Warning: Permanently added '[localhost]:9291' (ED25519) to the list of known hosts.
executing program
[ 69.620798][ T5314] loop0: detected capacity change from 0 to 32768
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[ 71.096273][ T5314] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names
[ 71.102523][ T5314] bcachefs (loop0): recovering from clean shutdown, journal seq 10
[ 71.105729][ T5314] bcachefs (loop0): Version upgrade required:
[ 71.105729][ T5314] Version upgrade from 0.24: unwritten_extents to 1.7: mi_btree_bitmap incomplete
[ 71.105729][ T5314] Doing incompatible version upgrade from 0.24: unwritten_extents to 1.13: inode_has_child_snapshots
[ 71.105729][ T5314] running recovery passes: check_allocations,check_alloc_info,check_lrus,check_btree_backpointers,check_backpointers_to_extents,check_extents_to_backpointers,check_alloc_to_lru_refs,bucket_gens_init,check_snapshot_trees,check_snapshots,check_subvols,check_subvol_children,delete_dead_snapshots,check_inodes,check_extents,check_indirect_extents,check_dirents,check_xattrs,check_root,check_unreachable_inodes,check_subvolume_structure,check_directory_structure,check_nlinks,set_fs_needs_rebalance
executing program
executing program
executing program
executing program
[ 71.369303][ T5314] bcachefs (loop0): accounting_read... done
[ 71.372114][ T5314] bcachefs (loop0): alloc_read... done
[ 71.374195][ T5314] bcachefs (loop0): stripes_read... done
[ 71.376469][ T5314] bcachefs (loop0): snapshots_read... done
executing program
[ 71.378886][ T5314] bcachefs (loop0): check_allocations...
[ 71.587252][ T5314] bucket 0:26 data type btree ptr gen 0 missing in alloc btree
[ 71.587279][ T5314] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0, fixing
[ 71.600193][ T5314] bucket 0:38 data type btree ptr gen 0 missing in alloc btree
[ 71.600208][ T5314] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0, fixing
[ 71.610574][ T5314] bucket 0:41 data type btree ptr gen 0 missing in alloc btree
[ 71.610585][ T5314] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0, fixing
[ 71.620093][ T5314] bucket 0:35 data type btree ptr gen 0 missing in alloc btree
[ 71.620108][ T5314] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0, fixing
[ 71.830788][ T5314] bucket 0:29 data type btree ptr gen 0 missing in alloc btree
[ 71.830804][ T5314] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq e81e1ed936acf3df written 32 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0, fixing
[ 71.839807][ T5314] bucket 0:1 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.843125][ T5314] bucket 0:1 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.847134][ T5314] bucket 0:2 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.850326][ T5314] bucket 0:2 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.854019][ T5314] bucket 0:3 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.857187][ T5314] bucket 0:3 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.860769][ T5314] bucket 0:4 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.863737][ T5314] bucket 0:4 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.867379][ T5314] bucket 0:5 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.870318][ T5314] bucket 0:5 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.873564][ T5314] bucket 0:6 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.876257][ T5314] bucket 0:6 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.879466][ T5314] bucket 0:7 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.882327][ T5314] bucket 0:7 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.887502][ T5314] bucket 0:8 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.890595][ T5314] bucket 0:8 gen 0 data type sb has wrong dirty_sectors: got 0, should be 8, fixing
[ 71.894421][ T5314] bucket 0:9 gen 0 has wrong data_type: got free, should be journal, fixing
[ 71.897520][ T5314] bucket 0:9 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.902213][ T5314] bucket 0:10 gen 0 has wrong data_type: got free, should be journal, fixing
[ 71.905354][ T5314] bucket 0:10 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.909153][ T5314] bucket 0:11 gen 0 has wrong data_type: got free, should be journal, fixing
[ 71.912460][ T5314] bucket 0:11 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.916304][ T5314] bucket 0:12 gen 0 has wrong data_type: got free, should be journal, fixing
[ 71.919708][ T5314] bucket 0:12 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.923601][ T5314] bucket 0:13 gen 0 has wrong data_type: got free, should be journal, fixing
[ 71.926898][ T5314] bucket 0:13 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.930946][ T5314] bucket 0:14 gen 0 has wrong data_type: got free, should be journal, fixing
