[syzbot] [bcachefs?] [jfs?] kernel BUG in vfs_get_tree

[syzbot] [bcachefs?] [jfs?] kernel BUG in vfs_get_tree

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    b311c1b497e5 Merge tag '6.11-rc4-server-fixes' of git://gi..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17dfa42b980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=df2f0ed7e30a639d
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16210a7b980000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-b311c1b4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1c99fa48192f/vmlinux-b311c1b4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/16d5710a012a/bzImage-b311c1b4.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/bcc0f964f07d/mount_0.gz
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/8d5780313c65/mount_1.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com

bcachefs: bch2_fs_get_tree() error: EPERM
Filesystem bcachefs get_tree() didn't set fc->root
------------[ cut here ]------------
kernel BUG at fs/super.c:1810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5368 Comm: syz.0.15 Not tainted 6.11.0-rc4-syzkaller-00019-gb311c1b497e5 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:vfs_get_tree+0x29c/0x2a0 fs/super.c:1810
Code: ff 49 8b 1f 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 74 95 ee ff 48 8b 33 48 c7 c7 60 93 18 8c e8 b5 82 a7 09 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f
RSP: 0018:ffffc90002c0fd08 EFLAGS: 00010246
RAX: 0000000000000032 RBX: ffffffff8ef44540 RCX: 3e1a74824a3f5500
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff11007074696 R08: ffffffff8174034c R09: 1ffff1100410519a
R10: dffffc0000000000 R11: ffffed100410519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8880383a34b0 R15: ffff8880383a3498
FS:  00007fea882896c0(0000) GS:ffff888020800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7345eec538 CR3: 0000000037c0e000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_new_mount+0x2be/0xb40 fs/namespace.c:3472
 do_mount fs/namespace.c:3812 [inline]
 __do_sys_mount fs/namespace.c:4020 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3997
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fea8757b61a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fea88288e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fea88288ef0 RCX: 00007fea8757b61a
RDX: 000000002000fec0 RSI: 000000002000ff00 RDI: 00007fea88288eb0
RBP: 000000002000fec0 R08: 00007fea88288ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000002000ff00
R13: 00007fea88288eb0 R14: 000000000000fe88 R15: 0000000020000040
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_get_tree+0x29c/0x2a0 fs/super.c:1810
Code: ff 49 8b 1f 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 74 95 ee ff 48 8b 33 48 c7 c7 60 93 18 8c e8 b5 82 a7 09 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f
RSP: 0018:ffffc90002c0fd08 EFLAGS: 00010246
RAX: 0000000000000032 RBX: ffffffff8ef44540 RCX: 3e1a74824a3f5500
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff11007074696 R08: ffffffff8174034c R09: 1ffff1100410519a
R10: dffffc0000000000 R11: ffffed100410519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8880383a34b0 R15: ffff8880383a3498
FS:  00007fea882896c0(0000) GS:ffff888020800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efe67e50469 CR3: 0000000037c0e000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    abf2050f51fd Merge tag 'media/v6.12-1' of git://git.kernel..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11f08a80580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bc30a30374b0753
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15fad2a9980000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17b7b107980000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-abf2050f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2179ebeade58/vmlinux-abf2050f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f05289b5cf7c/bzImage-abf2050f.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/326532b68b88/mount_1.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com

