From: syzbot <syzbot+86d3938ade3c1d827514@syzkaller.appspotmail.com>
To: kent.overstreet@linux.dev, linux-bcachefs@vger.kernel.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [bcachefs?] kernel BUG in bch2_quota_transfer (2)
Date: Fri, 12 Sep 2025 05:48:29 -0700 [thread overview]
Message-ID: <68c4169d.050a0220.2ff435.035c.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 76eeb9b8de98 Linux 6.17-rc5
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1483f312580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7f605fd273c8220
dashboard link: https://syzkaller.appspot.com/bug?extid=86d3938ade3c1d827514
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-76eeb9b8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/658515dceee8/vmlinux-76eeb9b8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ee40b9e4370a/bzImage-76eeb9b8.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+86d3938ade3c1d827514@syzkaller.appspotmail.com
/, fixing
done
bcachefs (loop0): check_xattrs...
bcachefs (loop0): key in missing inode, found keys:
u64s 7 type xattr 1073741824:945502502804528484:U32_MAX len 0 ver 0: user.xattr2:xattr2
u64s 7 type xattr 1073741824:3442546108204556527:U32_MAX len 0 ver 0: user.xattr1:xattr1
, fixing
bcachefs (loop0): key in missing inode, found keys:
u64s 7 type xattr 1073741824:3442546108204556527:U32_MAX len 0 ver 0: user.xattr1:xattr1
, fixing
done
bcachefs (loop0): check_root... done
bcachefs (loop0): check_unreachable_inodes... done
bcachefs (loop0): check_subvolume_structure... done
bcachefs (loop0): check_directory_structure... done
bcachefs (loop0): check_nlinks... done
bcachefs (loop0): check_rebalance_work... done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): set_fs_needs_rebalance... done
bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean
bcachefs (loop0): check_alloc_info... done
bcachefs (loop0): check_lrus... done
bcachefs (loop0): check_btree_backpointers... done
bcachefs (loop0): check_backpointers_to_extents... done
bcachefs (loop0): check_extents_to_backpointers... done
bcachefs (loop0): check_alloc_to_lru_refs... done
bcachefs (loop0): check_snapshot_trees... done
bcachefs (loop0): check_snapshots... done
bcachefs (loop0): check_subvols... done
bcachefs (loop0): check_subvol_children... done
bcachefs (loop0): delete_dead_snapshots... done
bcachefs (loop0): check_inodes... done
bcachefs (loop0): check_extents... done
bcachefs (loop0): check_indirect_extents... done
bcachefs (loop0): check_dirents... done
bcachefs (loop0): check_xattrs... done
bcachefs (loop0): check_root... done
bcachefs (loop0): check_unreachable_inodes... done
bcachefs (loop0): check_subvolume_structure... done
bcachefs (loop0): check_directory_structure... done
bcachefs (loop0): check_nlinks... done
bcachefs (loop0): check_rebalance_work... done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): set_fs_needs_rebalance... done
bcachefs (loop0): reading quotas
bcachefs (loop0): quotas done
bcachefs (loop0): done starting filesystem
------------[ cut here ]------------
kernel BUG at fs/bcachefs/quota.c:319!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5353 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__bch2_quota_transfer fs/bcachefs/quota.c:319 [inline]
RIP: 0010:bch2_quota_transfer+0xa29/0xa50 fs/bcachefs/quota.c:367
Code: ff ff 89 f9 80 e1 07 38 c1 0f 8c 72 f7 ff ff 48 89 d3 e8 0a fc d1 fd 48 89 da e9 62 f7 ff ff e8 cd 54 29 07 e8 68 0c 6d fd 90 <0f> 0b e8 60 0c 6d fd 90 0f 0b e8 58 0c 6d fd 90 0f 0b e8 50 0c 6d
RSP: 0018:ffffc9000f40f700 EFLAGS: 00010283
RAX: ffffffff8452b228 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc9000dbd2000 RSI: 00000000000008db RDI: 00000000000008dc
RBP: ffffc9000f40f8b0 R08: 0000000000000001 R09: 0000000000000001
R10: dffffc0000000000 R11: fffffbfff1f47807 R12: 0000000000000000
R13: ffff8880343d7c28 R14: 1ffff11007ff820a R15: dffffc0000000000
FS: 00007f3e39d976c0(0000) GS:ffff88808d20c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000004000 CR3: 0000000043f9a000 CR4: 0000000000352ef0
Call Trace:
<TASK>
bch2_fs_quota_transfer+0x27d/0x4f0 fs/bcachefs/fs.c:183
bch2_setattr_nonsize+0x3a6/0x10e0 fs/bcachefs/fs.c:1122
notify_change+0xb33/0xe40 fs/attr.c:552
chown_common+0x40c/0x5c0 fs/open.c:791
vfs_fchown fs/open.c:859 [inline]
ksys_fchown+0xea/0x160 fs/open.c:871
__do_sys_fchown fs/open.c:876 [inline]
__se_sys_fchown fs/open.c:874 [inline]
__x64_sys_fchown+0x7a/0x90 fs/open.c:874
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3e38f8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3e39d97038 EFLAGS: 00000246 ORIG_RAX: 000000000000005d
RAX: ffffffffffffffda RBX: 00007f3e391c5fa0 RCX: 00007f3e38f8ebe9
RDX: 000000000000000a RSI: 000000003a736e6f RDI: 0000000000000006
RBP: 00007f3e39011e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3e391c6038 R14: 00007f3e391c5fa0 R15: 00007ffd7c15f018
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__bch2_quota_transfer fs/bcachefs/quota.c:319 [inline]
RIP: 0010:bch2_quota_transfer+0xa29/0xa50 fs/bcachefs/quota.c:367
Code: ff ff 89 f9 80 e1 07 38 c1 0f 8c 72 f7 ff ff 48 89 d3 e8 0a fc d1 fd 48 89 da e9 62 f7 ff ff e8 cd 54 29 07 e8 68 0c 6d fd 90 <0f> 0b e8 60 0c 6d fd 90 0f 0b e8 58 0c 6d fd 90 0f 0b e8 50 0c 6d
RSP: 0018:ffffc9000f40f700 EFLAGS: 00010283
RAX: ffffffff8452b228 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc9000dbd2000 RSI: 00000000000008db RDI: 00000000000008dc
RBP: ffffc9000f40f8b0 R08: 0000000000000001 R09: 0000000000000001
R10: dffffc0000000000 R11: fffffbfff1f47807 R12: 0000000000000000
R13: ffff8880343d7c28 R14: 1ffff11007ff820a R15: dffffc0000000000
FS: 00007f3e39d976c0(0000) GS:ffff88808d20c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3e39d75fc8 CR3: 0000000043f9a000 CR4: 0000000000352ef0
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2025-09-12 12:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=68c4169d.050a0220.2ff435.035c.GAE@google.com \
--to=syzbot+86d3938ade3c1d827514@syzkaller.appspotmail.com \
--cc=kent.overstreet@linux.dev \
--cc=linux-bcachefs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.