[ 71.934105][ T5314] bucket 0:14 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.937721][ T5314] bucket 0:15 gen 0 has wrong data_type: got free, should be journal, fixing
[ 71.940828][ T5314] bucket 0:15 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.944569][ T5314] bucket 0:16 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.947671][ T5314] bucket 0:16 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.951625][ T5314] bucket 0:17 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.954698][ T5314] bucket 0:17 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.958218][ T5314] bucket 0:18 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.961319][ T5314] bucket 0:18 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.964925][ T5314] bucket 0:19 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.968002][ T5314] bucket 0:19 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.971851][ T5314] bucket 0:20 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.974960][ T5314] bucket 0:20 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.978550][ T5314] bucket 0:21 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.981683][ T5314] bucket 0:21 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.985291][ T5314] bucket 0:22 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.988038][ T5314] bucket 0:22 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.991674][ T5314] bucket 0:23 gen 0 has wrong data_type: got free, should be sb, fixing
[ 71.994524][ T5314] bucket 0:23 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 71.997942][ T5314] bucket 0:24 gen 0 has wrong data_type: got free, should be journal, fixing
[ 72.001391][ T5314] bucket 0:24 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.005118][ T5314] bucket 0:26 gen 0 has wrong data_type: got free, should be btree, fixing
[ 72.008275][ T5314] bucket 0:26 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.012029][ T5314] bucket 0:29 gen 0 has wrong data_type: got free, should be btree, fixing
[ 72.015210][ T5314] bucket 0:29 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.018984][ T5314] bucket 0:32 gen 0 has wrong data_type: got sb, should be btree, fixing
[ 72.022424][ T5314] bucket 0:35 gen 0 has wrong data_type: got free, should be btree, fixing
[ 72.025504][ T5314] bucket 0:35 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.029266][ T5314] bucket 0:38 gen 0 has wrong data_type: got free, should be btree, fixing
[ 72.032398][ T5314] bucket 0:38 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.035809][ T5314] bucket 0:41 gen 0 has wrong data_type: got free, should be btree, fixing
[ 72.038703][ T5314] bucket 0:41 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.042780][ T5314] bucket 0:120 gen 0 has wrong data_type: got free, should be sb, fixing
[ 72.045992][ T5314] bucket 0:120 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.049298][ T5314] bucket 0:121 gen 0 has wrong data_type: got free, should be sb, fixing
[ 72.052359][ T5314] bucket 0:121 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.056029][ T5314] bucket 0:122 gen 0 has wrong data_type: got free, should be sb, fixing
[ 72.059261][ T5314] bucket 0:122 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.063535][ T5314] bucket 0:123 gen 0 has wrong data_type: got free, should be sb, fixing
[ 72.066912][ T5314] bucket 0:123 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.070728][ T5314] bucket 0:124 gen 0 has wrong data_type: got free, should be sb, fixing
[ 72.073897][ T5314] bucket 0:124 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.077611][ T5314] bucket 0:125 gen 0 has wrong data_type: got free, should be sb, fixing
[ 72.080964][ T5314] bucket 0:125 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.084704][ T5314] bucket 0:126 gen 0 has wrong data_type: got free, should be sb, fixing
[ 72.087753][ T5314] bucket 0:126 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.091623][ T5314] bucket 0:127 gen 0 has wrong data_type: got free, should be sb, fixing
[ 72.094920][ T5314] bucket 0:127 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
[ 72.099584][ T5314] done
executing program
executing program
[ 72.766242][ T5314] bcachefs (loop0): going read-write
executing program
executing program
executing program
executing program
executing program
[ 72.769294][ T5314] bcachefs (loop0): journal_replay... done
[ 73.903405][ T5314] bcachefs (loop0): check_alloc_info... done
[ 73.916631][ T5314] bcachefs (loop0): check_lrus... done
[ 73.919374][ T5314] bcachefs (loop0): check_btree_backpointers... done
[ 73.922505][ T5314] bcachefs (loop0): check_backpointers_to_extents... done
[ 73.925996][ T5314] bcachefs (loop0): check_extents_to_backpointers...