bcachefs: bch2_fs_get_tree() error: EPERM
Filesystem bcachefs get_tree() didn't set fc->root, returned 1
------------[ cut here ]------------
kernel BUG at fs/super.c:1810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5200 Comm: syz-executor203 Not tainted 6.11.0-syzkaller-09959-gabf2050f51fd #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 22 b3 ae 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc9000b457d08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef58520 RCX: 12995cb9c2040600
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff11008249016 R08: ffffffff81746c8c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff888041248098 R15: ffff8880412480b0
FS:  0000555567b69480(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555567b72918 CR3: 000000004ebe6000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_new_mount+0x2be/0xb40 fs/namespace.c:3507
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4055 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4032
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff4a950680a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 7e 09 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdb635bea8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffdb635bec0 RCX: 00007ff4a950680a
RDX: 0000000020005d80 RSI: 0000000020005dc0 RDI: 00007ffdb635bec0
RBP: 0000000000000004 R08: 00007ffdb635bf00 R09: 0000000000005dc5
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 00007ffdb635bf00 R14: 0000000000000003 R15: 0000000001000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 22 b3 ae 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc9000b457d08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef58520 RCX: 12995cb9c2040600
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff11008249016 R08: ffffffff81746c8c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff888041248098 R15: ffff8880412480b0
FS:  0000555567b69480(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff4a1141000 CR3: 000000004ebe6000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[Edward Adam Davis]

Add EPERM support

#syz test

diff --git a/fs/bcachefs/errcode.h b/fs/bcachefs/errcode.h
index 60b7875adada..4119ef5e1fa1 100644
--- a/fs/bcachefs/errcode.h
+++ b/fs/bcachefs/errcode.h
@@ -102,6 +102,7 @@
 	x(ENOSPC,			ENOSPC_sb_downgrade)			\
 	x(ENOSPC,			ENOSPC_btree_slot)			\
 	x(ENOSPC,			ENOSPC_snapshot_tree)			\
+	x(EPERM,			EPERM_fc_root)				\
 	x(ENOENT,			ENOENT_bkey_type_mismatch)		\
 	x(ENOENT,			ENOENT_str_hash_lookup)			\
 	x(ENOENT,			ENOENT_str_hash_set_must_replace)	\

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in vfs_get_tree

bcachefs: bch2_fs_get_tree() error: EPERM
Filesystem bcachefs get_tree() didn't set fc->root, returned 1
------------[ cut here ]------------
kernel BUG at fs/super.c:1810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5668 Comm: syz.0.15 Not tainted 6.11.0-syzkaller-10547-g684a64bf32b6-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc90002f3fd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba40 RCX: 1e1b0d788f0b2200
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100ab23e96 R08: ffffffff81746c8c R09: 1ffff920005e7f3c
R10: dffffc0000000000 R11: fffff520005e7f3d R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88805591f498 R15: ffff88805591f4b0
FS:  00007f6bb22e16c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbe68be1000 CR3: 000000004b5ae000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_new_mount+0x2be/0xb40 fs/namespace.c:3507
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4055 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4032
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6bb157f69a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6bb22e0e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f6bb22e0ef0 RCX: 00007f6bb157f69a
RDX: 0000000020005d80 RSI: 0000000020005dc0 RDI: 00007f6bb22e0eb0
RBP: 0000000020005d80 R08: 00007f6bb22e0ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020005dc0
R13: 00007f6bb22e0eb0 R14: 0000000000005dcb R15: 0000000020000240
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc90002f3fd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba40 RCX: 1e1b0d788f0b2200
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100ab23e96 R08: ffffffff81746c8c R09: 1ffff920005e7f3c
R10: dffffc0000000000 R11: fffff520005e7f3d R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88805591f498 R15: ffff88805591f4b0
FS:  00007f6bb22e16c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c00171dff8 CR3: 000000004b5ae000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


Tested on:

commit:         684a64bf Merge tag 'nfs-for-6.12-1' of git://git.linux..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=162dc99f980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bd75e1a00004094f
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12b2dd3b980000

