kernel BUG in ocfs2_reserve_suballoc_bits on v7.3-rc2

kernel BUG in ocfs2_reserve_suballoc_bits on v7.3-rc2

[CJ]

Hi,


I am reporting a kernel BUG in ocfs2_reserve_suballoc_bits. It is still reproducible on
Linux v7.3-rc2 (HEAD df2908090cda368b01ff43709f51890076c56157) with a syzkaller reproducer.
syzbot originally reported "kernel BUG in ocfs2_reserve_suballoc_bits" on linux-6.1
(https://syzkaller.appspot.com/bug?extid=487e39304129321dd253). The target console shows a matching failure signature.


The reproducer mounts a crafted OCFS2 image and creates a file, reaching the metadata suballocator while reserving blocks for the new inode.


On the target, the kernel reports:
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  RIP: ocfs2_reserve_suballoc_bits


The diagnostic path is ocfs2_reserve_new_metadata_blocks -> ocfs2_calc_xattr_init -> ocfs2_mknod -> ocfs2_create.
It shares 5 key stack frames with the original kernel BUG
report, including ocfs2_reserve_new_metadata_blocks, ocfs2_mknod, ocfs2_create, path_openat.


This looks like the suballocator hitting an invariant failure while reserving metadata blocks for a new inode.


This is a follow-up for an existing syzbot report and describes an
observed failure, not a bisected root cause.


Reproducer:
  C reproducer: https://pastebin.com/raw/HwtDrmaz


console output: https://pastebin.com/raw/P3nKCetg
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=b1adc0bfde2d8a4a


Kernel:
  HEAD commit: df2908090cda368b01ff43709f51890076c56157
  git tree: linux-stable
  kernel version: 7.3.0-rc2
  tested tag: v7.3-rc2


Let me know if you need more details or testing.


Thanks.