[ 73.926710][ T5314] missing backpointer for btree=inodes l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0
[ 73.926733][ T5314] got: u64s 5 type deleted 0:9961472:0 len 0 ver 0
[ 73.926741][ T5314] want: u64s 9 type backpointer 0:9961472:0 len 0 ver 0: bucket=0:38:0 btree=inodes l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing
[ 73.944083][ T5314] missing backpointer for btree=dirents l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0
[ 73.944100][ T5314] got: u64s 5 type deleted 0:10747904:0 len 0 ver 0
[ 73.944107][ T5314] want: u64s 9 type backpointer 0:10747904:0 len 0 ver 0: bucket=0:41:0 btree=dirents l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing
[ 73.958409][ T5314] missing backpointer for btree=alloc l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 40 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0
[ 73.958429][ T5314] got: u64s 5 type deleted 0:6815744:0 len 0 ver 0
[ 73.958436][ T5314] want: u64s 9 type backpointer 0:6815744:0 len 0 ver 0: bucket=0:26:0 btree=alloc l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing
[ 73.974411][ T5314] missing backpointer for btree=subvolumes l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0
[ 73.974426][ T5314] got: u64s 5 type deleted 0:9175040:0 len 0 ver 0
[ 73.974431][ T5314] want: u64s 9 type backpointer 0:9175040:0 len 0 ver 0: bucket=0:35:0 btree=subvolumes l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing
[ 73.988632][ T5314] missing backpointer for btree=snapshots l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ebb8d5a9e3463bdb written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0
[ 73.988649][ T5314] got: u64s 5 type deleted 0:8388608:0 len 0 ver 0
[ 73.988656][ T5314] want: u64s 9 type backpointer 0:8388608:0 len 0 ver 0: bucket=0:32:0 btree=snapshots l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing
[ 74.209256][ T5314] missing backpointer for btree=snapshots l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ebb8d5a9e3463bdb written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0
[ 74.209283][ T5314] got: u64s 5 type deleted 0:8388608:0 len 0 ver 0
[ 74.209291][ T5314] want: u64s 9 type backpointer 0:8388608:0 len 0 ver 0: bucket=0:32:0 btree=snapshots l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing
executing program
executing program
[ 74.463144][ T5314] missing backpointer for btree=freespace l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq e81e1ed936acf3df written 40 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0
[ 74.463163][ T5314] got: u64s 5 type deleted 0:7602176:0 len 0 ver 0
[ 74.463171][ T5314] want: u64s 9 type backpointer 0:7602176:0 len 0 ver 0: bucket=0:29:0 btree=freespace l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing
[ 74.477548][ T5314] done
executing program
[ 74.487099][ T5314] bcachefs (loop0): check_alloc_to_lru_refs... done
[ 74.492549][ T5314] bcachefs (loop0): bucket_gens_init... done
[ 74.499991][ T5314] bcachefs (loop0): check_snapshot_trees... done
[ 74.502512][ T5314] bcachefs (loop0): check_snapshots...