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[Edward Adam Davis]

db

#syz test

diff --git a/fs/bcachefs/fs.c b/fs/bcachefs/fs.c
index 4a1bb07a2574..49d711e9837e 100644
--- a/fs/bcachefs/fs.c
+++ b/fs/bcachefs/fs.c
@@ -2148,6 +2148,7 @@ static int bch2_fs_get_tree(struct fs_context *fc)
 out:
 	fc->root = dget(sb->s_root);
 err:
+	pr_info("ret: %d, sb: %p, fc: %p, fcroot: %p, %s\n", ret, sb, fc, fc->root, __func__);
 	darray_exit(&devs_to_fs);
 	bch2_darray_str_exit(&devs);
 	if (ret)
diff --git a/fs/bcachefs/recovery.c b/fs/bcachefs/recovery.c
index be1e7ca4362f..12835c0290f8 100644
--- a/fs/bcachefs/recovery.c
+++ b/fs/bcachefs/recovery.c
@@ -849,6 +849,7 @@ int bch2_fs_recovery(struct bch_fs *c)
 		atomic64_add(1 << 16, &c->key_version);
 
 	ret = read_btree_roots(c);
+	pr_info("ret: %d, %s\n", ret, __func__);
 	if (ret)
 		goto err;
 
diff --git a/fs/bcachefs/super.c b/fs/bcachefs/super.c
index 873e4be7e1dc..9fb45c7e7063 100644
--- a/fs/bcachefs/super.c
+++ b/fs/bcachefs/super.c
@@ -1011,6 +1011,7 @@ int bch2_fs_start(struct bch_fs *c)
 	mutex_lock(&c->sb_lock);
 
 	ret = bch2_sb_members_v2_init(c);
+	pr_info("ret: %d, %s\n", ret, __func__);
 	if (ret) {
 		mutex_unlock(&c->sb_lock);
 		goto err;
@@ -1036,6 +1037,7 @@ int bch2_fs_start(struct bch_fs *c)
 	ret = BCH_SB_INITIALIZED(c->disk_sb.sb)
 		? bch2_fs_recovery(c)
 		: bch2_fs_initialize(c);
+	pr_info("2ret: %d, %s\n", ret, __func__);
 	if (ret)
 		goto err;
 

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in vfs_get_tree

bcachefs: bch2_fs_get_tree() ret: 1, sb: fffffffffffffff0, fc: ffff8880537ad800, fcroot: 0000000000000000, bch2_fs_get_tree
bcachefs: bch2_fs_get_tree() error: EPERM
Filesystem bcachefs get_tree() didn't set fc->root, returned 1
------------[ cut here ]------------
kernel BUG at fs/super.c:1810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5755 Comm: syz.0.15 Not tainted 6.11.0-syzkaller-10547-g684a64bf32b6-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc9000313fd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba00 RCX: cdd8394f8f48fd00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100a6f5b16 R08: ffffffff81746c8c R09: 1ffff92000627f3c
R10: dffffc0000000000 R11: fffff52000627f3d R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8880537ad898 R15: ffff8880537ad8b0
FS:  00007fed01cdb6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ca2d7dd000 CR3: 00000000577b4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_new_mount+0x2be/0xb40 fs/namespace.c:3507
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4055 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4032
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fed00f7f69a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fed01cdae68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fed01cdaef0 RCX: 00007fed00f7f69a
RDX: 0000000020005d80 RSI: 0000000020005dc0 RDI: 00007fed01cdaeb0
RBP: 0000000020005d80 R08: 00007fed01cdaef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020005dc0
R13: 00007fed01cdaeb0 R14: 0000000000005dcb R15: 0000000020000240
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0018:ffffc9000313fd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba00 RCX: cdd8394f8f48fd00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100a6f5b16 R08: ffffffff81746c8c R09: 1ffff92000627f3c
R10: dffffc0000000000 R11: fffff52000627f3d R12: 0000000000000001
R13: dffffc0000000000 R14: ffff8880537ad898 R15: ffff8880537ad8b0
FS:  00007fed01cdb6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1c28ab5b47 CR3: 00000000577b4000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


Tested on:

commit:         684a64bf Merge tag 'nfs-for-6.12-1' of git://git.linux..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=143e8a80580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bd75e1a00004094f
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10b3c99f980000

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[syzbot]

syzbot has bisected this issue to:

commit d97de0d017cde0d442c3d144b4f969f43064cc0f
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date:   Tue Aug 13 01:31:25 2024 +0000

    bcachefs: Make bkey_fsck_err() a wrapper around fsck_err()

