UBSAN: shift-out-of-bounds in __btree_node_pinned

Status: auto-obsoleted due to no activity on 2025/10/12 01:18
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+9f41e4b255897d99d4e9@syzkaller.appspotmail.com
First crash: 684d, last: 410d
Cause bisection: introduced by (bisect log) :
commit 7a51608d0125469664e2daf8e060d6d783924c98
Author: Kent Overstreet <kent.overstreet@linux.dev>
Date: Thu Sep 5 00:49:37 2024 +0000

  bcachefs: Rework btree node pinning

Crash: UBSAN: shift-out-of-bounds in __btree_node_pinned (log)
Repro: C syz .config
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [bcachefs?] UBSAN: shift-out-of-bounds in __btree_node_pinned 0 (5) 2025/09/28 00:11
[PATCH v1] bcachefs: add check for btree id against max in try read node 4 (4) 2024/10/07 19:15
▶ ▼ Last patch testing requests (10)
Created Duration User Patch Repo Result
2025/09/28 00:11 39m xandfury@gmail.com upstream no crash log
2025/08/25 00:29 21m retest repro upstream no crash log
2025/06/15 23:53 15m retest repro upstream report log
2025/04/06 23:26 15m retest repro upstream report log
2025/02/04 03:47 13m retest repro upstream report log
2025/01/15 02:55 13m retest repro upstream report log
2024/12/21 15:01 19m retest repro upstream no crash log
2024/10/12 14:35 16m retest repro upstream report log
2024/10/04 21:48 16m niharchaithanya@gmail.com patch upstream report log
2024/10/04 19:54 17m niharchaithanya@gmail.com patch upstream report log
▶ ▼ Fix bisection attempts (6)
Created Duration User Patch Repo Result
2025/07/30 12:15 2h29m bisect fix upstream error job log
2025/06/29 21:50 1h35m bisect fix upstream OK (0) job log log
2025/05/30 05:51 1h59m bisect fix upstream OK (0) job log log
2025/04/26 19:28 2h35m bisect fix upstream OK (0) job log log
2025/03/23 21:23 1h33m bisect fix upstream OK (0) job log log
2025/02/21 15:12 1h30m bisect fix upstream OK (0) job log log

Sample crash report:
bcachefs (loop0): recovering from clean shutdown, journal seq 10
bcachefs (loop0): Doing compatible version upgrade from 1.7: mi_btree_bitmap to 1.13: inode_has_child_snapshots
  running recovery passes: check_allocations,check_inodes
bcachefs (loop0): dropping and reconstructing all alloc info
invalid btree id 251 (max 63), fix?
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/bcachefs/btree_cache.c:215:18
shift exponent 251 is too large for 64-bit type 'unsigned long long'
CPU: 0 UID: 0 PID: 5821 Comm: syz-executor193 Not tainted 6.13.0-rc5-syzkaller-00004-gccb98ccef0e5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
 __btree_node_pinned+0x80b/0x850 fs/bcachefs/btree_cache.c:215
 __bch2_btree_node_hash_insert+0xd02/0x1310 fs/bcachefs/btree_cache.c:292
 bch2_btree_node_hash_insert+0x7e/0xc0 fs/bcachefs/btree_cache.c:307
 __bch2_btree_root_read fs/bcachefs/btree_io.c:1743 [inline]
 bch2_btree_root_read+0x5c6/0x7a0 fs/bcachefs/btree_io.c:1771
 read_btree_roots+0x296/0x840 fs/bcachefs/recovery.c:523
 bch2_fs_recovery+0x2585/0x39d0 fs/bcachefs/recovery.c:853
 bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1037
 bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170
 vfs_get_tree+0x90/0x2b0 fs/super.c:1814
 do_new_mount+0x2be/0xb40 fs/namespace.c:3507
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4057 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb0bcbc8f3a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffecf5c55f8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffecf5c5610 RCX: 00007fb0bcbc8f3a
RDX: 0000000020000180 RSI: 0000000020000540 RDI: 00007ffecf5c5610
RBP: 0000000000000004 R08: 00007ffecf5c5650 R09: 0000000000005965
R10: 0000000000800000 R11: 0000000000000282 R12: 0000000000800000
R13: 00007ffecf5c5650 R14: 0000000000000003 R15: 0000000001000000
 </TASK>
---[ end trace ]---

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/01 02:54 upstream ccb98ccef0e5 d3ccff63 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs UBSAN: shift-out-of-bounds in __btree_node_pinned
2025/01/20 21:58 upstream ffd294d346d1 6e87cfa2 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in __btree_node_pinned
2024/12/28 01:20 upstream 8379578b11d5 d3ccff63 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in __btree_node_pinned
2024/12/28 01:12 upstream 8379578b11d5 d3ccff63 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in __btree_node_pinned
2024/09/28 14:33 upstream ad46e8f95e93 ba29ff75 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] [mounted in repro] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in __btree_node_pinned
2024/09/28 10:45 upstream e477dba5442c 440b26ec .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root UBSAN: shift-out-of-bounds in __btree_node_pinned
* Struck through repros no longer work on HEAD.