[ 74.502884][ T5314] snapshot points to missing/incorrect tree:
[ 74.502892][ T5314] u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent 0 children 0 0 subvol 1 tree 0, fixing
[ 74.513486][ T5314] snapshot points to missing/incorrect tree:
[ 74.513500][ T5314] u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent 0 children 0 0 subvol 1 tree 0, fixing
[ 74.524685][ T5314] done
executing program
[ 74.930876][ T5314] bcachefs (loop0): check_subvols... done
[ 74.934643][ T5314] bcachefs (loop0): check_subvol_children... done
[ 74.937560][ T5314] bcachefs (loop0): delete_dead_snapshots... done
[ 74.942085][ T5314] bcachefs (loop0): check_inodes... done
executing program
executing program
executing program
[ 75.337611][ T5314] bcachefs (loop0): check_extents... done
[ 75.345901][ T5314] bcachefs (loop0): check_indirect_extents... done
[ 75.349003][ T5314] bcachefs (loop0): check_dirents... done
[ 75.352571][ T5314] bcachefs (loop0): check_xattrs... done
[ 75.355415][ T5314] bcachefs (loop0): check_root... done
[ 75.358095][ T5314] bcachefs (loop0): check_unreachable_inodes... done
[ 75.365862][ T5314] bcachefs (loop0): check_subvolume_structure... done
[ 75.369004][ T5314] bcachefs (loop0): check_directory_structure... done
[ 75.372795][ T5314] bcachefs (loop0): check_nlinks... done
[ 75.375934][ T5314] bcachefs (loop0): resume_logged_ops... done
[ 75.378310][ T5314] bcachefs (loop0): delete_dead_inodes... done
[ 75.381847][ T5314] bcachefs (loop0): set_fs_needs_rebalance... done
executing program
executing program
executing program
[ 76.415493][ T1303] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.418062][ T1303] ieee802154 phy1 wpan1: encryption failed: -22
executing program
executing program
executing program
executing program
[ 77.072727][ T5314] bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean
[ 77.076184][ T5314] bcachefs (loop0): check_alloc_info... done
[ 77.080869][ T5314] bcachefs (loop0): check_lrus... done
[ 77.083007][ T5314] bcachefs (loop0): check_btree_backpointers... done
[ 77.086077][ T5314] bcachefs (loop0): check_backpointers_to_extents... done
[ 77.089179][ T5314] bcachefs (loop0): check_extents_to_backpointers... done
[ 77.092468][ T5314] bcachefs (loop0): check_alloc_to_lru_refs... done
[ 77.095301][ T5314] bcachefs (loop0): bucket_gens_init... done
[ 77.098712][ T5314] bcachefs (loop0): check_snapshot_trees... done
[ 77.101731][ T5314] bcachefs (loop0): check_snapshots... done
[ 77.104168][ T5314] bcachefs (loop0): check_subvols... done
[ 77.106387][ T5314] bcachefs (loop0): check_subvol_children... done
[ 77.108893][ T5314] bcachefs (loop0): delete_dead_snapshots... done
[ 77.111398][ T5314] bcachefs (loop0): check_inodes... done
[ 77.113799][ T5314] bcachefs (loop0): check_extents... done
[ 77.116227][ T5314] bcachefs (loop0): check_indirect_extents... done
[ 77.118695][ T5314] bcachefs (loop0): check_dirents... done
[ 77.121496][ T5314] bcachefs (loop0): check_xattrs... done
[ 77.123669][ T5314] bcachefs (loop0): check_root... done
[ 77.125778][ T5314] bcachefs (loop0): check_unreachable_inodes... done
[ 77.128451][ T5314] bcachefs (loop0): check_subvolume_structure... done
[ 77.131029][ T5314] bcachefs (loop0): check_directory_structure... done
[ 77.133761][ T5314] bcachefs (loop0): check_nlinks... done
[ 77.136065][ T5314] bcachefs (loop0): resume_logged_ops... done