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=147a0989980000
start commit:   2004cef11ea0 Merge tag 'sched-core-2024-09-19' of git://gi..
git tree:       upstream
final oops:     https://syzkaller.appspot.com/x/report.txt?x=167a0989980000
console output: https://syzkaller.appspot.com/x/log.txt?x=127a0989980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=38d475ce6711b8b4
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=171f769f980000

Reported-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
Fixes: d97de0d017cd ("bcachefs: Make bkey_fsck_err() a wrapper around fsck_err()")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[Edward Adam Davis]

db

#syz test

diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..aa247ca6270d 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -280,7 +280,7 @@ static int read_btree_nodes(struct find_btree_nodes *f)
 			percpu_ref_put(&ca->io_ref);
 			closure_put(&cl);
 			f->ret = ret;
-			bch_err(c, "error starting kthread: %i", ret);
+			bch_err(c, "error starting kthread: %i %d", ret, PTR_ERR(t));
 			break;
 		}
 	}
@@ -358,6 +358,7 @@ int bch2_scan_for_btree_nodes(struct bch_fs *c)
 	mutex_init(&f->lock);
 
 	ret = read_btree_nodes(f);
+	pr_info("ret: %d, %s\n", ret, __func__);
 	if (ret)
 		return ret;
 
diff --git a/fs/bcachefs/fs.c b/fs/bcachefs/fs.c
index 4a1bb07a2574..49d711e9837e 100644
--- a/fs/bcachefs/fs.c
+++ b/fs/bcachefs/fs.c
@@ -2148,6 +2148,7 @@ static int bch2_fs_get_tree(struct fs_context *fc)
 out:
 	fc->root = dget(sb->s_root);
 err:
+	pr_info("ret: %d, sb: %p, fc: %p, fcroot: %p, %s\n", ret, sb, fc, fc->root, __func__);
 	darray_exit(&devs_to_fs);
 	bch2_darray_str_exit(&devs);
 	if (ret)
diff --git a/fs/bcachefs/recovery.c b/fs/bcachefs/recovery.c
index be1e7ca4362f..aeeeda0f01d4 100644
--- a/fs/bcachefs/recovery.c
+++ b/fs/bcachefs/recovery.c
@@ -522,8 +522,8 @@ static int read_btree_roots(struct bch_fs *c)
 					bch2_btree_id_str(i)) ||
 		    mustfix_fsck_err_on((ret = r->error = bch2_btree_root_read(c, i, &r->key, r->level)),
 					c, btree_root_read_error,
-					"error reading btree root %s l=%u: %s",
-					bch2_btree_id_str(i), r->level, bch2_err_str(ret))) {
+					"error reading btree root %s l=%u: %s ret: %d",
+					bch2_btree_id_str(i), r->level, bch2_err_str(ret), ret)) {
 			if (btree_id_is_alloc(i)) {
 				c->opts.recovery_passes |= BIT_ULL(BCH_RECOVERY_PASS_check_allocations);
 				c->opts.recovery_passes |= BIT_ULL(BCH_RECOVERY_PASS_check_alloc_info);
@@ -849,6 +849,7 @@ int bch2_fs_recovery(struct bch_fs *c)
 		atomic64_add(1 << 16, &c->key_version);
 
 	ret = read_btree_roots(c);
+	pr_info("ret: %d, %s\n", ret, __func__);
 	if (ret)
 		goto err;
 
@@ -967,6 +968,7 @@ int bch2_fs_recovery(struct bch_fs *c)
 
 	ret = 0;
 out:
+	pr_info("out ret: %d, %s\n", ret, __func__);
 	bch2_flush_fsck_errs(c);
 
 	if (!c->opts.retain_recovery_info) {
diff --git a/fs/bcachefs/super.c b/fs/bcachefs/super.c
index 873e4be7e1dc..74d0af559a77 100644
--- a/fs/bcachefs/super.c
+++ b/fs/bcachefs/super.c
@@ -1036,6 +1036,7 @@ int bch2_fs_start(struct bch_fs *c)
 	ret = BCH_SB_INITIALIZED(c->disk_sb.sb)
 		? bch2_fs_recovery(c)
 		: bch2_fs_initialize(c);
+	pr_info("2ret: %d, %s\n", ret, __func__);
 	if (ret)
 		goto err;
 

