SND_UMP SND_UMP_LEGACY_RAWMIDI SND_USB SND_USB_6FIRE SND_USB_AUDIO SND_USB_AUDIO_MIDI_V2 SND_USB_AUDIO_USE_MEDIA_CONTROLLER SND_USB_CAIAQ SND_USB_CAIAQ_INPUT SND_USB_HIFACE SND_USB_LINE6 SND_USB_POD SND_USB_PODHD SND_USB_TONEPORT SND_USB_UA101 SND_USB_US122L SND_USB_USX2Y SND_USB_VARIAX SND_VERBOSE_PROCFS SND_VIRMIDI SND_VIRTIO SND_VMASTER SND_X86 SOCK_VALIDATE_XMIT SOLARIS_X86_PARTITION SONY_FF SOUND SOUNDWIRE SOUND_OSS_CORE SOUND_OSS_CORE_PRECLAIM SPI SPI_DLN2 SPI_DYNAMIC SPI_LJCA SPI_MASTER SQUASHFS SQUASHFS_4K_DEVBLK_SIZE SQUASHFS_COMPILE_DECOMP_MULTI SQUASHFS_DECOMP_MULTI SQUASHFS_FILE_DIRECT SQUASHFS_LZ4 SQUASHFS_LZO SQUASHFS_XATTR SQUASHFS_XZ SQUASHFS_ZLIB SQUASHFS_ZSTD SSB SSB_PCIHOST_POSSIBLE SSB_PCMCIAHOST_POSSIBLE SSB_SDIOHOST_POSSIBLE STEAM_FF STP STREAM_PARSER SUN_PARTITION SURFACE_AGGREGATOR SURFACE_AGGREGATOR_BUS SURFACE_AGGREGATOR_REGISTRY SURFACE_HID SURFACE_HID_CORE SURFACE_KBD SW_SYNC SYSFB SYSFS_SYSCALL SYSV68_PARTITION TABLET_USB_ACECAD TABLET_USB_AIPTEK TABLET_USB_HANWANG TABLET_USB_KBTAB TABLET_USB_PEGASUS TAHVO_USB TAHVO_USB_HOST_BY_DEFAULT TCG_CRB TCG_TIS TCG_TIS_CORE TCG_TPM TCP_CONG_BBR TCP_CONG_BIC TCP_CONG_CDG TCP_CONG_DCTCP TCP_CONG_HSTCP TCP_CONG_HTCP TCP_CONG_HYBLA TCP_CONG_ILLINOIS TCP_CONG_LP TCP_CONG_NV TCP_CONG_ROCCET TCP_CONG_SCALABLE TCP_CONG_VEGAS TCP_CONG_VENO TCP_CONG_WESTWOOD TCP_CONG_YEAH TEE TEE_DMABUF_HEAPS TEXTSEARCH TEXTSEARCH_BM TEXTSEARCH_FSM TEXTSEARCH_KMP THRUSTMASTER_FF TIPC TIPC_CRYPTO TIPC_DIAG TIPC_MEDIA_IB TIPC_MEDIA_UDP TMPFS_QUOTA TOOLS_SUPPORT_RELR TOUCHSCREEN_SUR40 TOUCHSCREEN_USB_3M TOUCHSCREEN_USB_COMPOSITE TOUCHSCREEN_USB_DMC_TSC10 TOUCHSCREEN_USB_E2I TOUCHSCREEN_USB_EASYTOUCH TOUCHSCREEN_USB_EGALAX TOUCHSCREEN_USB_ELO TOUCHSCREEN_USB_ETT_TC45USB TOUCHSCREEN_USB_ETURBO TOUCHSCREEN_USB_GENERAL_TOUCH TOUCHSCREEN_USB_GOTOP TOUCHSCREEN_USB_GUNZE TOUCHSCREEN_USB_IDEALTEK TOUCHSCREEN_USB_IRTOUCH TOUCHSCREEN_USB_ITM TOUCHSCREEN_USB_JASTEC TOUCHSCREEN_USB_NEXIO TOUCHSCREEN_USB_PANJIT TOUCHSCREEN_USB_ZYTRONIC TTPCI_EEPROM TTY_PRINTK TUN_VNET_CROSS_LE TWL4030_CORE TYPEC TYPEC_ANX7411 TYPEC_DP_ALTMODE TYPEC_FUSB302 TYPEC_HD3SS3220 TYPEC_MT6360 TYPEC_MUX_FSA4480 TYPEC_MUX_GPIO_SBU TYPEC_MUX_INTEL_PMC TYPEC_MUX_NB7VPQ904M TYPEC_MUX_PTN36502 TYPEC_MUX_WCD939X_USBSS TYPEC_NVIDIA_ALTMODE TYPEC_RT1711H TYPEC_RT1719 TYPEC_STUSB160X TYPEC_TCPCI TYPEC_TCPCI_MAXIM TYPEC_TCPCI_MT6370 TYPEC_TCPM TYPEC_TPS6598X TYPEC_UCSI TYPEC_WCOVE TYPEC_WUSB3801 UBIFS_ATIME_SUPPORT UBIFS_FS UBIFS_FS_ADVANCED_COMPR UBIFS_FS_LZO UBIFS_FS_SECURITY UBIFS_FS_XATTR UBIFS_FS_ZLIB UBIFS_FS_ZSTD UCSI_ACPI UCSI_CCG UCSI_STM32G0 UDF_FS UDMABUF UFS_FS UFS_FS_WRITE UHID ULTRIX_PARTITION UNICODE UNIXWARE_DISKLABEL UNIX_DIAG USB4 USB4_CONFIGFS USB4_NET USBIP_CORE USBIP_HOST USBIP_VHCI_HCD USBIP_VUDC USBPCWATCHDOG USB_ACM USB_ADUTUX USB_AIRSPY USB_ALI_M5632 USB_AN2720 USB_APPLEDISPLAY USB_ARMLINUX USB_BDC_UDC USB_BELKIN USB_C67X00_HCD USB_CATC USB_CDC_PHONET USB_CDNS2_UDC USB_CDNS3 USB_CDNS3_GADGET USB_CDNS3_HOST USB_CDNS3_PCI_WRAP USB_CDNSP_PCI USB_CDNS_SUPPORT USB_CHAOSKEY USB_CHIPIDEA USB_CHIPIDEA_GENERIC USB_CHIPIDEA_HOST USB_CHIPIDEA_MSM USB_DWC2 USB_GADGET USB_LJCA USB_MUSB_HDRC USB_NET_CDC_SUBSET USB_ROLE_SWITCH USB_STORAGE_REALTEK USB_ULPI_BUS USB_USBNET VIDEO_DEV WIRELESS WLAN WLAN_VENDOR_PURELIFI ZONE_DEVICE] disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep hang], they are not needed picked [v7.3 v7.2 v7.1 v6.19 v6.17 v6.15 v6.13 v6.11 v6.8 v6.5 v6.2 v5.19 v5.16 v5.13 v5.10 v5.7 v5.4 v5.1 v4.19] out of 46 release tags testing release v7.3 testing commit c03c1a14507dfaf8b856c2608f9ac216021fc222 