[BUG] kernel BUG in ext4_do_writepages

[Xianying Wang]

Hi,

I am reporting a kernel BUG triggered in the ext4 writeback path,
reproducible with a syzkaller-generated workload on v6.18.0-rc7 and
v6.17.0.

The crash may caused by a violated internal assumption in
ext4_do_writepages() . During writeback, the code reaches a path that
assumes the inode is not using journaled data, but
ext4_should_journal_data(inode) evaluates to true, triggering a
BUG_ON() and crashing the kernel.

The BUG is triggered at:

: ext4_do_writepages()

specifically at the assertion:

BUG_ON(ext4_should_journal_data(inode));

>From code inspection, ext4_do_writepages() contains earlier logic to
handle journaled-data inodes by disabling mapping (mpd->can_map = 0).
However, later in the function, the code unconditionally asserts that
journaled data must not be in effect. This suggests an internal state
inconsistency: either the inode metadata indicates journaled data
unexpectedly, or the writeback state (mpd) allows the control flow to
reach a path that is incompatible with journaled data inodes.

This can be reproduced on:

HEAD commit:

v6.18-rc7: ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d

v6.17.0: e5f0a698b34ed76002dc5cff3804a61c80233a7a

report: https://pastebin.com/raw/t7sKi2aU

console output v6.18-rc7 :https://pastebin.com/raw/a88x4vQt

console output v6.17.0: https://pastebin.com/raw/s3cfkbmC

kernel config : https://pastebin.com/raw/1grwrT16

C reproducer :https://pastebin.com/raw/0nLHxWck

Let me know if you need more details or testing.

Best regards,

Xianying