kernel BUG in clear_inode (3)

Status: upstream: reported C repro on 2024/11/22 00:29
Bug presence: origin:lts-only
Labels: missing-backport
[Documentation on labels]
Reported-by: syzbot+fd3c895d1c86f6104539@syzkaller.appspotmail.com
First crash: 682d, last: 35d
Fix commit to backport (bisect log) :
tree: upstream
commit 8c3f9a70d2d4dd6c640afe294b05c6a0a45434d9
Author: Dmitry Antipov <dmantipov@yandex.ru>
Date: Thu Nov 7 05:42:28 2024 +0000

  jfs: reject on-disk inodes of an unsupported type

[report pending]
  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2025/09/08 linux-5.15.y (ToT) 7a6c2d093c45 C [report] kernel BUG in clear_inode
2025/09/08 upstream (ToT) 76eeb9b8de98 C Didn't crash
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in clear_inode (2) jfs -1 syz, C inconclusive 986 481d 706d 28/29 fixed on 2025/06/10 16:19
linux-6.1 kernel BUG in clear_inode origin:upstream missing-backport -1 syz, C inconclusive 30 286d 1228d 0/3 upstream: reported C repro on 2023/05/25 23:24
linux-6.6 kernel BUG in clear_inode origin:upstream missing-backport -1 syz, C inconclusive 6 414d 474d 0/2 upstream: reported C repro on 2025/06/18 00:00
upstream kernel BUG in clear_inode (4) f2fs -1 syz, C done 6 359d 390d 29/29 fixed on 2025/10/29 21:02
linux-5.15 kernel BUG in clear_inode -1 1 1252d 1252d 0/3 auto-obsoleted due to no activity on 2023/08/23 09:07
upstream kernel BUG in clear_inode (3) jfs -1 syz, C error 637 398d 479d 29/29 fixed on 2025/09/04 16:57
upstream kernel BUG in clear_inode (5) prio:high f2fs -1 syz, C error error 6 5d22h 243d 0/29 upstream: reported C repro on 2026/02/04 00:52
linux-5.15 kernel BUG in clear_inode (2) -1 2 807d 887d 0/3 auto-obsoleted due to no activity on 2024/10/27 05:50
upstream kernel BUG in clear_inode btrfs -1 syz, C 12 714d 856d 28/29 fixed on 2024/10/22 11:57
upstream kernel BUG at fs/inode.c:LINE! (2) fs -1 syz, C done unreliable 322 880d 2228d 25/29 fixed on 2024/05/21 07:00
▶ ▼ Last patch testing requests (6)
Created Duration User Patch Repo Result
2026/09/20 23:11 0m retest repro linux-5.15.y error job log
2026/09/20 23:11 0m retest repro linux-5.15.y error job log
2026/06/17 20:23 24m retest repro linux-5.15.y report log
2026/04/07 03:37 15m retest repro linux-5.15.y report log
2026/01/27 02:36 11m retest repro linux-5.15.y report log
2025/11/17 23:16 12m retest repro linux-5.15.y report log
▶ ▼ Fix bisection attempts (1)
Created Duration User Patch Repo Result
2025/06/06 21:06 4h54m fix candidate upstream OK (1) job log