[ 77.138366][ T5314] bcachefs (loop0): delete_dead_inodes... done
[ 77.140809][ T5314] bcachefs (loop0): set_fs_needs_rebalance... done
[ 77.145884][ T5314] bcachefs (loop0): bch2_copygc_start(): error creating copygc thread EINTR
[ 77.149057][ T5314] bcachefs (loop0): error starting copygc thread
[ 77.151275][ T5314] bcachefs (loop0): bch2_fs_start(): error starting filesystem EINTR
[ 77.154324][ T5314] bcachefs (loop0): shutting down
[ 77.156152][ T5314] bcachefs (loop0): going read-only
[ 77.172951][ T5314] bcachefs (loop0): finished waiting for writes to stop
[ 77.175988][ T5314] bcachefs (loop0): flushing journal and stopping allocators, journal seq 104
executing program
executing program
executing program
[ 77.183416][ T5314] bcachefs (loop0): flushing journal and stopping allocators complete, journal seq 106
[ 77.188223][ T5314] bcachefs (loop0): shutdown complete, journal seq 107
[ 77.191909][ T5314] bcachefs (loop0): marking filesystem clean
[ 77.206105][ T5314] bcachefs (loop0): shutdown complete
[ 77.208943][ T1029] ==================================================================
[ 77.211704][ T1029] BUG: KASAN: slab-use-after-free in percpu_ref_put+0xda/0x250
[ 77.214450][ T1029] Read of size 8 at addr ffff88803f0cc0b0 by task kworker/u4:5/1029
[ 77.217963][ T1029]
[ 77.218845][ T1029] CPU: 0 UID: 0 PID: 1029 Comm: kworker/u4:5 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0
[ 77.222534][ T1029] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 77.226426][ T1029] Workqueue: loop0 loop_rootcg_workfn
[ 77.228493][ T1029] Call Trace:
[ 77.229857][ T1029]
[ 77.230990][ T1029] dump_stack_lvl+0x241/0x360
[ 77.232815][ T1029] ? __pfx_dump_stack_lvl+0x10/0x10
[ 77.234810][ T1029] ? __pfx__printk+0x10/0x10
[ 77.236662][ T1029] ? _printk+0xd5/0x120
[ 77.238230][ T1029] ? __virt_addr_valid+0x183/0x530
[ 77.240248][ T1029] ? __virt_addr_valid+0x183/0x530
[ 77.242259][ T1029] print_report+0x169/0x550
[ 77.244022][ T1029] ? __virt_addr_valid+0x183/0x530
[ 77.246071][ T1029] ? __virt_addr_valid+0x183/0x530
[ 77.248053][ T1029] ? __virt_addr_valid+0x45f/0x530
[ 77.249851][ T1029] ? __phys_addr+0xba/0x170
[ 77.251569][ T1029] ? percpu_ref_put+0xda/0x250
[ 77.253244][ T1029] kasan_report+0x143/0x180
[ 77.254988][ T1029] ? percpu_ref_put+0xda/0x250
[ 77.256834][ T1029] ? percpu_ref_put+0x1f/0x250
[ 77.258565][ T1029] percpu_ref_put+0xda/0x250
[ 77.260236][ T1029] blk_update_request+0x5e5/0x1160
[ 77.262042][ T1029] blk_mq_end_request+0x3e/0x70
[ 77.263765][ T1029] loop_process_work+0x1c10/0x2170
[ 77.265573][ T1029] ? __pfx_loop_process_work+0x10/0x10
[ 77.267384][ T1029] ? register_lock_class+0x102/0x980
[ 77.269367][ T1029] ? __pfx_register_lock_class+0x10/0x10
[ 77.271244][ T1029] ? mark_lock+0x9a/0x360
[ 77.272640][ T1029] ? debug_object_deactivate+0x2d5/0x390
[ 77.274793][ T1029] ? __pfx_lock_acquire+0x10/0x10
[ 77.276719][ T1029] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 77.278967][ T1029] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 77.281316][ T1029] ? process_scheduled_works+0x976/0x1850
[ 77.283285][ T1029] process_scheduled_works+0xa63/0x1850
[ 77.285165][ T1029] ? __pfx_process_scheduled_works+0x10/0x10
[ 77.287328][ T1029] ? assign_work+0x364/0x3d0
[ 77.288894][ T1029] worker_thread+0x870/0xd30
[ 77.290530][ T1029] ? __kthread_parkme+0x169/0x1d0
