syzbot


kernel BUG in bch2_fill_extent

Status: upstream: reported on 2025/04/29 22:24
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+150f08265580ecb7c31f@syzkaller.appspotmail.com
Fix commit: a2f546330ef9 bcachefs: Fix losing return code in next_fiemap_extent()
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm]
First crash: 55d, last: 31d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bcachefs?] kernel BUG in bch2_fill_extent 1 (2) 2025/04/30 03:46

Sample crash report:
    bi_sectors=0
    bi_version=0
    bi_atime=200535484
    bi_ctime=2780562352
    bi_mtime=2780562352
    bi_otime=200535484
    bi_uid=0
    bi_gid=0
    bi_nlink=2
    bi_generation=0
    bi_dev=0
    bi_data_checksum=0
    bi_compression=0
    bi_project=0
    bi_background_compression=0
    bi_data_replicas=0
    bi_promote_target=0
    bi_foreground_target=0
    bi_background_target=0
    bi_erasure_code=0
    bi_fields_set=0
    bi_dir=0
    bi_dir_offset=0
    bi_subvol=0
    bi_parent_subvol=0
    bi_nocow=0
    bi_depth=0
    bi_inodes_32bit=0
    bi_casefold=0, fixing
bcachefs (loop0): creating /file0/lost+found in subvol 1 snapshot 4294967295
bcachefs (loop0): creating /file0/lost+found in subvol 1 snapshot 4294967295
bcachefs (loop0): creating /file0/lost+found in subvol 1 snapshot 4294967295
bcachefs (loop0): creating /file0/lost+found in subvol 1 snapshot 4294967295
 done
bcachefs (loop0): check_subvolume_structure... done
bcachefs (loop0): check_directory_structure... done
bcachefs (loop0): check_nlinks...
bcachefs (loop0): inode 536870914 type reg has wrong i_nlink (2780562353, should be 1), fixing
 done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): set_fs_needs_rebalance... done
bcachefs (loop0): done starting filesystem
bcachefs (loop0): /file3 offset 0: key_type_error
  u64s 5 type error 536870913:24:U32_MAX len 24 ver 0
bcachefs (loop0): /file3 offset 0: key_type_error
  u64s 5 type error 536870913:24:U32_MAX len 24 ver 0
bcachefs (loop0): /file3 offset 0: key_type_error
  u64s 5 type error 536870913:24:U32_MAX len 24 ver 0
------------[ cut here ]------------
kernel BUG at fs/bcachefs/fs.c:1327!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:bch2_fill_extent+0x96e/0x970 fs/bcachefs/fs.c:1327
Code: 0f 0b e8 45 56 8d fd 90 0f 0b e8 3d 56 8d fd e9 f7 fe ff ff e8 33 56 8d fd 90 0f 0b e8 2b 56 8d fd 90 0f 0b e8 23 56 8d fd 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa
RSP: 0018:ffffc9000fe27420 EFLAGS: 00010283
RAX: ffffffff84329bad RBX: 0000000000000018 RCX: 0000000000100000
RDX: ffffc9000dd7a000 RSI: 00000000000018c1 RDI: 00000000000018c2
RBP: 0000000000000001 R08: ffff88801e2a4880 R09: 0000000000000004
R10: 0000000000000012 R11: 0000000000000002 R12: 0000000000000000
R13: ffffc9000fe278a8 R14: 0000000000000002 R15: 0000000000000002
FS:  00007f803c5ca6c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000003480 CR3: 00000000351cc000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 bch2_fiemap+0x288e/0x2ab0 fs/bcachefs/fs.c:1542
 ioctl_fiemap fs/ioctl.c:220 [inline]
 do_vfs_ioctl+0x163b/0x1eb0 fs/ioctl.c:840
 __do_sys_ioctl fs/ioctl.c:904 [inline]
 __se_sys_ioctl+0x82/0x170 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f803b78e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f803c5ca038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f803b9b5fa0 RCX: 00007f803b78e969
RDX: 0000200000000180 RSI: 00000000c020660b RDI: 0000000000000007
RBP: 00007f803b810ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f803b9b5fa0 R15: 00007ffff5c72c78
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_fill_extent+0x96e/0x970 fs/bcachefs/fs.c:1327
Code: 0f 0b e8 45 56 8d fd 90 0f 0b e8 3d 56 8d fd e9 f7 fe ff ff e8 33 56 8d fd 90 0f 0b e8 2b 56 8d fd 90 0f 0b e8 23 56 8d fd 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa
RSP: 0018:ffffc9000fe27420 EFLAGS: 00010283
RAX: ffffffff84329bad RBX: 0000000000000018 RCX: 0000000000100000
RDX: ffffc9000dd7a000 RSI: 00000000000018c1 RDI: 00000000000018c2
RBP: 0000000000000001 R08: ffff88801e2a4880 R09: 0000000000000004
R10: 0000000000000012 R11: 0000000000000002 R12: 0000000000000000
R13: ffffc9000fe278a8 R14: 0000000000000002 R15: 0000000000000002
FS:  00007f803c5ca6c0(0000) GS:ffff88808d6c2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f80301b2000 CR3: 00000000351cc000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/19 17:14 upstream a5806cd506af 27f68995 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/05/18 04:18 upstream 205b2bd7939c f41472b0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/05/18 00:57 upstream 205b2bd7939c f41472b0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/05/06 12:06 upstream 01f95500a162 ae98e6b9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/04/25 23:13 upstream c3137514f1f1 c6b4fb39 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/04/25 23:12 upstream c3137514f1f1 c6b4fb39 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/04/25 23:10 upstream c3137514f1f1 c6b4fb39 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/04/25 22:21 upstream c3137514f1f1 c6b4fb39 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
* Struck through repros no longer work on HEAD.