From: syzbot <syzbot+71d64eb53ffbb023de3b@syzkaller.appspotmail.com>
To: kent.overstreet@linux.dev, linux-bcachefs@vger.kernel.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [bcachefs?] kernel BUG in bch2_rename2
Date: Mon, 02 Dec 2024 05:43:28 -0800 [thread overview]
Message-ID: <674db980.050a0220.ad585.0053.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: f788b5ef1ca9 Merge tag 'timers_urgent_for_v6.13_rc1' of gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=110d55e8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2b3a18edb5017fc8
dashboard link: https://syzkaller.appspot.com/bug?extid=71d64eb53ffbb023de3b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-f788b5ef.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/40a792cdbfb9/vmlinux-f788b5ef.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8b3ae7a81a9a/bzImage-f788b5ef.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+71d64eb53ffbb023de3b@syzkaller.appspotmail.com
u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0
node offset 0/24 bset u64s 0: incorrect max key 18446462598732840960:14872293344460931071:U32_MAX
bcachefs (loop0): flagging btree inodes lost data
error reading btree root inodes l=0: btree_node_read_error, fixing
bcachefs (loop0): will run btree node scan
invalid bkey u64s 7 type xattr 536870912:3798421620223919902:U32_MAX len 0 ver 0: user.\x06:
xattr name has invalid characters: delete?, fixing
bcachefs (loop0): error validating btree node on loop0 at btree snapshots level 0/0
u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ebb8d5a9e3463bdb written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0
node offset 0/16 bset u64s 0: unknown checksum type 9, fixing
bcachefs (loop0): error validating btree node on loop0 at btree snapshots level 0/0
u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ebb8d5a9e3463bdb written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0
node offset 8/16: btree node data missing: expected 16 sectors, found 8, fixing
bcachefs (loop0): btree_node_read_work: rewriting btree node at btree=snapshots level=0 SPOS_MAX due to error
bcachefs (loop0): scan_for_btree_nodes...
bch2_scan_for_btree_nodes: nodes found after overwrites:
extents l=0 seq=1 journal_seq=5 cookie=c6c25c03258c59c5 POS_MIN-SPOS_MAX ptr: 0:27:0 gen 0
inodes l=0 seq=1 journal_seq=5 cookie=7589ab5e0c11cc7a POS_MIN-18446462598732840960:14872293344460931071:U32_MAX ptr: 0:38:0 gen 0
dirents l=0 seq=1 journal_seq=3458764513820540929 cookie=9aa2895aefce4bdf POS_MIN-SPOS_MAX ptr: 0:41:0 gen 0
xattrs l=0 seq=1 journal_seq=4 cookie=2285c34bed0abe32 POS_MIN-SPOS_MAX ptr: 0:31:0 gen 0
subvolumes l=0 seq=1 journal_seq=1 cookie=c0bef60d07ceb940 POS_MIN-SPOS_MAX ptr: 0:35:0 gen 0
snapshots l=0 seq=1 journal_seq=0 cookie=ebb8d5a9e3463bdb POS_MIN-SPOS_MAX ptr: 0:32:0 gen 0
lru l=0 seq=1 journal_seq=5 cookie=28f61e078e70b95c POS_MIN-SPOS_MAX ptr: 0:28:0 gen 0
deleted_inodes l=0 seq=1 journal_seq=0 cookie=1db8f60c84bb244c POS_MIN-SPOS_MAX ptr: 0:42:0 gen 0
done
bcachefs (loop0): check_topology...