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in vfs_get_tree

bcachefs: bch2_fs_get_tree() ret: 1, sb: fffffffffffffff0, fc: ffff88804b373c00, fcroot: 0000000000000000, bch2_fs_get_tree
bcachefs: bch2_fs_get_tree() error: EPERM
Filesystem bcachefs get_tree() didn't set fc->root, returned 1
------------[ cut here ]------------
kernel BUG at fs/super.c:1810!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5758 Comm: syz.0.15 Not tainted 6.11.0-syzkaller-10547-g684a64bf32b6-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0000:ffffc90002ddfd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba40 RCX: 09535156e62e3f00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100966e796 R08: ffffffff81746c8c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88804b373c98 R15: ffff88804b373cb0
FS:  00007f939e8e66c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa76e92b000 CR3: 0000000058070000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_new_mount+0x2be/0xb40 fs/namespace.c:3507
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4055 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4032
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f939db7f69a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f939e8e5e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f939e8e5ef0 RCX: 00007f939db7f69a
RDX: 0000000020005d80 RSI: 0000000020005dc0 RDI: 00007f939e8e5eb0
RBP: 0000000020005d80 R08: 00007f939e8e5ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020005dc0
R13: 00007f939e8e5eb0 R14: 0000000000005dcb R15: 0000000020000240
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:vfs_get_tree+0x29f/0x2b0 fs/super.c:1810
Code: 1e 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 14 c4 ec ff 48 8b 33 48 c7 c7 20 d4 18 8c 44 89 e2 e8 92 98 af 09 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90
RSP: 0000:ffffc90002ddfd08 EFLAGS: 00010246
RAX: 000000000000003e RBX: ffffffff8ef5ba40 RCX: 09535156e62e3f00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 1ffff1100966e796 R08: ffffffff81746c8c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88804b373c98 R15: ffff88804b373cb0
FS:  00007f939e8e66c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005615655e7000 CR3: 0000000058070000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


Tested on:

commit:         684a64bf Merge tag 'nfs-for-6.12-1' of git://git.linux..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1270d627980000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bd75e1a00004094f
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13834a80580000

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[Edward Adam Davis]

kthread_run return -EINTR in read_btree_nodes(), it needs to be returnned
to bch2_fs_recovery(), not back to "ret = IS_ERR_OR_NULL(t)".

#syz test

diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..aa0f84d35895 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -280,12 +280,15 @@ static int read_btree_nodes(struct find_btree_nodes *f)
 			percpu_ref_put(&ca->io_ref);
 			closure_put(&cl);
 			f->ret = ret;
-			bch_err(c, "error starting kthread: %i", ret);
+			bch_err(c, "error starting kthread: %i %d", ret, PTR_ERR(t));
 			break;
 		}
 	}
 err:
 	closure_sync(&cl);
+	if (IS_ERR(t))
+		return PTR_ERR(t);
+
 	return f->ret ?: ret;
 }
 

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

fs/bcachefs/btree_node_scan.c:289:13: error: use of undeclared identifier 't'
fs/bcachefs/btree_node_scan.c:290:18: error: use of undeclared identifier 't'


Tested on:

commit:         684a64bf Merge tag 'nfs-for-6.12-1' of git://git.linux..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=bc30a30374b0753
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=17a8d627980000

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[Edward Adam Davis]

kthread_run return -EINTR in read_btree_nodes(), it needs to be returnned
to bch2_fs_recovery(), not back to "ret = IS_ERR_OR_NULL(t)".

