Warning: Permanently added '10.128.0.202' (ED25519) to the list of known hosts. executing program [ 36.139578][ T6487] loop0: detected capacity change from 0 to 32768 [ 36.258268][ T6487] bcachefs (baafa011-d992-4344-aaf9-4ff0e0bec0ff): Using encoding defined by superblock: utf8-12.1.0 [ 36.269511][ T6487] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,background_compression=zstd,grpquota,nojournal_transaction_names,no_data_io [ 36.269511][ T6487] allowing incompatible features above 0.0: (unknown version) [ 36.269737][ T6487] bcachefs (loop0): recovering from clean shutdown, journal seq 13 [ 36.269882][ T6487] bcachefs (loop0): Version upgrade required: [ 36.269882][ T6487] Version upgrade from 0.32: (unknown version) to 1.7: mi_btree_bitmap incomplete [ 36.269882][ T6487] Doing incompatible version upgrade from 0.32: (unknown version) to 1.25: extent_flags [ 36.269882][ T6487] running recovery passes: check_allocations,check_extents_to_backpointers,check_snapshots,check_subvols,check_inodes,check_dirents,set_fs_needs_rebalance [ 36.275863][ T6487] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree inodes level 0/0 [ 36.275888][ T6487] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2a20405ac3f40602 written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 [ 36.275901][ T6487] node offset 8/24 bset u64s 29: checksum error, type chacha20_poly1305_128: got f8456eb9a83e831f81f0fce6813a84d4 should be ef30dab84eb82d57729a51b00f54184b, fixing [ 36.276103][ T6487] bcachefs (loop0): bcachefs (loop0): error validating btree node at btree inodes level 0/0 [ 36.276115][ T6487] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2a20405ac3f40602 written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 [ 36.276152][ T6487] node offset 8/24 bset u64s 29 bset byte offset 40: key extends past end of bset, fixing [ 36.276359][ T6487] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree inodes level 0/0 [ 36.276371][ T6487] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2a20405ac3f40602 written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 [ 36.276383][ T6487] node offset 16/24 bset u64s 110: checksum error, type chacha20_poly1305_128: got ca1efad85cd55ae08e1cc9ae8bb4c330 should be d1e256903dc89dd6436b0db8b45d2093, fixing [ 36.276712][ T6487] bcachefs (loop0): invalid bkey in btree_node btree=inodes level=0: u64s 18 type inode_v3 0:4100:U32_MAX len 0 ver 0: (unpack error) [ 36.276726][ T6487] invalid variable length fields, deleting [ 36.276877][ T6487] bcachefs (loop0): btree_node_read_work: rewriting btree node at due to error [ 36.276877][ T6487] btree=inodes level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2a20405ac3f40602 written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 [ 36.277625][ T6487] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree dirents level 0/0 [ 36.277641][ T6487] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 267fcf747c875937 written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0 [ 36.277653][ T6487] node offset 16/24 bset u64s 36: checksum error, type chacha20_poly1305_128: got 888929da0b83c604eaf25fa65c8a4b93 should be 9c0f2415a667f93682c3af0cd44ed5f4, fixing [ 36.277901][ T6487] bcachefs (loop0): btree_node_read_work: rewriting btree node at due to error [ 36.277901][ T6487] btree=dirents level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 267fcf747c875937 written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0 [ 36.279187][ T6487] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree alloc level 0/0 [ 36.279208][ T6487] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 36.279221][ T6487] node offset 8/40 bset u64s 375: checksum error, type chacha20_poly1305_128: got b9ce1a4b2b863debafacb20143deb410 should be 61ec379a8789477e76ff1a5280fd6dbd, fixing executing program [ 36.279467][ T6487] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree alloc level 0/0 [ 36.279480][ T6487] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 36.279492][ T6487] node offset 16/40 bset u64s 30: checksum error, type chacha20_poly1305_128: got 29c49b2fdd8d9048e17ac38271cc7e07 should be d4669159f868458f2b4c55fc2a69f1aa, fixing [ 36.279901][ T6487] ================================================================== [ 36.279914][ T6487] BUG: KASAN: use-after-free in poly1305_update_arch+0x2a0/0x3f0 [ 36.279938][ T6487] Read of size 8 at addr ffff0000e225b070 by task syz-executor418/6487 [ 36.279954][ T6487] [ 36.279965][ T6487] CPU: 0 UID: 0 PID: 6487 Comm: syz-executor418 Not tainted 6.15.0-rc5-syzkaller-gc32f8dc5aaf9 #0 PREEMPT [ 36.279978][ T6487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 36.279984][ T6487] Call trace: [ 36.279988][ T6487] show_stack+0x2c/0x3c (C) [ 36.280000][ T6487] __dump_stack+0x30/0x40 [ 36.280010][ T6487] dump_stack_lvl+0xd8/0x12c [ 36.280020][ T6487] print_address_description+0xa8/0x254 [ 36.280033][ T6487] print_report+0x68/0x84 [ 36.280045][ T6487] kasan_report+0xb0/0x110 [ 36.280055][ T6487] kasan_check_range+0x264/0x2a4 [ 36.280065][ T6487] __asan_memcpy+0x3c/0x84 [ 36.280076][ T6487] poly1305_update_arch+0x2a0/0x3f0 [ 36.280088][ T6487] bch2_checksum+0x1d4/0x4ac [ 36.280100][ T6487] bch2_btree_node_read_done+0xd20/0x4328 [ 36.280111][ T6487] btree_node_read_work+0x414/0xc64 [ 36.280137][ T6487] bch2_btree_node_read+0x1c88/0x228c [ 36.280148][ T6487] bch2_btree_root_read+0x274/0x3b0 [ 36.280158][ T6487] read_btree_roots+0x220/0x6c0 [ 36.280174][ T6487] bch2_fs_recovery+0x1a60/0x2d30 [ 36.280187][ T6487] bch2_fs_start+0x5b0/0x908 [ 36.280199][ T6487] bch2_fs_get_tree+0xa0c/0xf30 [ 36.280211][ T6487] vfs_get_tree+0x90/0x28c [ 36.280223][ T6487] do_new_mount+0x228/0x814 [ 36.280235][ T6487] path_mount+0x5b4/0xde0 [ 36.280246][ T6487] __arm64_sys_mount+0x3e8/0x468 [ 36.280257][ T6487] invoke_syscall+0x98/0x2b8 [ 36.280267][ T6487] el0_svc_common+0x130/0x23c [ 36.280277][ T6487] do_el0_svc+0x48/0x58 [ 36.280287][ T6487] el0_svc+0x58/0x17c [ 36.280301][ T6487] el0t_64_sync_handler+0x78/0x108 [ 36.280313][ T6487] el0t_64_sync+0x198/0x19c [ 36.280325][ T6487] [ 36.280468][ T6487] The buggy address belongs to the physical page: [ 36.280478][ T6487] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12225b [ 36.280494][ T6487] flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) [ 36.280515][ T6487] raw: 05ffc00000000000 0000000000000000 fffffdffc38896c8 0000000000000000 [ 36.280531][ T6487] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 36.280542][ T6487] page dumped because: kasan: bad access detected [ 36.280552][ T6487] [ 36.280561][ T6487] Memory state around the buggy address: [ 36.280572][ T6487] ffff0000e225af00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.280585][ T6487] ffff0000e225af80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.280599][ T6487] >ffff0000e225b000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.280610][ T6487] ^ [ 36.280622][ T6487] ffff0000e225b080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.280635][ T6487] ffff0000e225b100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 36.280647][ T6487] ================================================================== [ 36.280659][ T6487] Disabling lock debugging due to kernel taint [ 36.280789][ T6487] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree alloc level 0/0 [ 36.280800][ T6487] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 36.280811][ T6487] node offset 24/40 bset u64s 61450: checksum error, type chacha20_poly1305_128: got cc4708a18a79d18b0e29d148f3f534b5 should be eca0b87f8a1bd5d855d98c80b1d5305e, fixing [ 36.281624][ T6487] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree alloc level 0/0 [ 36.281636][ T6487] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 36.281646][ T6487] node offset 24/40 bset u64s 61450: bset past end of btree node (offset 24 len 968 but written 40), fixing [ 36.281777][ T6487] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree alloc level 0/0 [ 36.281787][ T6487] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 36.281797][ T6487] node offset 24/40 bset u64s 0: empty bset, fixing [ 36.282114][ T6487] bcachefs (loop0): invalid bkey in btree_node btree=alloc level=0: u64s 11 type alloc_v4 0:22:0 len 0 ver 0: [ 36.282138][ T6487] gen 0 oldest_gen 0 data_type sb [ 36.282146][ T6487] journal_seq_nonempty 1 [ 36.282154][ T6487] journal_seq_empty 0 [ 36.282161][ T6487] need_discard 1 [ 36.282169][ T6487] need_inc_gen 1 [ 36.282176][ T6487] dirty_sectors 256 [ 36.282184][ T6487] stripe_sectors 0 [ 36.282191][ T6487] cached_sectors 0 [ 36.282199][ T6487] stripe 0 [ 36.282206][ T6487] stripe_redundancy 0 [ 36.282214][ T6487] io_time[READ] 1 [ 36.282221][ T6487] io_time[WRITE] 1 [ 36.282229][ T6487] fragmentation 0 [ 36.282236][ T6487] bp_start 8 [ 36.282244][ T6487] [ 36.282250][ T6487] bad val size (14 > 6), deleting [ 36.282447][ T6487] bcachefs (loop0): btree_node_read_work: rewriting btree node at due to error [ 36.282447][ T6487] btree=alloc level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 36.284722][ T6487] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree freespace level 0/0 [ 36.284736][ T6487] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq b6c44d07df4e9bb7 written 48 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0 [ 36.284747][ T6487] node offset 8/48 bset u64s 35: checksum error, type chacha20_poly1305_128: got 9a0c7e4fba9774736fd5fe399afe0fd4 should be 696606121d98d113a1b1dc69c6e72339, fixing [ 36.284966][ T6487] bcachefs (loop0): btree_node_read_work: rewriting btree node at due to error [ 36.284966][ T6487] btree=freespace level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq b6c44d07df4e9bb7 written 48 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0 [ 36.286139][ T6487] bcachefs (loop0): accounting_read... done [ 36.303386][ T6487] bcachefs (loop0): alloc_read... done [ 36.303431][ T6487] bcachefs (loop0): snapshots_read... done [ 36.304000][ T6487] bcachefs (loop0): check_allocations... [ 36.306235][ T6487] bcachefs (loop0): bucket 0:28 data type btree ptr gen 0 missing in alloc btree [ 36.306250][ T6487] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 93dda84068e88b3f written 16 min_key POS_MIN durability: 1 ptr: 0:28:0 gen 0, fixing [ 36.306650][ T6487] bcachefs (loop0): bucket 0:36 data type btree ptr gen 0 missing in alloc btree [ 36.306660][ T6487] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 