On Fri, Jun 30, 2023 at 07:41:54AM -0700, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 6995e2de6891 Linux 6.4 > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=175bc8bf280000 > kernel config: https://syzkaller.appspot.com/x/.config?x=f4df35260418daa6 > dashboard link: https://syzkaller.appspot.com/bug?extid=b960a0fea3fa8df1cd22 > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17e661af280000 There is a syz reproducer, but no C reprodducer. Looking at the syz reproducer, though, it looks like this is another one of these "let's flip the mounted file system between r/o and r/w", with the added "fun" that it appears that the mounted file system has a corrupted set of quota inodes. (See below.) Looking at the stack trace, it looks like we're passing an invalid inode pointer to ext4_quota_read() from do_insert_tree() which is ultimately called from dquot_file_open() while trying to open an ext4 file. Jan, since I know you're working on reworking the quota code to handle crazy (and as Linus says, crazy userspace doesn't come more crazy than syzbot) r/o <-> r/w racing remounts with quota enabled, over to you. :-) - Ted e2fsck 1.47.0 (5-Feb-2023) Pass 1: Checking inodes, blocks, and sizes Inode 3, i_blocks is 16, should be 8. Fix? no Inode 15, i_size is 360287970189639690, should be 4096. Fix? no Inode 16, i_size is 9000, should be 20480. Fix? no Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Pass 5: Checking group summary information Block bitmap differences: -10 Fix? no Free blocks count wrong for group #0 (41, counted=18). Fix? no Free blocks count wrong (41, counted=18). Fix? no Padding at end of block bitmap is not set. Fix? no [ERROR] ../../../../lib/support/quotaio_tree.c:546:check_reference: Illegal reference (975616 >= 6) in user quota file Update quota info for quota type 0? no [ERROR] ../../../../lib/support/quotaio_tree.c:546:check_reference: Illegal reference (196613 >= 6) in group quota file Update quota info for quota type 1? no syzkaller: ********** WARNING: Filesystem still has errors ********** syzkaller: 17/32 files (0.0% non-contiguous), 0/41 blocks
