syzbot


kernel BUG in ocfs2_claim_suballoc_bits

Status: upstream: reported C repro on 2025/11/09 13:08
Bug presence: origin:lts-only
[Documentation on labels]
Reported-by: syzbot+a11ccf24c7d55bec632b@syzkaller.appspotmail.com
First crash: 18d, last: 18d
Bug presence (2)
Date Name Commit Repro Result
2025/11/09 linux-6.6.y (ToT) 0a805b6ea8cd C [report] kernel BUG in ocfs2_claim_suballoc_bits
2025/11/09 upstream (ToT) f850568efe3a C Didn't crash
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in ocfs2_claim_suballoc_bits ocfs2 -1 C inconclusive 1678 10h33m 463d 0/29 upstream: reported C repro on 2024/08/22 08:11
linux-6.1 kernel BUG in ocfs2_claim_suballoc_bits origin:upstream -1 C 25 16d 360d 0/3 upstream: reported C repro on 2024/12/02 23:45
linux-5.15 kernel BUG in ocfs2_claim_suballoc_bits origin:upstream -1 C 31 30d 396d 0/3 upstream: reported C repro on 2024/10/28 07:17

Sample crash report:
ocfs2: Mounting device (7,0) on (node local, slot 0) with writeback data mode.
(syz.0.17,5953,0):ocfs2_read_blocks_sync:112 ERROR: status = -12
(syz.0.17,5953,0):update_backups:188 ERROR: status = -12
ocfs2: Failed to update super blocks on 7,0 during fs resize. This condition is not fatal, but fsck.ocfs2 should be run to fix it
------------[ cut here ]------------
kernel BUG at fs/ocfs2/suballoc.c:1349!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 5953 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:ocfs2_block_group_set_bits+0x53e/0x670 fs/ocfs2/suballoc.c:1349
Code: ff 44 89 f9 80 e1 07 fe c1 38 c1 0f 8c 8e fd ff ff 4c 89 ff e8 e3 fa 82 fe e9 81 fd ff ff e8 c9 9f 2b fe 0f 0b e8 c2 9f 2b fe <0f> 0b f3 0f 1e fa 65 44 8b 3d f0 c7 a9 7c bf 07 00 00 00 44 89 fe
RSP: 0018:ffffc900032470c0 EFLAGS: 00010293
RAX: ffffffff8359efce RBX: 0000000000000008 RCX: ffff88802b8fbc00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008
RBP: ffffc900032471b0 R08: 0000000000000000 R09: 0000000000000008
R10: 00000000fffffffc R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff888076bb1000 R15: 0000000000000001
FS:  0000555589520500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2da63fff CR3: 0000000076ba6000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 ocfs2_search_one_group fs/ocfs2/suballoc.c:1717 [inline]
 ocfs2_claim_suballoc_bits+0x1434/0x2230 fs/ocfs2/suballoc.c:1915
 __ocfs2_claim_clusters+0x302/0x900 fs/ocfs2/suballoc.c:2338
 ocfs2_add_clusters_in_btree+0x337/0xf60 fs/ocfs2/alloc.c:4827
 ocfs2_add_inode_data fs/ocfs2/file.c:550 [inline]
 ocfs2_extend_allocation+0x9fd/0x1760 fs/ocfs2/file.c:630
 ocfs2_allocate_unwritten_extents+0x2ea/0x7b0 fs/ocfs2/file.c:1495
 __ocfs2_change_file_space+0x8d6/0xe40 fs/ocfs2/file.c:2022
 ocfs2_fallocate+0x1f5/0x240 fs/ocfs2/file.c:2137
 vfs_fallocate+0x58e/0x700 fs/open.c:324
 ksys_fallocate fs/open.c:347 [inline]
 __do_sys_fallocate fs/open.c:355 [inline]
 __se_sys_fallocate fs/open.c:353 [inline]
 __x64_sys_fallocate+0xc1/0x110 fs/open.c:353
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f8808b8f6c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffed97b33b8 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00007f8808de5fa0 RCX: 00007f8808b8f6c9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 00007f8808c11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000008000c62 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8808de5fa0 R14: 00007f8808de5fa0 R15: 0000000000000004
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ocfs2_block_group_set_bits+0x53e/0x670 fs/ocfs2/suballoc.c:1349
Code: ff 44 89 f9 80 e1 07 fe c1 38 c1 0f 8c 8e fd ff ff 4c 89 ff e8 e3 fa 82 fe e9 81 fd ff ff e8 c9 9f 2b fe 0f 0b e8 c2 9f 2b fe <0f> 0b f3 0f 1e fa 65 44 8b 3d f0 c7 a9 7c bf 07 00 00 00 44 89 fe
RSP: 0018:ffffc900032470c0 EFLAGS: 00010293
RAX: ffffffff8359efce RBX: 0000000000000008 RCX: ffff88802b8fbc00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000008
RBP: ffffc900032471b0 R08: 0000000000000000 R09: 0000000000000008
R10: 00000000fffffffc R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff888076bb1000 R15: 0000000000000001
FS:  0000555589520500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2da63fff CR3: 0000000076ba6000 CR4: 00000000003506f0

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/09 14:04 linux-6.6.y 0a805b6ea8cd 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan kernel BUG in ocfs2_claim_suballoc_bits
2025/11/09 13:36 linux-6.6.y 0a805b6ea8cd 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)] ci2-linux-6-6-kasan kernel BUG in ocfs2_claim_suballoc_bits
2025/11/09 13:07 linux-6.6.y 0a805b6ea8cd 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan kernel BUG in ocfs2_claim_suballoc_bits
* Struck through repros no longer work on HEAD.