syzbot


kernel BUG in __build_ro_aux_tree (2)

Status: upstream: reported on 2025/07/24 01:12
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+7e787e7154eb952a259b@syzkaller.appspotmail.com
First crash: 53d, last: 4d11h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bcachefs?] kernel BUG in __build_ro_aux_tree (2) 0 (1) 2025/07/24 01:12
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in __build_ro_aux_tree bcachefs -1 4 189d 270d 0/29 auto-obsoleted due to no activity on 2025/06/13 20:14

Sample crash report:
    bi_inodes_32bit=0
    bi_casefold=0, fixing
bcachefs (loop0): got lostfound inum 4097
bcachefs (loop0): reattached at (disconnected)
 done
bcachefs (loop0): check_subvolume_structure... done
bcachefs (loop0): check_directory_structure... done
bcachefs (loop0): check_nlinks... done
bcachefs (loop0): check_rebalance_work... done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): set_fs_needs_rebalance... done
bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean
bcachefs (loop0): check_alloc_info... done
bcachefs (loop0): check_lrus... done
bcachefs (loop0): check_btree_backpointers... done
bcachefs (loop0): check_backpointers_to_extents... done
bcachefs (loop0): check_extents_to_backpointers... done
bcachefs (loop0): check_alloc_to_lru_refs... done
bcachefs (loop0): check_snapshot_trees... done
bcachefs (loop0): check_snapshots... done
bcachefs (loop0): check_subvols... done
bcachefs (loop0): check_subvol_children... done
bcachefs (loop0): delete_dead_snapshots... done
bcachefs (loop0): check_inodes... done
bcachefs (loop0): check_extents... done
bcachefs (loop0): check_indirect_extents... done
bcachefs (loop0): check_dirents...
bcachefs (loop0): directory with wrong i_nlink: got 0, should be 1
  /, fixing
 done
bcachefs (loop0): check_xattrs... done
bcachefs (loop0): check_root... done
bcachefs (loop0): check_unreachable_inodes... done
bcachefs (loop0): check_subvolume_structure... done
bcachefs (loop0): check_directory_structure... done
bcachefs (loop0): check_nlinks... done
bcachefs (loop0): check_rebalance_work... done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): set_fs_needs_rebalance... done
bcachefs (loop0): Second fsck run was not clean
bcachefs (loop0): scanning for old btree nodes: min_version 0.9: (unknown version)
bcachefs (loop0): scanning for old btree nodes done
bcachefs (loop0): done starting filesystem
bcachefs (loop0): shutting down
bcachefs (loop0): going read-only
bcachefs (loop0): finished waiting for writes to stop
bcachefs (loop0): flushing journal and stopping allocators, journal seq 35
------------[ cut here ]------------
kernel BUG at fs/bcachefs/bset.c:652!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5355 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:make_bfloat fs/bcachefs/bset.c:652 [inline]
RIP: 0010:__build_ro_aux_tree+0x17e1/0x1800 fs/bcachefs/bset.c:750
Code: 40 9d fd be 01 00 00 00 48 c7 c7 a0 0f 76 8e 48 89 da e8 82 a0 de 00 e9 18 f4 ff ff e8 98 40 9d fd 90 0f 0b e8 90 40 9d fd 90 <0f> 0b e8 88 40 9d fd 90 0f 0b e8 80 40 9d fd 90 0f 0b 66 66 66 66
RSP: 0018:ffffc9000d47f2c0 EFLAGS: 00010246
RAX: ffffffff84227dc0 RBX: dffffc0000000000 RCX: 0000000000100000
RDX: ffffc9000e04a000 RSI: 00000000000fffff RDI: 0000000000100000
RBP: ffffc9000d47f490 R08: ffff88801fbd0000 R09: 0000000000000002