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: b85a7864f38ff056e9a5d431a576fb4183b784466e5f6c8b8b655e035b867144 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] testing release v7.2 testing commit 8d3ae59288f1e7d58d76558a6ee96d533bc5019f gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: b0a49857b543b70e5f5065fb3df8c0a5722cf3c9a13bccea0da9a617069efbc9 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] testing release v7.1 testing commit 8cd9520d35a6c38db6567e97dd93b1f11f185dc6 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 5fbd5e73ddd8a376e47199182f5cf79faa3d37deff2da647b20157c3d6027d50 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] testing release v6.19 testing commit 05f7e89ab9731565d8a62e3b5d1ec206485eeb0b gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 194b6f9b8976a8f2017fc3daafade3c1f4f72c09aa28e747906efb1a06029fb4 all runs: OK false negative chance: 0.000 # git bisect start 8cd9520d35a6c38db6567e97dd93b1f11f185dc6 05f7e89ab9731565d8a62e3b5d1ec206485eeb0b Bisecting: 16425 revisions left to test after this (roughly 14 steps) [370c3883195566ee3e7d79e0146c3d735a406573] Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux testing commit 370c3883195566ee3e7d79e0146c3d735a406573 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: d212644dd7c67f15d3506d6344ae66a0138006fca9afcd8020963ccd77484f4a all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] # git bisect bad 370c3883195566ee3e7d79e0146c3d735a406573 Bisecting: 8151 revisions left to test after this (roughly 13 steps) [37a93dd5c49b5fda807fd204edf2547c3493319c] Merge tag 'net-next-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next testing commit 37a93dd5c49b5fda807fd204edf2547c3493319c gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 91cd23fd155e9dc0c1687d8cf3af3644d145bad812f85227e278e6d103b53a58 all runs: OK false negative chance: 0.000 # git bisect good 37a93dd5c49b5fda807fd204edf2547c3493319c Bisecting: 4052 revisions left to test after this (roughly 12 steps) [c7decec2f2d2ab0366567f9e30c0e1418cece43f] Merge tag 'perf-tools-for-v7.0-1-2026-02-21' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools testing commit c7decec2f2d2ab0366567f9e30c0e1418cece43f gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 47344cfd3ad7cc5baaa53f39a7fc7a391cb51d74d0311d0a17db4b43d116e452 all runs: OK false negative chance: 0.000 # git bisect good c7decec2f2d2ab0366567f9e30c0e1418cece43f Bisecting: 2028 revisions left to test after this (roughly 11 steps) [d2a43e7f89da55d6f0f96aaadaa243f35557291e] Merge tag 'hardening-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux testing commit d2a43e7f89da55d6f0f96aaadaa243f35557291e gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 64aa675bfa3f8c97fb9997cb70f346f43ed4f9f874cd93430540605f0adb73d1 all runs: OK false negative chance: 0.000 # git bisect good d2a43e7f89da55d6f0f96aaadaa243f35557291e Bisecting: 1047 revisions left to test after this (roughly 10 steps) [fc3d53288158d68444eed059adb734709b855bbf] btrfs: btrfs_log_dev_io_error() on all bio errors testing commit fc3d53288158d68444eed059adb734709b855bbf gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: af172e0b13ab4ed760c918d8219c87d2a8c6cc941994b66ab6215d1d5855b25b all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] # git bisect bad fc3d53288158d68444eed059adb734709b855bbf Bisecting: 482 revisions left to test after this (roughly 9 steps) [2ec9074b28a09a2cc4871371675bafc575a114c5] Merge tag 'sound-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound testing commit 2ec9074b28a09a2cc4871371675bafc575a114c5 