Hi, Mounting the attached filesystem image (fuzzed) on latest linus/master causes an endless stream of the following output on the console: EXT4-fs (loop0): Inode 5 (ffff8800153ed720): orphan list check failed! ffff8800153ed720: 00000000 00000000 00000000 00000000 ................ ffff8800153ed730: 00000000 00000000 00000000 00000000 ................ ffff8800153ed740: 00000000 00000000 00000000 00000000 ................ ffff8800153ed750: 00000000 00000000 00000000 00000000 ................ ffff8800153ed760: 00000000 00000000 00000000 00000000 ................ ffff8800153ed770: 00000000 00000000 00000000 00000000 ................ ffff8800153ed780: 153ed780 ffff8800 153ed780 ffff8800 ..>.......>..... ffff8800153ed790: 00000000 00000000 00000000 00000000 ................ ffff8800153ed7a0: 153edcc0 ffff8800 15a0b920 ffff8800 ..>..... ....... ffff8800153ed7b0: 00000000 00000000 00000000 00000000 ................ ffff8800153ed7c0: 153ed7c0 ffff8800 153ed7c0 ffff8800 ..>.......>..... ffff8800153ed7d0: 00000000 00000000 00000000 00000000 ................ ffff8800153ed7e0: 00008000 00000000 00000000 00000000 ................ ffff8800153ed7f0: ffffffff ffffffff ffffffff ffffffff ................ ffff8800153ed800: 82080e80 ffffffff 15a0c050 ffff8800 ........P....... ffff8800153ed810: 153ed938 ffff8800 0007dc80 ffff8800 8.>............. ffff8800153ed820: 00000005 00000000 00000000 00000000 ................ ffff8800153ed830: 00000000 00000000 565dc7b8 00000000 ..........]V.... ffff8800153ed840: 00000000 00000000 565dc7b8 00000000 ..........]V.... ffff8800153ed850: 00000000 00000000 565dc7b8 00000000 ..........]V.... ffff8800153ed860: 00000000 00000000 00000000 00000000 ................ ffff8800153ed870: 0000000a 00000000 00000000 00000000 ................ ffff8800153ed880: 00000060 00000000 00000001 00000000 `............... ffff8800153ed890: 153ed890 ffff8800 153ed890 ffff8800 ..>.......>..... ffff8800153ed8a0: 00000000 00000000 00000000 00000000 ................ ffff8800153ed8b0: 00000000 00000000 00000000 00000000 ................ ffff8800153ed8c0: 00000000 00000000 00000000 00000000 ................ ffff8800153ed8d0: 153ed8d0 ffff8800 153ed8d0 ffff8800 ..>.......>..... ffff8800153ed8e0: 153ed8e0 ffff8800 153ed8e0 ffff8800 ..>.......>..... ffff8800153ed8f0: 153ed8f0 ffff8800 153ed8f0 ffff8800 ..>.......>..... ffff8800153ed900: 00000000 00000000 81317bc0 ffffffff .........{1..... ffff8800153ed910: 00000000 00000000 00000000 00000000 ................ ffff8800153ed920: 00000000 00000000 82080fa0 ffffffff ................ ffff8800153ed930: 00000000 00000000 153ed7e0 ffff8800 ..........>..... ffff8800153ed940: 00000000 02080020 00000000 00000000 .... ........... ffff8800153ed950: 00000000 00000000 00000000 00000000 ................ ffff8800153ed960: 00000000 00000000 153ed968 ffff8800 ........h.>..... ffff8800153ed970: 153ed968 ffff8800 00000000 00000000 h.>............. ffff8800153ed980: 00000000 00000000 00000000 00000000 ................ ffff8800153ed990: 00000000 00000000 00000000 00000000 ................ ffff8800153ed9a0: 82080d80 ffffffff 024200ca 00000000 ..........B..... ffff8800153ed9b0: 00000000 00000000 153ed9b8 ffff8800 ..........>..... ffff8800153ed9c0: 153ed9b8 ffff8800 00000000 00000000 ..>............. ffff8800153ed9d0: 153ed9d0 ffff8800 153ed9d0 ffff8800 ..>.......>..... ffff8800153ed9e0: 00000000 00000000 00000000 00000000 ................ ffff8800153ed9f0: 00000000 00000000 00000000 00000000 ................ ffff8800153eda00: 00000000 00000000 00000000 00000000 ................ ffff8800153eda10: 00000000 00000000 00000000 00000000 ................ ffff8800153eda20: 153eda20 ffff8800 153eda20 ffff8800 .>..... .>..... ffff8800153eda30: 00000000 00000000 00000000 00000000 ................ ffff8800153eda40: 00000000 00000000 00000000 00000000 ................ ffff8800153eda50: 153eda50 ffff8800 153eda50 ffff8800 P.>.....P.>..... ffff8800153eda60: 00000000 00000000 00000000 ffffffff ................ ffff8800153eda70: 00000000 00000000 00000000 00000000 ................ ffff8800153eda80: 00000000 00000000 00000000 00000000 ................ ffff8800153eda90: 00000000 00000000 00000000 00000000 ................ ffff8800153edaa0: 153edaa0 ffff8800 153edaa0 ffff8800 ..>.......>..... ffff8800153edab0: 00000000 00000000 ffffffe0 0000000f ................ ffff8800153edac0: 153edac0 ffff8800 153edac0 ffff8800 ..>.......>..... ffff8800153edad0: 81302e40 ffffffff 00000000 00000003 @.0............. ffff8800153edae0: 00000003 00000000 00000000 00000000 ................ ffff8800153edaf0: 00000000 00000000 00000000 00000000 ................ ffff8800153edb00: 00000000 00000000 ........ CPU: 1 PID: 957 Comm: mount Not tainted 4.4.0-rc3+ #244 ffffffff820ac0c0 ffff88001562f868 ffffffff81610cc9 ffff8800153ed7e0 ffff88001562f8a0 ffffffff8133097a 00000000000003e8 ffffffff00000001 ffff8800153ed7e0 ffffffff820ac0c0 ffff8800153ed880 ffff88001562f8c0 Call Trace: [] dump_stack+0x44/0x5b [] ext4_destroy_inode+0xba/0xc0 [] destroy_inode+0x5f/0x80 [] evict+0x1e5/0x270 [] iput+0x297/0x350 [] ext4_fill_super+0x4fa5/0x53b0 [] ? deactivate_slab+0x32a/0x3e0 [] ? strnlen+0x31/0x60 [] ? ext4_calculate_overhead+0x530/0x530 [] ? snprintf+0x88/0xa0 [] ? up_write+0x11/0x30 [] ? register_shrinker+0xca/0x110 [] ? set_blocksize+0x8e/0x140 [] mount_bdev+0x284/0x2e0 [] ? ext4_calculate_overhead+0x530/0x530 [] ? mount_ns+0xc0/0xc0 [] ? __kmalloc_track_caller+0xbe/0x190 [] ? kstrdup_const+0x1e/0x20 [] ? memcpy+0x36/0x40 [] ext4_mount+0x10/0x20 [] mount_fs+0x56/0x1b0 [] ? alloc_vfsmnt+0x2f2/0x350 [] vfs_kern_mount+0x66/0x190 [] do_mount+0x362/0x16b0 [] ? ___slab_alloc+0x152/0x470 [] ? copy_mount_string+0x20/0x20 [] ? kasan_unpoison_shadow+0x36/0x50 [] ? kasan_kmalloc+0x5e/0x70 [] ? kasan_slab_alloc+0xd/0x10 [] ? __kmalloc_track_caller+0xbe/0x190 [] ? strndup_user+0x41/0x70 [] ? copy_mount_options+0x23/0x1d0 [] ? memdup_user+0x3d/0x70 [] SyS_mount+0xf6/0x160 [] ? copy_mnt_ns+0x440/0x440 [] entry_SYSCALL_64_fastpath+0x12/0x71 This seems to lock up the VM as well. A quick look/guess suggests maybe a cycle in the orphan list, maybe something in ext4_orphan_del() could cause an infinite loop in the cleanup? I can test patches. Thanks, Vegard