syzbot


kernel BUG in bch2_fill_extent (2)

Status: upstream: reported on 2025/07/15 07:40
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+397f6fe952a0defb9424@syzkaller.appspotmail.com
Fix commit: bcachefs: Fix unhandled key type in fiemap_fill_extent
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 65d, last: 4d19h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bcachefs?] kernel BUG in bch2_fill_extent (2) 1 (2) 2025/07/19 18:38
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in bch2_fill_extent bcachefs -1 8 118d 137d 29/29 fixed on 2025/07/10 09:09

Sample crash report:
    gen 0 oldest_gen 0 data_type need_discard
    journal_seq_nonempty 5
    journal_seq_empty    134217728
    need_discard         1
    need_inc_gen         1
    dirty_sectors        0
    stripe_sectors       0
    cached_sectors       0
    stripe               0
    stripe_redundancy    0
    io_time[READ]        1
    io_time[WRITE]       512
    fragmentation     0
    bp_start          8
  , fixing
bcachefs (loop0): hole in alloc btree missing in freespace btree
  device 0 buckets 39-40, fixing
bcachefs (loop0): hole in alloc btree missing in freespace btree
  device 0 buckets 44-45, fixing
bcachefs (loop0): hole in alloc btree missing in freespace btree
  device 0 buckets 46-50, fixing
bcachefs (loop0): hole in alloc btree missing in freespace btree
  device 0 buckets 51-120, fixing
 done
bcachefs (loop0): check_lrus...
bcachefs (loop0): incorrect lru entry: lru fragmentation time 134217728
  u64s 5 type set 18446462598867058688:6597069766690:0 len 0 ver 0
  for u64s 5 type deleted 0:6597069766690:0 len 0 ver 0, fixing
 done
bcachefs (loop0): check_backpointers_to_extents... done
bcachefs (loop0): check_extents_to_backpointers...
bcachefs (loop0): scanning for missing backpointers in 1/128 buckets
 done
bcachefs (loop0): check_inodes...
bcachefs (loop0): directory 4096:4294967295 with nonzero i_size 4095, fixing
 done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): going read-only
bcachefs (loop0): finished waiting for writes to stop
bcachefs (loop0): flushing journal and stopping allocators, journal seq 26
bcachefs (loop0): flushing journal and stopping allocators complete, journal seq 26
bcachefs (loop0): clean shutdown complete, journal seq 27
bcachefs (loop0): done going read-only, filesystem not clean
bcachefs (loop0): done starting filesystem
bridge0: port 2(bridge_slave_1) entered disabled state
bridge0: port 1(bridge_slave_0) entered disabled state
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
------------[ cut here ]------------
kernel BUG at fs/bcachefs/fs.c:1323!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5362 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:bch2_fill_extent+0x96e/0x970 fs/bcachefs/fs.c:1323
Code: 0f 0b e8 e5 7c 7f fd 90 0f 0b e8 dd 7c 7f fd e9 f7 fe ff ff e8 d3 7c 7f fd 90 0f 0b e8 cb 7c 7f fd 90 0f 0b e8 c3 7c 7f fd 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41
RSP: 0018:ffffc9000d3b76a0 EFLAGS: 00010287
RAX: ffffffff844041cd RBX: 0000000000000016 RCX: 0000000000100000
RDX: ffffc9000e0aa000 RSI: 00000000000018a9 RDI: 00000000000018aa
RBP: 0000000000000001 R08: ffff88801f910000 R09: 0000000000000004
R10: 0000000000000012 R11: 0000000000000002 R12: 0000000000000000
R13: ffffc9000d3b7b28 R14: 0000000000000002 R15: 0000000000000002
FS:  00007f7f413a16c0(0000) GS:ffff88808d20c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdb6a18b000 CR3: 0000000043966000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 bch2_fiemap+0x2871/0x2a90 fs/bcachefs/fs.c:1538
 ioctl_fiemap fs/ioctl.c:220 [inline]
 do_vfs_ioctl+0x1173/0x1430 fs/ioctl.c:532
 __do_sys_ioctl fs/ioctl.c:596 [inline]
 __se_sys_ioctl+0x82/0x170 fs/ioctl.c:584
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7f4058eba9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7f413a1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f7f407d5fa0 RCX: 00007f7f4058eba9
RDX: 0000200000000100 RSI: 00000000c020660b RDI: 0000000000000007
RBP: 00007f7f40611e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7f407d6038 R14: 00007f7f407d5fa0 R15: 00007ffe54514bc8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_fill_extent+0x96e/0x970 fs/bcachefs/fs.c:1323
Code: 0f 0b e8 e5 7c 7f fd 90 0f 0b e8 dd 7c 7f fd e9 f7 fe ff ff e8 d3 7c 7f fd 90 0f 0b e8 cb 7c 7f fd 90 0f 0b e8 c3 7c 7f fd 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41
RSP: 0018:ffffc9000d3b76a0 EFLAGS: 00010287
RAX: ffffffff844041cd RBX: 0000000000000016 RCX: 0000000000100000
RDX: ffffc9000e0aa000 RSI: 00000000000018a9 RDI: 00000000000018aa
RBP: 0000000000000001 R08: ffff88801f910000 R09: 0000000000000004
R10: 0000000000000012 R11: 0000000000000002 R12: 0000000000000000
R13: ffffc9000d3b7b28 R14: 0000000000000002 R15: 0000000000000002
FS:  00007f7f413a16c0(0000) GS:ffff88808d20c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdb6a18b000 CR3: 0000000043966000 CR4: 0000000000352ef0

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/09 23:23 upstream 9dd1835ecda5 fdeaa69b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/09/08 04:14 upstream 6ab41fca2e80 d291dd2d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/09/03 07:39 upstream e6b9dce0aeeb 96a211bc .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/09/02 07:15 upstream b320789d6883 807a3b61 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/08/28 05:22 upstream 39f90c196721 e12e5ba4 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/08/25 08:29 upstream 1b237f190eb3 bf27483f .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/07/23 00:10 upstream 89be9a83ccf1 af30dea9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
2025/07/11 07:34 upstream bc9ff192a6c9 3cda49cf .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_fill_extent
* Struck through repros no longer work on HEAD.