#syz test

diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..df7090ca1e81 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -281,6 +281,10 @@ static int read_btree_nodes(struct find_btree_nodes *f)
 			closure_put(&cl);
 			f->ret = ret;
 			bch_err(c, "error starting kthread: %i", ret);
+			if (IS_ERR(t)) {
+				closure_sync(&cl);
+				return PTR_ERR(t);
+			}
 			break;
 		}
 	}

Re: [syzbot] [bcachefs?] kernel BUG in vfs_get_tree

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
Tested-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com

Tested on:

commit:         684a64bf Merge tag 'nfs-for-6.12-1' of git://git.linux..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=167b4a80580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bd75e1a00004094f
dashboard link: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=13b332a9980000

Note: testing is done by a robot and is best-effort only.

[PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL

[Edward Adam Davis]

Syzbot report a kernel BUG in vfs_get_tree.
The root cause is that read_btree_nodes() returned 1 and returned -EINTR
due to kthread_run() execution failure.

The -EINTR needs to be returnned to bch2_fs_recovery(), not return to
"ret = IS_ERR_OR_NULL(t)".

Reported-and-tested-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 fs/bcachefs/btree_node_scan.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..df7090ca1e81 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -281,6 +281,10 @@ static int read_btree_nodes(struct find_btree_nodes *f)
 			closure_put(&cl);
 			f->ret = ret;
 			bch_err(c, "error starting kthread: %i", ret);
+			if (IS_ERR(t)) {
+				closure_sync(&cl);
+				return PTR_ERR(t);
+			}
 			break;
 		}
 	}
-- 
2.43.0

Re: [PATCH] bcachefs: return the error code instead of the return value of IS_ERR_OR_NULL

[Kent Overstreet]

On Wed, Sep 25, 2024 at 09:53:00PM GMT, Edward Adam Davis wrote:
> Syzbot report a kernel BUG in vfs_get_tree.
> The root cause is that read_btree_nodes() returned 1 and returned -EINTR
> due to kthread_run() execution failure.
> 
> The -EINTR needs to be returnned to bch2_fs_recovery(), not return to
> "ret = IS_ERR_OR_NULL(t)".
> 
> Reported-and-tested-by: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c0360e8367d6d8d04a66
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
>  fs/bcachefs/btree_node_scan.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
> index b28c649c6838..df7090ca1e81 100644
> --- a/fs/bcachefs/btree_node_scan.c
> +++ b/fs/bcachefs/btree_node_scan.c
> @@ -281,6 +281,10 @@ static int read_btree_nodes(struct find_btree_nodes *f)
>  			closure_put(&cl);
>  			f->ret = ret;
>  			bch_err(c, "error starting kthread: %i", ret);
> +			if (IS_ERR(t)) {
> +				closure_sync(&cl);
> +				return PTR_ERR(t);
> +			}
>  			break;
>  		}
>  	}
> -- 
> 2.43.0
> 

I fixed this last night with the patch below...

commit c1a6f5ca052b7f8609917d13cd11fc60c94396aa
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date:   Tue Sep 24 19:31:22 2024 -0400

    bcachefs: Fix incorrect IS_ERR_OR_NULL usage
    
    Returning a positive integer instead of an error code causes error paths
    to become very confused.
    
    Closes: syzbot+c0360e8367d6d8d04a66@syzkaller.appspotmail.com
    Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>

diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
index b28c649c6838..1e694fedc5da 100644
--- a/fs/bcachefs/btree_node_scan.c
+++ b/fs/bcachefs/btree_node_scan.c
@@ -275,7 +275,7 @@ static int read_btree_nodes(struct find_btree_nodes *f)
 		w->ca		= ca;
 
 		t = kthread_run(read_btree_nodes_worker, w, "read_btree_nodes/%s", ca->name);
-		ret = IS_ERR_OR_NULL(t);
+		ret = PTR_ERR_OR_ZERO(t);
 		if (ret) {
 			percpu_ref_put(&ca->io_ref);
 			closure_put(&cl);