From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-137.mail.qq.com (out162-62-57-137.mail.qq.com [162.62.57.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F17F024A058 for ; Thu, 27 Nov 2025 03:02:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.137 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764212550; cv=none; b=NI7p9jE9dAdMkaScyhIC7ALblgKm/RoDLqBobyBW2O+AWMj40wt2svz4x/cZkg3KROkw8Rc58resyy/O/n9aqOD1H1rjOEHhaJEdJUeNrI0Y4ASdannP71+9aHhcKX8uNnmhfV0q3WQ2JsakWo/dWhm1zncayROtzR45N6IudpM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764212550; c=relaxed/simple; bh=p4YVLQGQf0T0uBa153R9zF/gRcdmv0WVY+YmeOGTH30=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=hwQ/5Ezac0cOgin3j86nXwLyqrq7oUQ0hGMa9+wk/zvwr69e+1iiUqaY03aRuVbAP4PZIzr8ims/QZ6NJ4XVpMSQwd0ebuv8rSSU16+bgDFy5QtSxmuih9O4oz+y/Wwun25WaiZpbhltwdr+I0eRCrEKNtZrcYa1LqlU4I+1i6Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=ZIhuN/70; arc=none smtp.client-ip=162.62.57.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="ZIhuN/70" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1764212537; bh=5ciVJ8vZLsjBo/D2nDYMgfoWWkn8qoJf0dsU/eWS43U=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ZIhuN/70+kNW8mttBUWF7cJpqIK328ipBWIa7XVlKuCxoVVSPK3qsZdOqKwmDLDEB sBReWDx7kjkYpRF30yOIFMLeCe5V4aZQSfFpdlxZPN8wcklfEDjDw/YlHhDNOgdqD3 ezDYGgJgTxL+cc8x3gHG69VBCS+1cIl0b22+5gYU= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrsza56-0.qq.com (NewEsmtp) with SMTP id 8F08CB4; Thu, 27 Nov 2025 11:02:15 +0800 X-QQ-mid: xmsmtpt1764212535th87crdnl Message-ID: X-QQ-XMAILINFO: NU8eBzUWfc8Fvc0incqoSJSnTmCEfEqA+iz9YLEGwtVKgXm50yibZnssznfhGb KWRZ0582PFgpWtu3vfNjDuWvkQvgUOCHjGDiSgsKmO8WFzuc7Gf2TpgYtjCPAU3w+wX3+KqTQEKU awDcWNo+1GIcwRD8STKdv209gSqF+OY1/kpqGin7WhxX1QcAAEDdk1LntxEz8EisOBTTYgStk4yo 2g7QOPdenPNOJamlN1XSmR+c9X8vsh0dog574PIpTVRh9t5XRZWKl0yvEs5G4r+KKrd/k86ll6vO yrSpl5xdJgcQkb7wb0M7J17nkfzvRSVOlrERY/tbZoVH8j9xV6h2BDK+R0SHV9XZQCvUTS2pgrB8 31QNgU5RGdQ6uE9tSdGfrqOhbQyJU2COjo3dtgrVvP7pL6AQEvVmmsejzN80zijPfxLw5z5/R8uf NMxiQMZDTs4RSa5slTE3iI2HYXZr4e4NF5ypxGW077jK6+db8omEZliOa2F/4gd+UykIALDl0exb JWdUaqieSPsD7qVazxZAexKMDeyotHmy2C6gmIW/Ib2SDrsCRiSzVviFqU70aOLTqy80ZNHBpWVV 8F8561NDWXWdLHQ/odgmOZRZk367+PU2RnMv8ibqcUogIozK0/P53eQyw3A9SRQs9KQizDpe/hZL MbMFW+G8dxofhAiYWO2lT0X6tcVbeR+2gqjBG87FsNhgbJJNyRF7FlM9vxaruJKEWOarfRkShfyB h0gBOmv1Hf4H9EJHW4bbkbndNljY+W9pmlZwaC4LxAmpPEk22sb4bqvzxhIh3qgetuInLKzjZdxY xc+vGRddlWrOKhuZiW6qu38ul1GRNCgm7sCk9EGo/bsOVzqr9ojvikHR/tU0ak85j0JnS3oJ1D1Z hWzx82o4iprA8xuZKd57TORyG/M8r3RQfy94bmoHoK59TPle5W1XPrxYHCevc4GyHThCsJEhZXJ/ 8ybmer7nYoAvt5TXZaVC3P4Snh+zc2 X-QQ-XMRINFO: MSVp+SPm3vtS1Vd6Y4Mggwc= From: Edward Adam Davis To: syzbot+f82afc4d4e74d0ef7a89@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [ocfs2?] kernel BUG in ocfs2_remove_btree_range (2) Date: Thu, 27 Nov 2025 11:02:15 +0800 X-OQ-MSGID: <20251127030214.39193-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6927a541.a70a0220.d98e3.00e5.GAE@google.com> References: <6927a541.a70a0220.d98e3.00e5.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c index 162711cc5b20..570d747a00ca 100644 --- a/fs/ocfs2/alloc.c +++ b/fs/ocfs2/alloc.c @@ -6164,7 +6164,7 @@ static int ocfs2_get_truncate_log_info(struct ocfs2_super *osb, struct buffer_head *bh = NULL; struct ocfs2_dinode *di; struct ocfs2_truncate_log *tl; - unsigned int tl_count; + unsigned int tl_count, tl_used; inode = ocfs2_get_system_file_inode(osb, TRUNCATE_LOG_SYSTEM_INODE, @@ -6185,8 +6185,10 @@ static int ocfs2_get_truncate_log_info(struct ocfs2_super *osb, di = (struct ocfs2_dinode *)bh->b_data; tl = &di->id2.i_dealloc; tl_count = le16_to_cpu(tl->tl_count); + tl_used = le16_to_cpu(tl->tl_used); if (unlikely(tl_count > ocfs2_truncate_recs_per_inode(osb->sb) || - tl_count == 0)) { + tl_count == 0) || + tl_used > tl_count) { status = -EFSCORRUPTED; iput(inode); brelse(bh);