[ 77.292347][ T1029] ? __pfx_worker_thread+0x10/0x10
[ 77.294151][ T1029] kthread+0x2f0/0x390
[ 77.295640][ T1029] ? __pfx_worker_thread+0x10/0x10
[ 77.297544][ T1029] ? __pfx_kthread+0x10/0x10
[ 77.299228][ T1029] ret_from_fork+0x4b/0x80
[ 77.300826][ T1029] ? __pfx_kthread+0x10/0x10
[ 77.302584][ T1029] ret_from_fork_asm+0x1a/0x30
[ 77.304368][ T1029]
[ 77.305567][ T1029]
[ 77.306475][ T1029] Allocated by task 5314:
[ 77.308110][ T1029] kasan_save_track+0x3f/0x80
[ 77.309886][ T1029] __kasan_kmalloc+0x98/0xb0
[ 77.311550][ T1029] __kmalloc_cache_noprof+0x19c/0x2c0
[ 77.313441][ T1029] __bch2_dev_alloc+0x57/0xa60
[ 77.314862][ T1029] bch2_dev_alloc+0xd4/0x170
[ 77.316543][ T1029] bch2_fs_open+0x2e3f/0x2f80
[ 77.318269][ T1029] bch2_fs_get_tree+0x738/0x1710
[ 77.320050][ T1029] vfs_get_tree+0x90/0x2b0
[ 77.321767][ T1029] do_new_mount+0x2be/0xb40
[ 77.323569][ T1029] __se_sys_mount+0x2d6/0x3c0
[ 77.325400][ T1029] do_syscall_64+0xf3/0x230
[ 77.327153][ T1029] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.329402][ T1029]
[ 77.330296][ T1029] Freed by task 5314:
[ 77.331837][ T1029] kasan_save_track+0x3f/0x80
[ 77.333699][ T1029] kasan_save_free_info+0x40/0x50
[ 77.335580][ T1029] __kasan_slab_free+0x59/0x70
[ 77.337368][ T1029] kfree+0x1a0/0x440
[ 77.338871][ T1029] kobject_put+0x22f/0x480
[ 77.340595][ T1029] bch2_fs_free+0x27b/0x3c0
[ 77.342326][ T1029] bch2_fs_get_tree+0xd9f/0x1710
[ 77.344247][ T1029] vfs_get_tree+0x90/0x2b0
[ 77.346013][ T1029] do_new_mount+0x2be/0xb40
[ 77.347654][ T1029] __se_sys_mount+0x2d6/0x3c0
[ 77.349387][ T1029] do_syscall_64+0xf3/0x230
[ 77.351123][ T1029] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 77.353396][ T1029]
[ 77.354321][ T1029] Last potentially related work creation:
[ 77.356646][ T1029] kasan_save_stack+0x3f/0x60
[ 77.358521][ T1029] __kasan_record_aux_stack+0xac/0xc0
[ 77.360673][ T1029] insert_work+0x3e/0x330
[ 77.362439][ T1029] __queue_work+0xc8b/0xf50
[ 77.364211][ T1029] queue_work_on+0x1c2/0x380
[ 77.366000][ T1029] bch2_dev_do_discards+0x17a/0x1f0
[ 77.367878][ T1029] bch2_do_discards+0x29/0x60
[ 77.369562][ T1029] journal_write_done+0x785/0xea0
[ 77.371505][ T1029] process_scheduled_works+0xa63/0x1850
[ 77.373647][ T1029] worker_thread+0x870/0xd30
[ 77.375373][ T1029] kthread+0x2f0/0x390
[ 77.376939][ T1029] ret_from_fork+0x4b/0x80
[ 77.378634][ T1029] ret_from_fork_asm+0x1a/0x30
[ 77.380535][ T1029]
[ 77.381479][ T1029] Second to last potentially related work creation:
[ 77.383901][ T1029] kasan_save_stack+0x3f/0x60
[ 77.385664][ T1029] __kasan_record_aux_stack+0xac/0xc0
[ 77.387671][ T1029] insert_work+0x3e/0x330
[ 77.389267][ T1029] __queue_work+0xc8b/0xf50
[ 77.390941][ T1029] queue_work_on+0x1c2/0x380
[ 77.392560][ T1029] bch2_dev_do_discards+0x17a/0x1f0
[ 77.394327][ T1029] bch2_do_discards+0x29/0x60
[ 77.395970][ T1029] journal_write_done+0x785/0xea0
[ 77.397785][ T1029] process_scheduled_works+0xa63/0x1850
[ 77.399904][ T1029] worker_thread+0x870/0xd30
[ 77.401693][ T1029] kthread+0x2f0/0x390
[ 77.403219][ T1029] ret_from_fork+0x4b/0x80
[ 77.404978][ T1029] ret_from_fork_asm+0x1a/0x30
[ 77.406694][ T1029]
[ 77.407541][ T1029] The buggy address belongs to the object at ffff88803f0cc000
[ 77.407541][ T1029] which belongs to the cache kmalloc-4k of size 4096
[ 77.412730][ T1029] The buggy address is located 176 bytes inside of
