[BUG] ocfs2: assertion failure in _ocfs2_free_suballoc_bits on a crafted image

[BUG] ocfs2: assertion failure in _ocfs2_free_suballoc_bits on a crafted image

[CJ]

Hi,



I am reporting an issue triggered by a syzkaller reproducer on Linux
7.3.0-rc2. The issue is reproducible with HEAD commit
df2908090cda368b01ff43709f51890076c56157.


The reproducer mounts a crafted ocfs2 image with commit= options and then
removes a directory, which makes ocfs2 evict the inode and release its
suballocator bits.


While freeing the bits, _ocfs2_free_suballoc_bits() reads the group
descriptor for the target group and checks that the range it is about to
clear fits within the group's declared bit count. The check fails and
BUG_ON() terminates the kernel. The call path is ocfs2_evict_inode() ->
ocfs2_wipe_inode() -> ocfs2_remove_inode() -> ocfs2_free_dinode() ->
_ocfs2_free_suballoc_bits(), reached from vfs_rmdir() in the unlinkat
syscall context.


This looks like the on-disk group descriptor and the suballocator chain
disagreeing about the size of the group, so the release range computed from
the chain falls outside it. Since the image is untrusted input, reporting
the inconsistency as a filesystem error instead of an assertion would keep
the kernel alive. I have not determined which of the two metadata sources
carries the inconsistent value.


This failure was reported earlier against the linux-6.1 longterm series at
https://syzkaller.appspot.com/bug?extid=3b664d98a77a329be77e, and the
reproducer below is the one from that report. It still reproduces on the
tested mainline kernel.


Reproducer:


syz reproducer:   https://pastebin.com/raw/9vVANXgZ
console output:  https://pastebin.com/raw/AZMvqBm0
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=6a5cbd268406bf43


Kernel:


HEAD commit: df2908090cda368b01ff43709f51890076c56157
git tree: mainline
kernel version: 7.3.0-rc2
tested tag: v7.3-rc2 (annotated tag object 5e036ce12de91c6fd674dad33b169c6150be2a7a)


Let me know if you need more details or testing.


Best regards,
Changjian Liu 

Re: [BUG] ocfs2: assertion failure in _ocfs2_free_suballoc_bits on a crafted image

[Joseph Qi]

Out-of-date ocfs2-devel maillist, resend to ocfs2-devel@lists.linux.dev.

Joseph

On 9/22/26 1:55 PM, CJ wrote:
> 
> Hi,
> 
> 
> 
> I am reporting an issue triggered by a syzkaller reproducer on Linux
> 7.3.0-rc2. The issue is reproducible with HEAD commit
> df2908090cda368b01ff43709f51890076c56157.
> 
> 
> The reproducer mounts a crafted ocfs2 image with commit= options and then
> removes a directory, which makes ocfs2 evict the inode and release its
> suballocator bits.
> 
> 
> While freeing the bits, _ocfs2_free_suballoc_bits() reads the group
> descriptor for the target group and checks that the range it is about to
> clear fits within the group's declared bit count. The check fails and
> BUG_ON() terminates the kernel. The call path is ocfs2_evict_inode() ->
> ocfs2_wipe_inode() -> ocfs2_remove_inode() -> ocfs2_free_dinode() ->
> _ocfs2_free_suballoc_bits(), reached from vfs_rmdir() in the unlinkat
> syscall context.
> 
> 
> This looks like the on-disk group descriptor and the suballocator chain
> disagreeing about the size of the group, so the release range computed from
> the chain falls outside it. Since the image is untrusted input, reporting
> the inconsistency as a filesystem error instead of an assertion would keep
> the kernel alive. I have not determined which of the two metadata sources
> carries the inconsistent value.
> 
> 
> This failure was reported earlier against the linux-6.1 longterm series at
> https://syzkaller.appspot.com/bug?extid=3b664d98a77a329be77e, and the
> reproducer below is the one from that report. It still reproduces on the
> tested mainline kernel.
> 
> 
> Reproducer:
> 
> 
> syz reproducer:   https://pastebin.com/raw/9vVANXgZ
> console output:  https://pastebin.com/raw/AZMvqBm0
> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=6a5cbd268406bf43
> 
> 
> Kernel:
> 
> 
> HEAD commit: df2908090cda368b01ff43709f51890076c56157
> git tree: mainline
> kernel version: 7.3.0-rc2
> tested tag: v7.3-rc2 (annotated tag object 5e036ce12de91c6fd674dad33b169c6150be2a7a)
> 
> 
> Let me know if you need more details or testing.
> 
> 
> Best regards,
> Changjian Liu 

Re: [BUG] ocfs2: assertion failure in _ocfs2_free_suballoc_bits on a crafted image

[Joseph Qi]

It seems this BUG has been fixed in:
https://lore.kernel.org/ocfs2-devel/20260901125221.1634686-1-joseph.qi@linux.alibaba.com/T/#t

And now they have already been included in linux-next. Please confirm.

Thanks,
Joseph

On 9/22/26 5:17 PM, Joseph Qi wrote:
> Out-of-date ocfs2-devel maillist, resend to ocfs2-devel@lists.linux.dev.
> 
> Joseph
> 
> On 9/22/26 1:55 PM, CJ wrote:
>>
>> Hi,
>>
>>
>>
>> I am reporting an issue triggered by a syzkaller reproducer on Linux
>> 7.3.0-rc2. The issue is reproducible with HEAD commit
>> df2908090cda368b01ff43709f51890076c56157.
>>
>>
>> The reproducer mounts a crafted ocfs2 image with commit= options and then
>> removes a directory, which makes ocfs2 evict the inode and release its
>> suballocator bits.
>>
>>
>> While freeing the bits, _ocfs2_free_suballoc_bits() reads the group
>> descriptor for the target group and checks that the range it is about to
>> clear fits within the group's declared bit count. The check fails and
>> BUG_ON() terminates the kernel. The call path is ocfs2_evict_inode() ->
>> ocfs2_wipe_inode() -> ocfs2_remove_inode() -> ocfs2_free_dinode() ->
>> _ocfs2_free_suballoc_bits(), reached from vfs_rmdir() in the unlinkat
>> syscall context.
>>
>>
>> This looks like the on-disk group descriptor and the suballocator chain
>> disagreeing about the size of the group, so the release range computed from
>> the chain falls outside it. Since the image is untrusted input, reporting
>> the inconsistency as a filesystem error instead of an assertion would keep
>> the kernel alive. I have not determined which of the two metadata sources
>> carries the inconsistent value.
>>
>>
>> This failure was reported earlier against the linux-6.1 longterm series at
>> https://syzkaller.appspot.com/bug?extid=3b664d98a77a329be77e, and the
>> reproducer below is the one from that report. It still reproduces on the
>> tested mainline kernel.
>>
>>
>> Reproducer:
>>
>>
>> syz reproducer:   https://pastebin.com/raw/9vVANXgZ
>> console output:  https://pastebin.com/raw/AZMvqBm0
>> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=6a5cbd268406bf43
>>
>>
>> Kernel:
>>
>>
>> HEAD commit: df2908090cda368b01ff43709f51890076c56157
>> git tree: mainline
>> kernel version: 7.3.0-rc2
>> tested tag: v7.3-rc2 (annotated tag object 5e036ce12de91c6fd674dad33b169c6150be2a7a)
>>
>>
>> Let me know if you need more details or testing.
>>
>>
>> Best regards,
>> Changjian Liu 
>