R10: 000000000000ffff R11: 0000000000000002 R12: ffff888056460191
R13: 0000000000000130 R14: 0000000000000001 R15: 0000000000000090
FS:  00007fec370646c0(0000) GS:ffff88808d20c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b6589bc168 CR3: 0000000030b26000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 bch2_bset_build_aux_tree+0x3f5/0x570 fs/bcachefs/bset.c:787
 bch2_btree_build_aux_trees fs/bcachefs/btree_io.c:451 [inline]
 bch2_btree_post_write_cleanup+0x630/0xad0 fs/bcachefs/btree_io.c:2628
 bch2_btree_node_write_trans+0x17b/0x760 fs/bcachefs/btree_io.c:2676
 btree_node_write_if_need fs/bcachefs/btree_io.h:167 [inline]
 __btree_node_flush+0x323/0x430 fs/bcachefs/btree_trans_commit.c:255
 bch2_btree_node_flush1+0x2a/0x40 fs/bcachefs/btree_trans_commit.c:269
 journal_flush_pins+0x8e3/0xe90 fs/bcachefs/journal_reclaim.c:604
 journal_flush_pins_or_still_flushing fs/bcachefs/journal_reclaim.c:871 [inline]
 journal_flush_done+0x112/0x810 fs/bcachefs/journal_reclaim.c:889
 bch2_journal_flush_pins+0x155/0x250 fs/bcachefs/journal_reclaim.c:921
 bch2_journal_flush_all_pins fs/bcachefs/journal_reclaim.h:76 [inline]
 __bch2_fs_read_only+0x144/0x5b0 fs/bcachefs/super.c:291
 bch2_fs_read_only+0x42a/0xb00 fs/bcachefs/super.c:366
 __bch2_fs_stop+0x100/0x900 fs/bcachefs/super.c:677
 generic_shutdown_super+0x135/0x2c0 fs/super.c:643
 bch2_kill_sb+0x41/0x50 fs/bcachefs/fs.c:2618
 deactivate_locked_super+0xb9/0x130 fs/super.c:474
 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1375
 task_work_run+0x1d1/0x260 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fec3619038a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fec37063e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffec RBX: 00007fec37063ef0 RCX: 00007fec3619038a
RDX: 000020000000f640 RSI: 000020000000f680 RDI: 00007fec37063eb0
RBP: 000020000000f640 R08: 00007fec37063ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000020000000f680
R13: 00007fec37063eb0 R14: 000000000000f634 R15: 0000200000000000
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:make_bfloat fs/bcachefs/bset.c:652 [inline]
RIP: 0010:__build_ro_aux_tree+0x17e1/0x1800 fs/bcachefs/bset.c:750
Code: 40 9d fd be 01 00 00 00 48 c7 c7 a0 0f 76 8e 48 89 da e8 82 a0 de 00 e9 18 f4 ff ff e8 98 40 9d fd 90 0f 0b e8 90 40 9d fd 90 <0f> 0b e8 88 40 9d fd 90 0f 0b e8 80 40 9d fd 90 0f 0b 66 66 66 66
RSP: 0018:ffffc9000d47f2c0 EFLAGS: 00010246
RAX: ffffffff84227dc0 RBX: dffffc0000000000 RCX: 0000000000100000
RDX: ffffc9000e04a000 RSI: 00000000000fffff RDI: 0000000000100000
RBP: ffffc9000d47f490 R08: ffff88801fbd0000 R09: 0000000000000002
R10: 000000000000ffff R11: 0000000000000002 R12: ffff888056460191
R13: 0000000000000130 R14: 0000000000000001 R15: 0000000000000090
FS:  00007fec370646c0(0000) GS:ffff88808d20c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b6589bc168 CR3: 0000000030b26000 CR4: 0000000000352ef0

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/07 02:56 upstream b236920731dd d291dd2d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in __build_ro_aux_tree
2025/08/06 17:33 upstream 479058002c32 4bd24a3e .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in __build_ro_aux_tree
2025/07/20 01:03 upstream bf61759db409 7117feec .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in __build_ro_aux_tree
* Struck through repros no longer work on HEAD.