[ 77.412730][ T1029] freed 4096-byte region [ffff88803f0cc000, ffff88803f0cd000)
[ 77.417777][ T1029]
[ 77.418720][ T1029] The buggy address belongs to the physical page:
[ 77.421303][ T1029] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f0c8
[ 77.424749][ T1029] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.427954][ T1029] anon flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 77.430864][ T1029] page_type: f5(slab)
[ 77.432379][ T1029] raw: 04fff00000000040 ffff88801ac42140 0000000000000000 dead000000000001
[ 77.435641][ T1029] raw: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000
[ 77.438916][ T1029] head: 04fff00000000040 ffff88801ac42140 0000000000000000 dead000000000001
[ 77.442255][ T1029] head: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000
[ 77.445563][ T1029] head: 04fff00000000003 ffffea0000fc3201 ffffffffffffffff 0000000000000000
[ 77.448824][ T1029] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
[ 77.451930][ T1029] page dumped because: kasan: bad access detected
[ 77.454332][ T1029] page_owner tracks the page as allocated
[ 77.456412][ T1029] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 20852792118, free_ts 0
[ 77.463256][ T1029] post_alloc_hook+0x1f3/0x230
[ 77.465125][ T1029] get_page_from_freelist+0x3045/0x3190
[ 77.467033][ T1029] __alloc_pages_noprof+0x292/0x710
[ 77.469058][ T1029] alloc_pages_mpol_noprof+0x3e8/0x680
[ 77.471063][ T1029] alloc_slab_page+0x6a/0x120
[ 77.472787][ T1029] allocate_slab+0x5a/0x2f0
[ 77.474498][ T1029] ___slab_alloc+0xcd1/0x14b0
[ 77.476217][ T1029] __slab_alloc+0x58/0xa0
[ 77.477752][ T1029] __kmalloc_noprof+0x25a/0x400
[ 77.479512][ T1029] ops_init+0x75/0x590
[ 77.481024][ T1029] register_pernet_operations+0x30d/0x630
[ 77.483026][ T1029] register_pernet_subsys+0x28/0x40
[ 77.485005][ T1029] ip_vs_init+0x43/0x110
[ 77.486519][ T1029] do_one_initcall+0x248/0x880
[ 77.488251][ T1029] do_initcall_level+0x157/0x210
[ 77.490171][ T1029] do_initcalls+0x3f/0x80
[ 77.491877][ T1029] page_owner free stack trace missing
[ 77.493859][ T1029]
[ 77.494803][ T1029] Memory state around the buggy address:
[ 77.497005][ T1029] ffff88803f0cbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.500082][ T1029] ffff88803f0cc000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.502891][ T1029] >ffff88803f0cc080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.505797][ T1029] ^
[ 77.507678][ T1029] ffff88803f0cc100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.510487][ T1029] ffff88803f0cc180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.513611][ T1029] ==================================================================
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
[ 83.194817][ T1029] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 83.197623][ T1029] CPU: 0 UID: 0 PID: 1029 Comm: kworker/u4:5 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0
[ 83.201958][ T1029] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 83.206257][ T1029] Workqueue: loop0 loop_rootcg_workfn
[ 83.208356][ T1029] Call Trace:
[ 83.209647][ T1029]
[ 83.210805][ T1029] dump_stack_lvl+0x241/0x360
[ 83.212658][ T1029] ? __pfx_dump_stack_lvl+0x10/0x10
[ 83.214712][ T1029] ? __pfx__printk+0x10/0x10
[ 83.216827][ T1029] ? preempt_schedule+0xe1/0xf0
[ 83.218775][ T1029] ? vscnprintf+0x5d/0x90
[ 83.220451][ T1029] panic+0x349/0x880
[ 83.221989][ T1029] ? check_panic_on_warn+0x21/0xb0
