syzbot
kernel BUG in ocfs2_page_mkwrite (4)
Status:
upstream: reported on 2026/05/25 05:10
Subsystems:
ocfs2
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+42984127d45ad96219de@syzkaller.appspotmail.com
First crash: 101d, last: 3h31m
Sample crash report:
loop0: detected capacity change from 0 to 32768
=======================================================
WARNING: The mand mount option has been deprecated and
and is ignored by this kernel. Remove the mand
option from the mount to silence this warning.
=======================================================
JBD2: Ignoring recovery information on journal
ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
loop0: detected capacity change from 32768 to 64
(syz.0.0,5320,0):__ocfs2_journal_access:728 ERROR: Error -30 getting 1 access to buffer!
(syz.0.0,5320,0):ocfs2_write_end_nolock:1945 ERROR: status = -30
(syz.0.0,5320,0):ocfs2_commit_trans:401 ERROR: status = -5
------------[ cut here ]------------
kernel BUG at fs/ocfs2/mmap.c:106!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__ocfs2_page_mkwrite fs/ocfs2/mmap.c:106 [inline]
RIP: 0010:ocfs2_page_mkwrite+0xb5e/0xb60 fs/ocfs2/mmap.c:143
Code: 18 49 fe e9 27 fd ff ff e8 5f 91 f5 07 e8 3a b2 d7 fd 4c 89 e7 48 c7 c6 e0 2a 56 8c e8 bb 0f 38 fd 90 0f 0b e8 23 b2 d7 fd 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa
RSP: 0018:ffffc9000efa7960 EFLAGS: 00010287
RAX: ffffffff83f0124d RBX: 00000000ffffffe2 RCX: 0000000000100000
RDX: ffffc9000f699000 RSI: 000000000001349f RDI: 00000000000134a0
RBP: ffffc9000efa7af0 R08: ffffffff907a367f R09: 1ffffffff20f46cf
R10: dffffc0000000000 R11: fffffbfff20f46d0 R12: dffffc0000000000
R13: 0000000000005000 R14: 0000000000000000 R15: 0000000000001000
FS: 00007f7c714026c0(0000) GS:ffff88808c2d1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000600 CR3: 0000000011f94000 CR4: 0000000000352ef0
Call Trace:
<TASK>
do_page_mkwrite+0x147/0x310 mm/memory.c:3816
do_shared_fault mm/memory.c:6076 [inline]
do_fault mm/memory.c:6138 [inline]
do_pte_missing+0x757/0x34b0 mm/memory.c:4700
handle_pte_fault mm/memory.c:6558 [inline]
__handle_mm_fault mm/memory.c:6707 [inline]
handle_mm_fault+0x1a53/0x3750 mm/memory.c:6876
do_user_addr_fault+0x746/0x1340 arch/x86/mm/fault.c:1394
handle_page_fault arch/x86/mm/fault.c:1483 [inline]
exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0033:0x7f7c7045ce5f
Code: 0f eb c4 66 0f eb dc 66 41 0f 6a d7 66 41 0f 62 ef 66 0f 73 f7 28 66 41 0f 6a c7 f3 45 0f 7e f8 66 41 0f 73 d8 08 66 0f eb fc <44> 0f 11 80 10 ff ff ff 66 0f 73 f1 28 f3 44 0f 7e c3 66 0f 73 db
RSP: 002b:00007f7c71400470 EFLAGS: 00010206
RAX: 0000200000005900 RBX: 0000200000002000 RCX: 0000800000509120
RDX: 0000200000005a00 RSI: 000000004008ae89 RDI: 000000000000000c
RBP: 0000200000003000 R08: 0000000000000000 R09: 00000000000001ff
R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000003800
R13: 00007f7c71400b90 R14: 000000000000006b R15: 00000000000000c0
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__ocfs2_page_mkwrite fs/ocfs2/mmap.c:106 [inline]
RIP: 0010:ocfs2_page_mkwrite+0xb5e/0xb60 fs/ocfs2/mmap.c:143
Code: 18 49 fe e9 27 fd ff ff e8 5f 91 f5 07 e8 3a b2 d7 fd 4c 89 e7 48 c7 c6 e0 2a 56 8c e8 bb 0f 38 fd 90 0f 0b e8 23 b2 d7 fd 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa
RSP: 0018:ffffc9000efa7960 EFLAGS: 00010287
RAX: ffffffff83f0124d RBX: 00000000ffffffe2 RCX: 0000000000100000
RDX: ffffc9000f699000 RSI: 000000000001349f RDI: 00000000000134a0
RBP: ffffc9000efa7af0 R08: ffffffff907a367f R09: 1ffffffff20f46cf
R10: dffffc0000000000 R11: fffffbfff20f46d0 R12: dffffc0000000000
R13: 0000000000005000 R14: 0000000000000000 R15: 0000000000001000
FS: 00007f7c714026c0(0000) GS:ffff88808c2d1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000600 CR3: 0000000011f94000 CR4: 0000000000352ef0
* Struck through repros no longer work on HEAD.