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 5f703b00073c6fc422075befc84c3b4484675a9ef238c868ed348da3595c3937 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] # git bisect bad 2ec9074b28a09a2cc4871371675bafc575a114c5 Bisecting: 251 revisions left to test after this (roughly 8 steps) [196ef74abd3abb97a97fcf416ca9d59851fd1d08] Merge tag 'io_uring-7.0-20260327' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux testing commit 196ef74abd3abb97a97fcf416ca9d59851fd1d08 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 50449513bdb015dcfd81f7961536c3e3142cb413144eece3ce852a51d1b575d5 all runs: OK false negative chance: 0.000 # git bisect good 196ef74abd3abb97a97fcf416ca9d59851fd1d08 Bisecting: 125 revisions left to test after this (roughly 7 steps) [a3d97d1d3fa68253927a6e6c2fdfe7c039073af7] Merge tag 'ovl-fixes-7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs testing commit a3d97d1d3fa68253927a6e6c2fdfe7c039073af7 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 3d1a70c8bd0adec37639c25490ce409c9846f5dcdb8d9e6fd4344cf6d101ba90 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] # git bisect bad a3d97d1d3fa68253927a6e6c2fdfe7c039073af7 Bisecting: 64 revisions left to test after this (roughly 6 steps) [afb54c14047780b97719e8b6e4ea11a0cecc2739] Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi testing commit afb54c14047780b97719e8b6e4ea11a0cecc2739 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: d4a448e126b6995cb19f6065a57ba6c3231c711596b616406cefaa23473ace2a all runs: OK false negative chance: 0.000 # git bisect good afb54c14047780b97719e8b6e4ea11a0cecc2739 Bisecting: 30 revisions left to test after this (roughly 5 steps) [b51ad67773fbe9a03945843215b2cabffafa4084] Merge tag 'for-7.0-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux testing commit b51ad67773fbe9a03945843215b2cabffafa4084 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 7afb0f5d305a8672fbcb4afec3c816f7edc1c7d2a6e324dae901044f395a59d8 run #0: boot failed: can't ssh into the instance run #1: boot failed: can't ssh into the instance run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK false negative chance: 0.000 # git bisect good b51ad67773fbe9a03945843215b2cabffafa4084 Bisecting: 15 revisions left to test after this (roughly 4 steps) [5422fe71d26d42af6c454ca9527faaad4e677d6c] ext4: avoid infinite loops caused by residual data testing commit 5422fe71d26d42af6c454ca9527faaad4e677d6c gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 154a28d6e6136fe8b7b8845665bddee73416614a92027af777a036f71dcb95fe all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] # git bisect bad 5422fe71d26d42af6c454ca9527faaad4e677d6c Bisecting: 7 revisions left to test after this (roughly 3 steps) [1308255bbf8452762f89f44f7447ce137ecdbcff] ext4: fix fsync(2) for nojournal mode testing commit 1308255bbf8452762f89f44f7447ce137ecdbcff gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 472e0f1910a82cb8ee93d8756c3107214c31606cb596c6aae92d80f7f7b214a6 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] # git bisect bad 1308255bbf8452762f89f44f7447ce137ecdbcff Bisecting: 3 revisions left to test after this (roughly 2 steps) [f4a2b42e78914ff15630e71289adc589c3a8eb45] ext4: fix stale xarray tags after writeback testing commit f4a2b42e78914ff15630e71289adc589c3a8eb45 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 5e8bbd8cf5d5ef820936020728f7f6654b26edaabf124f9a525ab6571db3d791 all runs: OK false negative chance: 0.000 # git bisect good f4a2b42e78914ff15630e71289adc589c3a8eb45 Bisecting: 1 revision left to test after this (roughly 1 