bcachefs (loop0): btree root inodes unreadable, must recover from scan
bcachefs (loop0): bch2_get_scanned_nodes(): recovering inodes l=0 POS_MIN - SPOS_MAX
bcachefs (loop0): bch2_get_scanned_nodes(): recovering u64s 11 type btree_ptr_v2 18446462598732840960:14872293344460931071:U32_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0
btree node with incorrect max_keyat btree inodes level 1:
parent: u64s 5 type btree_ptr SPOS_MAX len 0 ver 0
child: u64s 11 type btree_ptr_v2 18446462598732840960:14872293344460931071:U32_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0, fixing
bcachefs (loop0): bch2_get_scanned_nodes(): recovering inodes l=0 18446462598732840960:14872293344460931072:0 - SPOS_MAX
btree node with incorrect max_keyat btree inodes level 1:
parent: u64s 5 type btree_ptr SPOS_MAX len 0 ver 0
child: u64s 11 type btree_ptr_v2 18446462598732840960:14872293344460931071:U32_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0, fixing
bcachefs (loop0): set_node_max(): u64s 11 type btree_ptr_v2 18446462598732840960:14872293344460931071:U32_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 -> SPOS_MAX
done
bcachefs (loop0): accounting_read... done
bcachefs (loop0): alloc_read... done
bcachefs (loop0): stripes_read... done
bcachefs (loop0): snapshots_read... done
bcachefs (loop0): check_allocations... done
bcachefs (loop0): going read-write
bcachefs (loop0): done starting filesystem
bcachefs (loop0): dirent to missing inode:
u64s 7 type dirent 4096:189491840996961599:U32_MAX len 0 ver 0: file0 -> 4098 type dir
bcachefs (loop0): dirent to missing inode:
u64s 7 type dirent 4096:4330382808765833931:U32_MAX len 0 ver 0: file1 -> 536870912 type reg
------------[ cut here ]------------
kernel BUG at fs/bcachefs/fs.c:935!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted 6.12.0-syzkaller-12128-gf788b5ef1ca9 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:bch2_rename2+0x2117/0x2130 fs/bcachefs/fs.c:935
Code: ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 0f f2 ff ff 4c 89 ff e8 f9 ca cc fd e9 02 f2 ff ff e8 2f bf 92 07 e8 4a e3 61 fd 90 <0f> 0b e8 42 e3 61 fd 90 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f
RSP: 0018:ffffc9000d2cf4e0 EFLAGS: 00010287
RAX: ffffffff843d8ed6 RBX: 0000000000001002 RCX: 0000000000100000
RDX: ffffc9000e772000 RSI: 0000000000002734 RDI: 0000000000002735
RBP: ffffc9000d2cfa90 R08: ffffffff843d81bd R09: 1ffff110088ba037
R10: dffffc0000000000 R11: ffffed10088ba038 R12: dffffc0000000000
R13: ffff8880545a0000 R14: 0000000000001003 R15: 0000000000000000
FS: 00007ff4ba7cf6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200002c0 CR3: 0000000040446000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
vfs_rename+0xbdb/0xf00 fs/namei.c:5067
do_renameat2+0xd94/0x13f0 fs/namei.c:5224
__do_sys_renameat2 fs/namei.c:5258 [inline]
__se_sys_renameat2 fs/namei.c:5255 [inline]
__x64_sys_renameat2+0xce/0xe0 fs/namei.c:5255
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff4b9980849
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff4ba7cf058 EFLAGS: 00000246 ORIG_RAX: 000000000000013c
RAX: ffffffffffffffda RBX: 00007ff4b9b45fa0 RCX: 00007ff4b9980849
RDX: ffffffffffffff9c RSI: 0000000020000440 RDI: ffffffffffffff9c
RBP: 00007ff4b99f3986 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff4b9b45fa0 R15: 00007fff1bc1c7f8
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_rename2+0x2117/0x2130 fs/bcachefs/fs.c:935
Code: ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 0f f2 ff ff 4c 89 ff e8 f9 ca cc fd e9 02 f2 ff ff e8 2f bf 92 07 e8 4a e3 61 fd 90 <0f> 0b e8 42 e3 61 fd 90 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f
RSP: 0018:ffffc9000d2cf4e0 EFLAGS: 00010287
RAX: ffffffff843d8ed6 RBX: 0000000000001002 RCX: 0000000000100000
RDX: ffffc9000e772000 RSI: 0000000000002734 RDI: 0000000000002735
RBP: ffffc9000d2cfa90 R08: ffffffff843d81bd R09: 1ffff110088ba037
R10: dffffc0000000000 R11: ffffed10088ba038 R12: dffffc0000000000
R13: ffff8880545a0000 R14: 0000000000001003 R15: 0000000000000000
FS: 00007ff4ba7cf6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff4ba7adfe0 CR3: 0000000040446000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2024-12-02 13:43 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=674db980.050a0220.ad585.0053.GAE@google.com \
--to=syzbot+71d64eb53ffbb023de3b@syzkaller.appspotmail.com \
--cc=kent.overstreet@linux.dev \
--cc=linux-bcachefs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.