syzbot


WARNING in bch2_dev_free (2)

Status: upstream: reported C repro on 2025/07/17 19:13
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+6d52ee9afea131b36348@syzkaller.appspotmail.com
Fix commit: bcachefs: Fix __bch2_fs_read_write() error path
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 4d11h, last: 19h03m
Cause bisection: introduced by (bisect log) :
commit de7405eff27e9bda562af96f8a7a6263ccd92f68
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Tue Jul 15 15:57:49 2025 +0000

  bcachefs: Fix __bch2_fs_read_write() error path

Crash: WARNING in bch2_dev_free (log)
Repro: C syz .config
  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bcachefs?] WARNING in bch2_dev_free (2) 2 (3) 2025/07/18 19:12
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in bch2_dev_free bcachefs -1 C done 258 41d 103d 28/29 fixed on 2025/06/13 13:52

Sample crash report:
bcachefs (loop0): going read-write
bcachefs (loop0): bch2_write_super(): fatal error  loop0: Superblock modified by another process (seq 43 expected 42)
bcachefs (loop0): error in recovery: erofs_sb_err
bcachefs (loop0): bch2_fs_start(): error starting filesystem erofs_sb_err
------------[ cut here ]------------
WARNING: fs/bcachefs/super.c:1373 at bch2_dev_free+0x3db/0x480 fs/bcachefs/super.c:1373, CPU#0: syz-executor315/5848
Modules linked in:
CPU: 0 UID: 0 PID: 5848 Comm: syz-executor315 Not tainted 6.16.0-rc6-next-20250716-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:bch2_dev_free+0x3db/0x480 fs/bcachefs/super.c:1373
Code: f7 e8 e9 13 e2 ff 4c 89 ef e8 e1 13 e2 ff 4c 89 ff 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d e9 7b dd 14 07 e8 96 e7 65 fd 90 <0f> 0b 90 e9 2c fd ff ff e8 88 e7 65 fd 90 0f 0b 90 e9 fe fd ff ff
RSP: 0018:ffffc90003f2f8c8 EFLAGS: 00010293
RAX: ffffffff8459bf3a RBX: dffffc0000000000 RCX: ffff888033b1bc00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88801fb71687 R09: 1ffff11003f6e2d0
R10: dffffc0000000000 R11: ffffed1003f6e2d1 R12: ffff888031fe8128
R13: 0000000000000001 R14: 1ffff110063fd024 R15: 1ffff110063fd025
FS:  0000555561a5c380(0000) GS:ffff888125be2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000557f62e59da0 CR3: 0000000068888000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 bch2_fs_free+0x440/0x550 fs/bcachefs/super.c:749
 bch2_fs_get_tree+0xb76/0x1540 fs/bcachefs/fs.c:2572
 vfs_get_tree+0x8f/0x2b0 fs/super.c:1804
 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3805
 do_mount fs/namespace.c:4133 [inline]
 __do_sys_mount fs/namespace.c:4344 [inline]
 __se_sys_mount+0x317/0x410 fs/namespace.c:4321
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f27d9758eaa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd6f511ee8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffd6f511f00 RCX: 00007f27d9758eaa
RDX: 0000200000000080 RSI: 0000200000000000 RDI: 00007ffd6f511f00
RBP: 0000200000000000 R08: 00007ffd6f511f40 R09: 000000000000f631
R10: 0000000001010051 R11: 0000000000000282 R12: 0000200000000080
R13: 0000000000000004 R14: 0000000000000003 R15: 00007ffd6f511f40
 </TASK>

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/17 04:26 linux-next e8352908bdcd 44f8051e .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-linux-next-kasan-gce-root WARNING in bch2_dev_free
2025/07/20 09:10 linux-next d086c886ceb9 7117feec .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in bch2_dev_free
2025/07/16 17:13 linux-next e8352908bdcd c118d736 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root WARNING in bch2_dev_free
* Struck through repros no longer work on HEAD.