syzbot


kernel BUG in bch2_quota_transfer (2)

Status: upstream: reported on 2025/09/12 12:48
Subsystems: bcachefs
[Documentation on labels]
Reported-by: syzbot+86d3938ade3c1d827514@syzkaller.appspotmail.com
First crash: 4d13h, last: 4d13h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bcachefs?] kernel BUG in bch2_quota_transfer (2) 0 (1) 2025/09/12 12:48
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in bch2_quota_transfer bcachefs -1 67 115d 251d 0/29 auto-obsoleted due to no activity on 2025/07/29 17:42

Sample crash report:
  /, fixing
 done
bcachefs (loop0): check_xattrs...
bcachefs (loop0): key in missing inode, found keys:
  u64s 7 type xattr 1073741824:945502502804528484:U32_MAX len 0 ver 0: user.xattr2:xattr2
  u64s 7 type xattr 1073741824:3442546108204556527:U32_MAX len 0 ver 0: user.xattr1:xattr1
  , fixing
bcachefs (loop0): key in missing inode, found keys:
  u64s 7 type xattr 1073741824:3442546108204556527:U32_MAX len 0 ver 0: user.xattr1:xattr1
  , fixing
 done
bcachefs (loop0): check_root... done
bcachefs (loop0): check_unreachable_inodes... done
bcachefs (loop0): check_subvolume_structure... done
bcachefs (loop0): check_directory_structure... done
bcachefs (loop0): check_nlinks... done
bcachefs (loop0): check_rebalance_work... done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): set_fs_needs_rebalance... done
bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean
bcachefs (loop0): check_alloc_info... done
bcachefs (loop0): check_lrus... done
bcachefs (loop0): check_btree_backpointers... done
bcachefs (loop0): check_backpointers_to_extents... done
bcachefs (loop0): check_extents_to_backpointers... done
bcachefs (loop0): check_alloc_to_lru_refs... done
bcachefs (loop0): check_snapshot_trees... done
bcachefs (loop0): check_snapshots... done
bcachefs (loop0): check_subvols... done
bcachefs (loop0): check_subvol_children... done
bcachefs (loop0): delete_dead_snapshots... done
bcachefs (loop0): check_inodes... done
bcachefs (loop0): check_extents... done
bcachefs (loop0): check_indirect_extents... done
bcachefs (loop0): check_dirents... done
bcachefs (loop0): check_xattrs... done
bcachefs (loop0): check_root... done
bcachefs (loop0): check_unreachable_inodes... done
bcachefs (loop0): check_subvolume_structure... done
bcachefs (loop0): check_directory_structure... done
bcachefs (loop0): check_nlinks... done
bcachefs (loop0): check_rebalance_work... done
bcachefs (loop0): resume_logged_ops... done
bcachefs (loop0): delete_dead_inodes... done
bcachefs (loop0): set_fs_needs_rebalance... done
bcachefs (loop0): reading quotas
bcachefs (loop0): quotas done
bcachefs (loop0): done starting filesystem
------------[ cut here ]------------
kernel BUG at fs/bcachefs/quota.c:319!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5353 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__bch2_quota_transfer fs/bcachefs/quota.c:319 [inline]
RIP: 0010:bch2_quota_transfer+0xa29/0xa50 fs/bcachefs/quota.c:367
Code: ff ff 89 f9 80 e1 07 38 c1 0f 8c 72 f7 ff ff 48 89 d3 e8 0a fc d1 fd 48 89 da e9 62 f7 ff ff e8 cd 54 29 07 e8 68 0c 6d fd 90 <0f> 0b e8 60 0c 6d fd 90 0f 0b e8 58 0c 6d fd 90 0f 0b e8 50 0c 6d
RSP: 0018:ffffc9000f40f700 EFLAGS: 00010283
RAX: ffffffff8452b228 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc9000dbd2000 RSI: 00000000000008db RDI: 00000000000008dc
RBP: ffffc9000f40f8b0 R08: 0000000000000001 R09: 0000000000000001
R10: dffffc0000000000 R11: fffffbfff1f47807 R12: 0000000000000000
R13: ffff8880343d7c28 R14: 1ffff11007ff820a R15: dffffc0000000000
FS:  00007f3e39d976c0(0000) GS:ffff88808d20c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000004000 CR3: 0000000043f9a000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 bch2_fs_quota_transfer+0x27d/0x4f0 fs/bcachefs/fs.c:183
 bch2_setattr_nonsize+0x3a6/0x10e0 fs/bcachefs/fs.c:1122
 notify_change+0xb33/0xe40 fs/attr.c:552
 chown_common+0x40c/0x5c0 fs/open.c:791
 vfs_fchown fs/open.c:859 [inline]
 ksys_fchown+0xea/0x160 fs/open.c:871
 __do_sys_fchown fs/open.c:876 [inline]
 __se_sys_fchown fs/open.c:874 [inline]
 __x64_sys_fchown+0x7a/0x90 fs/open.c:874
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3e38f8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3e39d97038 EFLAGS: 00000246 ORIG_RAX: 000000000000005d
RAX: ffffffffffffffda RBX: 00007f3e391c5fa0 RCX: 00007f3e38f8ebe9
RDX: 000000000000000a RSI: 000000003a736e6f RDI: 0000000000000006
RBP: 00007f3e39011e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3e391c6038 R14: 00007f3e391c5fa0 R15: 00007ffd7c15f018
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__bch2_quota_transfer fs/bcachefs/quota.c:319 [inline]
RIP: 0010:bch2_quota_transfer+0xa29/0xa50 fs/bcachefs/quota.c:367
Code: ff ff 89 f9 80 e1 07 38 c1 0f 8c 72 f7 ff ff 48 89 d3 e8 0a fc d1 fd 48 89 da e9 62 f7 ff ff e8 cd 54 29 07 e8 68 0c 6d fd 90 <0f> 0b e8 60 0c 6d fd 90 0f 0b e8 58 0c 6d fd 90 0f 0b e8 50 0c 6d
RSP: 0018:ffffc9000f40f700 EFLAGS: 00010283
RAX: ffffffff8452b228 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc9000dbd2000 RSI: 00000000000008db RDI: 00000000000008dc
RBP: ffffc9000f40f8b0 R08: 0000000000000001 R09: 0000000000000001
R10: dffffc0000000000 R11: fffffbfff1f47807 R12: 0000000000000000
R13: ffff8880343d7c28 R14: 1ffff11007ff820a R15: dffffc0000000000
FS:  00007f3e39d976c0(0000) GS:ffff88808d20c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3e39d75fc8 CR3: 0000000043f9a000 CR4: 0000000000352ef0

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/08 12:39 upstream 76eeb9b8de98 d291dd2d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in bch2_quota_transfer
* Struck through repros no longer work on HEAD.