Sample crash report:
------------[ cut here ]------------
kernel BUG at fs/inode.c:592!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4301 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:clear_inode+0x128/0x150 fs/inode.c:592
Code: e8 ad a9 a9 ff 43 80 3c 27 00 74 08 4c 89 f7 e8 3e d2 ee ff 49 c7 06 60 00 00 00 5b 41 5c 41 5d 41 5e 41 5f c3 e8 88 a9 a9 ff <0f> 0b e8 81 a9 a9 ff 0f 0b e8 7a a9 a9 ff 0f 0b e8 73 a9 a9 ff 0f
RSP: 0018:ffffc900030bf888 EFLAGS: 00010093
RAX: ffffffff81cf6618 RBX: ffff88805bcdb4a0 RCX: ffff88801df83b80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900030bfa28 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000617ef0 R12: dffffc0000000000
R13: ffff88805bcdb578 R14: ffff88805bcdb6d0 R15: 0000000000000001
FS:  000055557f1c4500(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000008a05df2000 CR3: 000000002c2fa000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ntfs_evict_big_inode+0x34/0x490 fs/ntfs/inode.c:2252
 evict+0x4b6/0x8b0 fs/inode.c:647
 ntfs_put_super+0x984/0x1050 fs/ntfs/super.c:2356
 generic_shutdown_super+0x130/0x300 fs/super.c:475
 kill_block_super+0x7c/0xe0 fs/super.c:1438
 deactivate_locked_super+0x93/0xf0 fs/super.c:335
 cleanup_mnt+0x426/0x4d0 fs/namespace.c:1148
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 get_signal+0x123e/0x12e0 kernel/signal.c:2681
 arch_do_signal_or_restart+0xe6/0x12a0 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9b97c15397
Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffcb87fd748 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f9b97caa474 RCX: 00007f9b97c15397
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcb87fd800
RBP: 00007ffcb87fd800 R08: 00007ffcb87fe800 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcb87fe890
R13: 00007f9b97caa474 R14: 0000000000010e9e R15: 00007ffcb87fe8d0
 </TASK>
Modules linked in:
---[ end trace d256e8ba8797eb19 ]---
RIP: 0010:clear_inode+0x128/0x150 fs/inode.c:592
Code: e8 ad a9 a9 ff 43 80 3c 27 00 74 08 4c 89 f7 e8 3e d2 ee ff 49 c7 06 60 00 00 00 5b 41 5c 41 5d 41 5e 41 5f c3 e8 88 a9 a9 ff <0f> 0b e8 81 a9 a9 ff 0f 0b e8 7a a9 a9 ff 0f 0b e8 73 a9 a9 ff 0f
RSP: 0018:ffffc900030bf888 EFLAGS: 00010093
RAX: ffffffff81cf6618 RBX: ffff88805bcdb4a0 RCX: ffff88801df83b80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900030bfa28 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000617ef0 R12: dffffc0000000000
R13: ffff88805bcdb578 R14: ffff88805bcdb6d0 R15: 0000000000000001
FS:  000055557f1c4500(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000008a05df2000 CR3: 000000002c2fa000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (26):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/30 07:20 linux-5.15.y 28c35638ec51 2f52988a .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/11/28 17:51 linux-5.15.y 0a51d2d4527b 5df23865 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan-arm64 kernel BUG in clear_inode
2025/08/16 07:11 linux-5.15.y c79648372d02 1804e95e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2025/07/28 12:21 linux-5.15.y c79648372d02 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2025/07/21 09:39 linux-5.15.y c79648372d02 7117feec .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2025/06/13 03:47 linux-5.15.y 1c700860e8bc 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2025/06/08 08:03 linux-5.15.y 1c700860e8bc 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2025/06/01 14:54 linux-5.15.y 98f47d0e9b8c 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2025/04/21 00:37 linux-5.15.y f7347f400572 2a20f901 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-5-15-kasan kernel BUG in clear_inode
2025/04/20 23:18 linux-5.15.y f7347f400572 2a20f901 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2025/01/23 15:58 linux-5.15.y 4735586da88e a44b0418 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2025/01/21 01:13 linux-5.15.y 4735586da88e 6e87cfa2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/12/09 11:19 linux-5.15.y 0a51d2d4527b 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/12/07 02:24 linux-5.15.y 0a51d2d4527b 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/11/22 20:19 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/11/22 18:50 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/11/22 16:58 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/11/22 14:58 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/11/22 13:49 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/11/22 03:09 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/11/22 00:30 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/11/22 00:28 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2024/11/22 00:28 linux-5.15.y 0a51d2d4527b 4b25d554 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan kernel BUG in clear_inode
2025/05/13 05:34 linux-5.15.y 3b8db0e4f263 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 kernel BUG in clear_inode
2025/02/07 16:11 linux-5.15.y c16c81c81336 53657d1b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 kernel BUG in clear_inode
2025/02/04 20:44 linux-5.15.y c16c81c81336 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-arm64 kernel BUG in clear_inode
* Struck through repros no longer work on HEAD.