3b468546fb27822d written 24 min_key POS_MIN durability: 1 ptr: 0:36:0 gen 0, fixing [ 36.306884][ T6487] bcachefs (loop0): bucket 0:40 data type btree ptr gen 0 missing in alloc btree [ 36.306895][ T6487] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 82036bda63714c10 written 8 min_key POS_MIN durability: 1 ptr: 0:40:0 gen 0, fixing [ 36.307281][ T6487] bcachefs (loop0): bucket 0:22 gen 0 has wrong data_type: got free, should be sb, fixing [ 36.307373][ T6487] bcachefs (loop0): bucket 0:22 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing [ 36.307597][ T6487] bcachefs (loop0): bucket 0:28 gen 0 has wrong data_type: got free, should be btree, fixing [ 36.307651][ T6487] bcachefs (loop0): bucket 0:28 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing [ 36.307775][ T6487] bcachefs (loop0): bucket 0:36 gen 0 has wrong data_type: got free, should be btree, fixing [ 36.307823][ T6487] bcachefs (loop0): bucket 0:36 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing [ 36.307922][ T6487] bcachefs (loop0): bucket 0:40 gen 0 has wrong data_type: got free, should be btree, fixing [ 36.307971][ T6487] bcachefs (loop0): bucket 0:40 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing [ 36.309044][ T6487] done [ 36.310410][ T6487] bcachefs (loop0): going read-write [ 36.315880][ T6487] bcachefs (loop0): journal_replay... done [ 36.327715][ T6487] bcachefs (loop0): check_extents_to_backpointers... [ 36.328530][ T6487] bcachefs (loop0): scanning for missing backpointers in 2/128 buckets [ 36.328905][ T6487] done [ 36.329605][ T6487] bcachefs (loop0): check_snapshots... [ 36.329858][ T6487] bcachefs (loop0): snapshot points to missing/incorrect tree: executing program [ 36.329869][ T6487] u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent 0 children 0 0 subvol 1 tree 0, fixing [ 36.332137][ T6487] done [ 36.332833][ T6487] bcachefs (loop0): check_subvols... done [ 36.334128][ T6487] bcachefs (loop0): check_inodes... [ 36.334611][ T6487] bcachefs (loop0): inode points to missing dirent [ 36.334622][ T6487] inum: 4099:4294967295 [ 36.334630][ T6487] mode=100755 [ 36.334637][ T6487] flags=(15300000) [ 36.334645][ T6487] journal_seq=5 [ 36.334652][ T6487] hash_seed=ab878b4c5ab7c89e [ 36.334659][ T6487] hash_type=siphash [ 36.334667][ T6487] bi_size=1050 [ 36.334674][ T6487] bi_sectors=8 [ 36.334681][ T6487] bi_version=0 [ 36.334688][ T6487] bi_atime=1997793410 [ 36.334695][ T6487] bi_ctime=1997793410 [ 36.334703][ T6487] bi_mtime=1997793410 [ 36.334710][ T6487] bi_otime=1997793410 [ 36.334718][ T6487] bi_uid=0 [ 36.334725][ T6487] bi_gid=0 [ 36.334732][ T6487] bi_nlink=0 [ 36.334739][ T6487] bi_generation=0 [ 36.334746][ T6487] bi_dev=0 [ 36.334753][ T6487] bi_data_checksum=0 [ 36.334761][ T6487] bi_compression=0 [ 36.334768][ T6487] bi_project=0 [ 36.334775][ T6487] bi_background_compression=0 [ 36.334783][ T6487] bi_data_replicas=0 [ 36.334790][ T6487] bi_promote_target=0 [ 36.334797][ T6487] bi_foreground_target=0 [ 36.334805][ T6487] bi_background_target=0 [ 36.334812][ T6487] bi_erasure_code=0 [ 36.334820][ T6487] bi_fields_set=0 [ 36.334827][ T6487] bi_dir=4098 [ 36.334834][ T6487] bi_dir_offset=2566586984702133180 [ 36.334842][ T6487] bi_subvol=0 [ 36.334849][ T6487] bi_parent_subvol=0 [ 36.334856][ T6487] bi_nocow=0 [ 36.334863][ T6487] bi_depth=0 [ 36.334870][ T6487] bi_inodes_32bit=0 [ 36.334878][ T6487] bi_casefold=0, fixing [ 36.335404][ T6487] bcachefs (loop0): inode journal seq in future (currently