[ 83.224058][ T1029] ? __pfx_panic+0x10/0x10
[ 83.225750][ T1029] ? _raw_spin_unlock_irqrestore+0x130/0x140
[ 83.227911][ T1029] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 83.230189][ T1029] ? print_report+0x502/0x550
[ 83.231970][ T1029] check_panic_on_warn+0x86/0xb0
[ 83.233841][ T1029] ? percpu_ref_put+0xda/0x250
[ 83.235660][ T1029] end_report+0x77/0x160
[ 83.237327][ T1029] kasan_report+0x154/0x180
[ 83.239097][ T1029] ? percpu_ref_put+0xda/0x250
[ 83.240965][ T1029] ? percpu_ref_put+0x1f/0x250
[ 83.242740][ T1029] percpu_ref_put+0xda/0x250
[ 83.244500][ T1029] blk_update_request+0x5e5/0x1160
[ 83.246422][ T1029] blk_mq_end_request+0x3e/0x70
[ 83.248265][ T1029] loop_process_work+0x1c10/0x2170
[ 83.250152][ T1029] ? __pfx_loop_process_work+0x10/0x10
[ 83.252215][ T1029] ? register_lock_class+0x102/0x980
[ 83.254182][ T1029] ? __pfx_register_lock_class+0x10/0x10
[ 83.256281][ T1029] ? mark_lock+0x9a/0x360
[ 83.257792][ T1029] ? debug_object_deactivate+0x2d5/0x390
[ 83.259883][ T1029] ? __pfx_lock_acquire+0x10/0x10
[ 83.261853][ T1029] ? lockdep_hardirqs_on_prepare+0x43d/0x780
[ 83.263939][ T1029] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[ 83.266376][ T1029] ? process_scheduled_works+0x976/0x1850
[ 83.268534][ T1029] process_scheduled_works+0xa63/0x1850
[ 83.270544][ T1029] ? __pfx_process_scheduled_works+0x10/0x10
[ 83.272747][ T1029] ? assign_work+0x364/0x3d0
[ 83.274473][ T1029] worker_thread+0x870/0xd30
[ 83.276271][ T1029] ? __kthread_parkme+0x169/0x1d0
[ 83.278001][ T1029] ? __pfx_worker_thread+0x10/0x10
[ 83.279785][ T1029] kthread+0x2f0/0x390
[ 83.281384][ T1029] ? __pfx_worker_thread+0x10/0x10
[ 83.283250][ T1029] ? __pfx_kthread+0x10/0x10
[ 83.285048][ T1029] ret_from_fork+0x4b/0x80
[ 83.286633][ T1029] ? __pfx_kthread+0x10/0x10
[ 83.288375][ T1029] ret_from_fork_asm+0x1a/0x30
[ 83.290141][ T1029]
[ 83.291627][ T1029] Kernel Offset: disabled
[ 83.293289][ T1029] Rebooting in 86400 seconds..
VM DIAGNOSIS:
18:08:58 Registers:
info registers vcpu 0
CPU#0
RAX=0000000000000074 RBX=ffffffff9a718e80 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=0000000000000000 RSP=ffffc9000238edf0
R8 =ffffffff854abd6b R9 =1ffff11003d75046 R10=dffffc0000000000 R11=ffffffff854abd20
R12=dffffc0000000000 R13=ffffffff9a413f08 R14=0000000000000074 R15=00000000000003f8
RIP=ffffffff854abd9e RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88801fc00000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=0000558d5734aea0 CR3=0000000043aec000 CR4=00352ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000fffe0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
Opmask00=0000000000040401 Opmask01=0000000000000001 Opmask02=00000000fff7ffff Opmask03=0000000000000000
Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000
ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffd716ce9e0 0000003000000018
ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 2525252525252525 2525252525252525 2525252525252525 2525252525252525
ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6e756f6d65723d73 726f727265003036 36396f7369007265 6c6c616b7a797300
ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 4b504a4840571856 574a575740001513 131c4a564c005740 4949444e5f5c5600
ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000
ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000