step) [b1d682f1990c19fb1d5b97d13266210457092bcd] ext4: fix journal credit check when setting fscrypt context testing commit b1d682f1990c19fb1d5b97d13266210457092bcd gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: e72d9721901dd9f752909db285abc4a02fad432b49bc72537a98f499954a56e7 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] # git bisect bad b1d682f1990c19fb1d5b97d13266210457092bcd Bisecting: 0 revisions left to test after this (roughly 0 steps) [ed9356a30e59c7cc3198e7fc46cfedf3767b9b17] ext4: convert inline data to extents when truncate exceeds inline size testing commit ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 gcc compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8 kernel signature: 9feedef47b2706ba67b488efb49b3e51a7e36a95b6141995417bac5309b15606 all runs: crashed: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode representative crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode, types: [NULL-POINTER-DEREFERENCE] # git bisect bad ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 is the first bad commit commit ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 Author: Deepanshu Kartikey Date: Sat Feb 7 10:06:07 2026 +0530 ext4: convert inline data to extents when truncate exceeds inline size Add a check in ext4_setattr() to convert files from inline data storage to extent-based storage when truncate() grows the file size beyond the inline capacity. This prevents the filesystem from entering an inconsistent state where the inline data flag is set but the file size exceeds what can be stored inline. Without this fix, the following sequence causes a kernel BUG_ON(): 1. Mount filesystem with inode that has inline flag set and small size 2. truncate(file, 50MB) - grows size but inline flag remains set 3. sendfile() attempts to write data 4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity) The crash occurs because ext4_write_inline_data() expects inline storage to accommodate the write, but the actual inline capacity (~60 bytes for i_block + ~96 bytes for xattrs) is far smaller than the file size and write request. The fix checks if the new size from setattr exceeds the inode's actual inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to extent-based storage before proceeding with the size change. This addresses the root cause by ensuring the inline data flag and file size remain consistent during truncate operations. Reported-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7de5fe447862fc37576f Tested-by: syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260207043607.1175976-1-kartikey406@gmail.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org fs/ext4/inode.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) accumulated error probability: 0.00 culprit signature: 9feedef47b2706ba67b488efb49b3e51a7e36a95b6141995417bac5309b15606 parent signature: 5e8bbd8cf5d5ef820936020728f7f6654b26edaabf124f9a525ab6571db3d791 revisions tested: 26, total time: 9h14m48.379284836s (build: 2h36m41.830709245s, test: 4h18m4.484121274s) first bad commit: ed9356a30e59c7cc3198e7fc46cfedf3767b9b17 ext4: convert inline data to extents when truncate exceeds inline size recipients (to): ["kartikey406@gmail.com" "syzbot+7de5fe447862fc37576f@syzkaller.appspotmail.com" "tytso@mit.edu"] recipients (cc): [] crash: BUG: unable to handle kernel NULL pointer dereference in jbd2_journal_file_inode loop3: detected capacity change from 0 to 49152 EXT4-fs (loop3): Using encoding defined by superblock: utf8-12.1.0 with flags 0x0 EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w with ordered data mode. Quota mode: journalled. BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 80000001175ef067 P4D 80000001175ef067 PUD 0 Oops: Oops: 0002 [#1] SMP PTI CPU: 1 UID: 0 PID: 3872 Comm: syz.3.17 Not tainted syzkaller #0 PREEMPT_{RT,(lazy)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 RIP: 0010:jbd2_journal_file_inode+0x5a/0x140 fs/jbd2/transaction.c:2658 Code: 41 f6 06 02 0f 85 da 00 00 00 48 89 cd 4d 89 c7 49 8d 9e c8 08 00 00 48 89 df 48 89 34 24 49 89 d5 e8 3a 5c 4a 01 48 8b 04 24 <4c> 09 68 28 48 8b 48 38 48 85 c9 74 18 48 8b 50 30 48 39 ea 48 0f RSP: 0018:ffffc90004577bf8 EFLAGS: 00010292 RAX: 0000000000000000 RBX: ffff8881076f98c8 RCX: 0000000000000000 RDX: 910272630ef0fe61 RSI: ffffffff83687027 RDI: 00000000ffffffff RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000b R10: 0000000000000000 R11: 2000000000000000 R12: ffff888109ca2780 R13: 0000000000000006 R14: ffff8881076f9000 R15: 00000000000007ff FS: 00007f0fda7bf6c0(0000) GS:ffff8881b72d5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000028 CR3: 00000001063be000 CR4: 00000000003506f0 Call Trace: ext4_jbd2_inode_add_write fs/ext4/ext4_jbd2.h:340 [inline] ext4_map_blocks+0x2ff/0x3c0 fs/ext4/inode.c:839 ext4_convert_inline_data_nolock+0xfb/0x320 fs/ext4/inline.c:1122 ext4_convert_inline_data+0x172/0x1d0 fs/ext4/inline.c:1986 ext4_setattr+0x391/0x780 fs/ext4/inode.c:5877 notify_change+0x304/0x350 fs/attr.c:556 do_truncate+0xda/0x120 fs/open.c:68 vfs_truncate+0xe5/0x110 fs/open.c:118 do_sys_truncate+0x73/0xf0 fs/open.c:142 __do_sys_truncate fs/open.c:154 [inline] __se_sys_truncate fs/open.c:152 [inline] __x64_sys_truncate+0x11/0x20 fs/open.c:152 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10f/0x3c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0fda968fd9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0fda7bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000004c RAX: ffffffffffffffda RBX: 00007f0fdabe5fa0 RCX: 00007f0fda968fd9 RDX: 0000000000000000 RSI: 0000000002fffffd RDI: 00002000000033c0 RBP: 00007f0fda9f7fed R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0fdabe6038 R14: 00007f0fdabe5fa0 R15: 00007ffd16463a68 Modules linked in: CR2: 0000000000000028 ---[ end trace 0000000000000000 ]--- RIP: 0010:jbd2_journal_file_inode+0x5a/0x140 fs/jbd2/transaction.c:2658 Code: 41 f6 06 02 0f 85 da 00 00 00 48 89 cd 4d 89 c7 49 8d 9e c8 08 00 00 48 89 df 48 89 34 24 49 89 d5 e8 3a 5c 4a 01 48 8b 04 24 <4c> 09 68 28 48 8b 48 38 48 85 c9 74 18 48 8b 50 30 48 39 ea 48 0f RSP: 0018:ffffc90004577bf8 EFLAGS: 00010292 RAX: 0000000000000000 RBX: ffff8881076f98c8 RCX: 0000000000000000 RDX: 910272630ef0fe61 RSI: ffffffff83687027 RDI: 00000000ffffffff RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000000b R10: 0000000000000000 R11: 2000000000000000 R12: ffff888109ca2780 R13: 0000000000000006 R14: ffff8881076f9000 R15: 00000000000007ff FS: 00007f0fda7bf6c0(0000) GS:ffff8881b72d5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000028 CR3: 00000001063be000 CR4: 00000000003506f0 ---------------- Code disassembly (best guess): 0: 41 f6 06 02 testb $0x2,(%r14) 4: 0f 85 da 00 00 00 jne 0xe4 a: 48 89 cd mov %rcx,%rbp d: 4d 89 c7 mov %r8,%r15 10: 49 8d 9e c8 08 00 00 lea 0x8c8(%r14),%rbx 17: 48 89 df mov %rbx,%rdi 1a: 48 89 34 24 mov %rsi,(%rsp) 1e: 49 89 d5 mov %rdx,%r13 21: e8 3a 5c 4a 01 call 0x14a5c60 26: 48 8b 04 24 mov (%rsp),%rax * 2a: 4c 09 68 28 or %r13,0x28(%rax) <-- trapping instruction 2e: 48 8b 48 38 mov 0x38(%rax),%rcx 32: 48 85 c9 test %rcx,%rcx 35: 74 18 je 0x4f 37: 48 8b 50 30 mov 0x30(%rax),%rdx 3b: 48 39 ea cmp %rbp,%rdx 3e: 48 rex.W 3f: 0f .byte 0xf