at 21) [ 36.335414][ T6487] inum: 1073741825:4294967295 [ 36.335422][ T6487] mode=100755 [ 36.335429][ T6487] flags=(15300000) [ 36.335436][ T6487] journal_seq=10300415144517173253 [ 36.335444][ T6487] hash_seed=259b6b0d0abf3ed4 [ 36.335457][ T6487] hash_type=siphash [ 36.335464][ T6487] bi_size=9000 [ 36.335472][ T6487] bi_sectors=24 [ 36.335479][ T6487] bi_version=0 [ 36.335486][ T6487] bi_atime=2007793514 [ 36.335494][ T6487] bi_ctime=2007793514 [ 36.335501][ T6487] bi_mtime=2007793514 [ 36.335508][ T6487] bi_otime=2007793514 [ 36.335516][ T6487] bi_uid=0 [ 36.335523][ T6487] bi_gid=0 [ 36.335530][ T6487] bi_nlink=1 [ 36.335537][ T6487] bi_generation=0 [ 36.335544][ T6487] bi_dev=0 [ 36.335551][ T6487] bi_data_checksum=0 [ 36.335559][ T6487] bi_compression=0 [ 36.335566][ T6487] bi_project=0 [ 36.335573][ T6487] bi_background_compression=0 [ 36.335581][ T6487] bi_data_replicas=0 [ 36.335588][ T6487] bi_promote_target=0 [ 36.335595][ T6487] bi_foreground_target=0 [ 36.335603][ T6487] bi_background_target=0 [ 36.335610][ T6487] bi_erasure_code=0 [ 36.335618][ T6487] bi_fields_set=0 [ 36.335625][ T6487] bi_dir=4096 [ 36.335632][ T6487] bi_dir_offset=3784119180373593407 [ 36.335640][ T6487] bi_subvol=0 [ 36.335647][ T6487] bi_parent_subvol=0 [ 36.335654][ T6487] bi_nocow=0 [ 36.335662][ T6487] bi_depth=0 [ 36.335669][ T6487] bi_inodes_32bit=0 [ 36.335676][ T6487] bi_casefold=0, fixing [ 36.336001][ T6487] done [ 36.336740][ T6487] bcachefs (loop0): check_dirents... [ 36.337097][ T6487] bcachefs (loop0): dirent points to missing inode: [ 36.337108][ T6487] u64s 8 type dirent 4096:1859603997870691834:U32_MAX len 0 ver 0: lost+found -> 4097 type dir, fixing [ 36.337654][ T6487] bcachefs (loop0): key in missing snapshot dirents u64s 7 type dirent 4098:2566587684781802388:1895552767 len 0 ver 0: file0 -> 4099 type reg, deleting [ 36.337796][ T6487] bcachefs (loop0): dirent points to missing inode: [ 36.337806][ T6487] u64s 7 type dirent 4098:4600437421902197670:U32_MAX len 0 ver 0: file1 -> 4100 type lnk, fixing [ 36.337900][ T6487] done [ 36.338573][ T6487] bcachefs (loop0): resume_logged_ops... done [ 36.338621][ T6487] bcachefs (loop0): delete_dead_inodes... done [ 36.338791][ T6487] bcachefs (loop0): set_fs_needs_rebalance... done [ 36.355955][ T6487] bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean [ 36.355984][ T6487] bcachefs (loop0): check_extents_to_backpointers... done [ 36.356723][ T6487] bcachefs (loop0): check_snapshots... done [ 36.356799][ T6487] bcachefs (loop0): check_subvols... done [ 36.356868][ T6487] bcachefs (loop0): check_inodes... done [ 36.357063][ T6487] bcachefs (loop0): check_dirents... [ 36.357574][ T6487] bcachefs (loop0): key in missing snapshot dirents u64s 7 type dirent 4098:2566587684781802388:1895552767 len 0 ver 0: file0 -> 4099 type reg, deleting [ 36.357694][ T6487] bcachefs (loop0): directory 4096:4294967295 with wrong i_nlink: got 2, should be 1, fixing [ 36.357837][ T6487] done [ 36.358191][ T6487] bcachefs (loop0): resume_logged_ops... done [ 36.358236][ T6487] bcachefs (loop0): delete_dead_inodes... done [ 36.358279][ T6487] bcachefs (loop0): set_fs_needs_rebalance... done [ 36.358870][ T6487] bcachefs (loop0): Second fsck run was not clean [ 36.358888][ T6487] bcachefs (loop0): reading quotas [ 36.359463][ T6487] bcachefs (loop0): quotas done [ 36.360426][ T6487] bcachefs (loop0): done starting filesystem executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program