syzbot


KASAN: null-ptr-deref Write in __bch2_trans_get

Status: moderation: reported on 2025/02/17 07:54
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+4b29a3ec4245f1a57b79@syzkaller.appspotmail.com
First crash: 57d, last: 12d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: unable to handle kernel paging request in __bch2_trans_get bcachefs 1 210d 199d 0/28 auto-obsoleted due to no activity on 2024/12/26 04:05

Sample crash report:
bcachefs (loop2): initializing new filesystem
==================================================================
BUG: KASAN: null-ptr-deref in __bch2_trans_get+0xcd/0xd40 fs/bcachefs/btree_iter.c:3317
Write of size 360 at addr 0000000000000001 by task syz.2.1692/11245

CPU: 0 UID: 0 PID: 11245 Comm: syz.2.1692 Not tainted 6.14.0-syzkaller-12886-ga1b5bd45d4ee #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_report+0xe3/0x5b0 mm/kasan/report.c:524
 kasan_report+0x143/0x180 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x28f/0x2a0 mm/kasan/generic.c:189
 __asan_memset+0x23/0x50 mm/kasan/shadow.c:84
 __bch2_trans_get+0xcd/0xd40 fs/bcachefs/btree_iter.c:3317
 bch2_btree_root_alloc_fake+0x44/0x130 fs/bcachefs/btree_update_interior.c:2629
 bch2_fs_initialize+0x85e/0x1620 fs/bcachefs/recovery.c:1118
 bch2_fs_start+0x2ec/0x610 fs/bcachefs/super.c:1061
 bch2_fs_get_tree+0x113e/0x18f0 fs/bcachefs/fs.c:2253
 vfs_get_tree+0x90/0x2b0 fs/super.c:1759
 do_new_mount+0x2cf/0xb70 fs/namespace.c:3878
 do_mount fs/namespace.c:4218 [inline]
 __do_sys_mount fs/namespace.c:4429 [inline]
 __se_sys_mount+0x38c/0x400 fs/namespace.c:4406
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2a7c98e90a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2a7d782e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f2a7d782ef0 RCX: 00007f2a7c98e90a
RDX: 00002000000000c0 RSI: 0000200000000180 RDI: 00007f2a7d782eb0
RBP: 00002000000000c0 R08: 00007f2a7d782ef0 R09: 0000000001200010
R10: 0000000001200010 R11: 0000000000000246 R12: 0000200000000180
R13: 00007f2a7d782eb0 R14: 0000000000005a07 R15: 0000200000000480
 </TASK>
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/03 07:02 upstream a1b5bd45d4ee 996a9618 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: null-ptr-deref Write in __bch2_trans_get
2025/02/16 10:51 upstream ad1b832bf1cf 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs KASAN: null-ptr-deref Write in __bch2_trans_get
* Struck through repros no longer work on HEAD.