./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor657957280 <...> Warning: Permanently added '10.128.0.106' (ED25519) to the list of known hosts. execve("./syz-executor657957280", ["./syz-executor657957280"], 0x7ffe563d7a00 /* 10 vars */) = 0 brk(NULL) = 0x55555b041000 brk(0x55555b041d00) = 0x55555b041d00 arch_prctl(ARCH_SET_FS, 0x55555b041380) = 0 set_tid_address(0x55555b041650) = 5832 set_robust_list(0x55555b041660, 24) = 0 rseq(0x55555b041ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor657957280", 4096) = 27 getrandom("\x79\x14\xaf\xb9\x3c\x69\x6b\xc4", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55555b041d00 brk(0x55555b062d00) = 0x55555b062d00 brk(0x55555b063000) = 0x55555b063000 mprotect(0x7eff198f1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 executing program write(1, "executing program\n", 18) = 18 memfd_create("syzkaller", 0) = 3 mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7eff11400000 write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216 munmap(0x7eff11400000, 138412032) = 0 openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 ioctl(4, LOOP_SET_FD, 3) = 0 close(3) = 0 close(4) = 0 mkdir("./file0", 0777) = 0 [ 70.759412][ T5832] loop0: detected capacity change from 0 to 32768 [ 70.802340][ T5832] ======================================================= [ 70.802340][ T5832] WARNING: The mand mount option has been deprecated and [ 70.802340][ T5832] and is ignored by this kernel. Remove the mand [ 70.802340][ T5832] option from the mount to silence this warning. [ 70.802340][ T5832] ======================================================= [ 70.868447][ T5832] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 70.884066][ T5832] bcachefs (loop0): recovering from clean shutdown, journal seq 10 [ 70.892434][ T5832] bcachefs (loop0): Version upgrade required: [ 70.892434][ T5832] Version upgrade from 0.9: (unknown version) to 1.7: mi_btree_bitmap incomplete [ 70.892434][ T5832] Doing incompatible version upgrade from 0.9: (unknown version) to 1.13: inode_has_child_snapshots [ 70.892434][ T5832] running recovery passes: check_allocations,check_alloc_info,check_lrus,check_btree_backpointers,check_backpointers_to_extents,check_extents_to_backpointers,check_alloc_to_lru_refs,bucket_gens_init,check_snapshot_trees,check_snapshots,check_subvols,check_subvol_children,delete_dead_snapshots,check_inodes,check_extents,check_indirect_extents,check_dirents,check_xattrs,check_root,check_unreachable_inodes,check_subvolume_structure,check_directory_structure,check_nlinks,set_fs_needs_rebalance [ 70.972943][ T5832] invalid bkey u64s 7 type subvolume 196608:1:0 len 0 ver 0: root 4096 snapshot id 4294967295 [ 70.972963][ T5832] invalid pos: delete?, fixing [ 70.991450][ T5832] invalid bkey u64s 9 type backpointer 0:7077888:0 len 0 ver 0: bucket=0:27:0 btree=extents l=1 offset=512:0 len=256 pos=SPOS_MAX [ 70.991464][ T5832] backpointer bucket_offset wrong: delete?, fixing [ 71.013276][ T5832] bcachefs (loop0): accounting_read... done [ 71.020351][ T5832] bcachefs (loop0): alloc_read... done [ 71.026157][ T5832] bcachefs (loop0): stripes_read... done [ 71.031827][ T5832] bcachefs (loop0): snapshots_read... done [ 71.037924][ T5832] bcachefs (loop0): check_allocations... [ 71.041248][ T5832] bucket 0:26 data type btree ptr gen 0 missing in alloc btree [ 71.041267][ T5832] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0, fixing [ 71.072633][ T5832] bucket 0:38 data type btree ptr gen 0 missing in alloc btree [ 71.072647][ T5832] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0, fixing [ 71.097099][ T5832] bucket 0:41 data type btree ptr gen 0 missing in alloc btree [ 71.097113][ T5832] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0, fixing [ 71.123898][ T5832] bucket 0:35 data type btree ptr gen 0 missing in alloc btree [ 71.123914][ T5832] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0, fixing [ 71.149419][ T5832] bucket 0:29 data type btree ptr gen 0 missing in alloc btree [ 71.149433][ T5832] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq e81e1ed936acf3df written 32 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0, fixing [ 71.173059][ T5832] ------------[ cut here ]------------ [ 71.178697][ T5832] kernel BUG at fs/bcachefs/btree_iter.c:631! [ 71.184839][ T5832] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 71.191781][ T5832] CPU: 1 UID: 0 PID: 5832 Comm: syz-executor657 Not tainted 6.12.0-rc5-syzkaller-00308-g3e5e6c9900c3 #0 [ 71.203316][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 71.213372][ T5832] RIP: 0010:bch2_btree_path_level_init+0x9ca/0x9f0 [ 71.219874][ T5832] Code: f5 fa ff ff e8 67 62 7f fd 90 0f 0b e8 5f 62 7f fd 90 0f 0b e8 57 62 7f fd 90 0f 0b e8 4f 62 7f fd 90 0f 0b e8 47 62 7f fd 90 <0f> 0b e8 3f 62 7f fd 90 0f 0b e8 37 62 7f fd 90 0f 0b e8 2f 62 7f [ 71.239485][ T5832] RSP: 0018:ffffc90003f96200 EFLAGS: 00010293 [ 71.245546][ T5832] RAX: ffffffff84157779 RBX: 0000000000000000 RCX: ffff8880345c0000 [ 71.253511][ T5832] RDX: 0000000000000000 RSI: 0000000001000000 RDI: 0000000000000000 [ 71.261478][ T5832] RBP: dffffc0000000000 R08: ffffffff84156fcc R09: 0000000000000000 [ 71.269440][ T5832] R10: dffffc0000000000 R11: fffffbfff2037ba6 R12: ffff8880272f7800 [ 71.277409][ T5832] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888074100033 [ 71.285368][ T5832] FS: 000055555b041380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 [ 71.294287][ T5832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.300863][ T5832] CR2: 0000556638bf8fb0 CR3: 000000003127c000 CR4: 00000000003526f0 [ 71.308828][ T5832] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 71.316788][ T5832] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 71.324774][ T5832] Call Trace: [ 71.328045][ T5832] [ 71.330969][ T5832] ? __die_body+0x5f/0xb0 [ 71.335303][ T5832] ? die+0x9e/0xc0 [ 71.339010][ T5832] ? do_trap+0x15a/0x3a0 [ 71.343246][ T5832] ? bch2_btree_path_level_init+0x9ca/0x9f0 [ 71.349304][ T5832] ? do_error_trap+0x1dc/0x2c0 [ 71.354057][ T5832] ? bch2_btree_path_level_init+0x9ca/0x9f0 [ 71.359941][ T5832] ? __pfx_do_error_trap+0x10/0x10 [ 71.365046][ T5832] ? report_bug+0x3e8/0x500 [ 71.369553][ T5832] ? handle_invalid_op+0x34/0x40 [ 71.374500][ T5832] ? bch2_btree_path_level_init+0x9ca/0x9f0 [ 71.380385][ T5832] ? exc_invalid_op+0x38/0x50 [ 71.385054][ T5832] ? asm_exc_invalid_op+0x1a/0x20 [ 71.390084][ T5832] ? bch2_btree_path_level_init+0x21c/0x9f0 [ 71.395967][ T5832] ? bch2_btree_path_level_init+0x9c9/0x9f0 [ 71.401849][ T5832] ? bch2_btree_path_level_init+0x9ca/0x9f0 [ 71.407739][ T5832] bch2_btree_path_traverse_one+0x10de/0x2940 [ 71.413799][ T5832] ? __pfx_validate_chain+0x10/0x10 [ 71.418994][ T5832] ? bch2_check_allocations+0x1abe/0x7070 [ 71.424715][ T5832] ? __pfx_bch2_btree_path_traverse_one+0x10/0x10 [ 71.431124][ T5832] ? __pfx_bch2_btree_path_verify_level+0x10/0x10 [ 71.437533][ T5832] ? mark_lock+0x9a/0x360 [ 71.441889][ T5832] ? __lock_acquire+0x1384/0x2050 [ 71.446910][ T5832] ? bch2_btree_path_verify+0x1fd/0x300 [ 71.452448][ T5832] bch2_btree_iter_peek_upto+0xb58/0x70e0 [ 71.458184][ T5832] ? __pfx_lock_acquire+0x10/0x10 [ 71.463217][ T5832] ? __pfx___might_resched+0x10/0x10 [ 71.468522][ T5832] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 71.474423][ T5832] ? __pfx_bch2_btree_iter_peek_upto+0x10/0x10 [ 71.480579][ T5832] ? bch2_trans_begin+0x9c5/0x1c00 [ 71.485684][ T5832] ? bch2_trans_begin+0x16c1/0x1c00 [ 71.490881][ T5832] ? bch2_check_allocations+0x1a53/0x7070 [ 71.496596][ T5832] ? __pfx___might_resched+0x10/0x10 [ 71.501870][ T5832] ? __bch2_path_free+0x6ef/0x820 [ 71.506885][ T5832] ? __asan_memset+0x23/0x50 [ 71.511470][ T5832] bch2_check_allocations+0x1abe/0x7070 [ 71.517022][ T5832] ? prb_first_seq+0x131/0x210 [ 71.521781][ T5832] ? __pfx_prb_first_seq+0x10/0x10 [ 71.526882][ T5832] ? this_cpu_in_panic+0x4f/0x80 [ 71.531809][ T5832] ? bch2_check_allocations+0x798/0x7070 [ 71.537436][ T5832] ? __pfx_validate_chain+0x10/0x10 [ 71.542628][ T5832] ? __pfx_validate_chain+0x10/0x10 [ 71.547844][ T5832] ? do_raw_spin_lock+0x14f/0x370 [ 71.552862][ T5832] ? __pfx_bch2_check_allocations+0x10/0x10 [ 71.558749][ T5832] ? prb_read_valid+0xa9/0xf0 [ 71.563414][ T5832] ? __pfx_prb_read_valid+0x10/0x10 [ 71.568601][ T5832] ? desc_read+0x200/0x3f0 [ 71.573006][ T5832] ? desc_read+0x1a2/0x3f0 [ 71.577457][ T5832] ? prb_first_seq+0x131/0x210 [ 71.582217][ T5832] ? __pfx_prb_first_seq+0x10/0x10 [ 71.587327][ T5832] ? this_cpu_in_panic+0x4f/0x80 [ 71.592254][ T5832] ? _prb_read_valid+0xa39/0xac0 [ 71.597185][ T5832] ? bch2_check_allocations+0x1a47/0x7070 [ 71.602896][ T5832] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 71.608869][ T5832] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 71.615193][ T5832] ? __console_unlock+0x12d/0x1f0 [ 71.620212][ T5832] ? bch2_check_allocations+0x2119/0x7070 [ 71.625926][ T5832] ? this_cpu_in_panic+0x4f/0x80 [ 71.630863][ T5832] ? __wake_up_klogd+0xd5/0x110 [ 71.635710][ T5832] ? __pfx_lock_release+0x10/0x10 [ 71.640728][ T5832] ? rcu_is_watching+0x15/0xb0 [ 71.645482][ T5832] ? bch2_check_allocations+0x798/0x7070 [ 71.651298][ T5832] ? __bch2_print+0x17a/0x220 [ 71.656096][ T5832] ? local_clock+0x10/0x30 [ 71.660512][ T5832] ? __pfx___bch2_print+0x10/0x10 [ 71.665534][ T5832] bch2_run_recovery_pass+0xf0/0x1e0 [ 71.670817][ T5832] bch2_run_recovery_passes+0x387/0x870 [ 71.676358][ T5832] bch2_fs_recovery+0x25cc/0x39c0 [ 71.681390][ T5832] ? __pfx_bch2_fs_recovery+0x10/0x10 [ 71.686764][ T5832] ? __pfx_lock_release+0x10/0x10 [ 71.691784][ T5832] ? bch2_get_next_online_dev+0x2b/0x4f0 [ 71.697407][ T5832] ? __pfx_lock_release+0x10/0x10 [ 71.702429][ T5832] ? bch2_get_next_online_dev+0x2b/0x4f0 [ 71.708056][ T5832] ? bch2_get_next_online_dev+0x4b9/0x4f0 [ 71.713768][ T5832] ? bch2_get_next_online_dev+0x2b/0x4f0 [ 71.719395][ T5832] ? llist_reverse_order+0x72/0x90 [ 71.724502][ T5832] bch2_fs_start+0x356/0x5b0 [ 71.729093][ T5832] bch2_fs_get_tree+0xd68/0x1710 [ 71.734036][ T5832] ? __pfx_bch2_fs_get_tree+0x10/0x10 [ 71.739428][ T5832] ? smack_fs_context_parse_param+0xff/0x170 [ 71.745414][ T5832] ? generic_parse_monolithic+0x387/0x400 [ 71.751133][ T5832] ? cap_capable+0x1b4/0x250 [ 71.755715][ T5832] ? safesetid_security_capable+0xb2/0x1d0 [ 71.761514][ T5832] vfs_get_tree+0x90/0x2b0 [ 71.765929][ T5832] do_new_mount+0x2be/0xb40 [ 71.770433][ T5832] ? __pfx_do_new_mount+0x10/0x10 [ 71.775457][ T5832] __se_sys_mount+0x2d6/0x3c0 [ 71.780128][ T5832] ? __pfx___se_sys_mount+0x10/0x10 [ 71.785318][ T5832] ? do_syscall_64+0x100/0x230 [ 71.790077][ T5832] ? __x64_sys_mount+0x20/0xc0 [ 71.794850][ T5832] do_syscall_64+0xf3/0x230 [ 71.799350][ T5832] ? clear_bhb_loop+0x35/0x90 [ 71.804019][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.809938][ T5832] RIP: 0033:0x7eff1987993a [ 71.814358][ T5832] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 71.833956][ T5832] RSP: 002b:00007ffdcc4011b8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5 [ 71.842363][ T5832] RAX: ffffffffffffffda RBX: 00007ffdcc4011d0 RCX: 00007eff1987993a [ 71.850326][ T5832] RDX: 0000000020000080 RSI: 0000000020000000 RDI: 00007ffdcc4011d0 [ 71.858293][ T5832] RBP: 0000000000000004 R08: 00007ffdcc401210 R09: 0027e461d5230a6f [ 71.866256][ T5832] R10: 0000000000000844 R11: 0000000000000282 R12: 0000000000000844 [ 71.874216][ T5832] R13: 00007ffdcc401210 R14: 0000000000000003 R15: 0000000001000000 [ 71.882200][ T5832] [ 71.885253][ T5832] Modules linked in: [ 71.889297][ T5832] ---[ end trace 0000000000000000 ]--- [ 71.897278][ T5832] RIP: 0010:bch2_btree_path_level_init+0x9ca/0x9f0 [ 71.903795][ T5832] Code: f5 fa ff ff e8 67 62 7f fd 90 0f 0b e8 5f 62 7f fd 90 0f 0b e8 57 62 7f fd 90 0f 0b e8 4f 62 7f fd 90 0f 0b e8 47 62 7f fd 90 <0f> 0b e8 3f 62 7f fd 90 0f 0b e8 37 62 7f fd 90 0f 0b e8 2f 62 7f [ 71.923496][ T5832] RSP: 0018:ffffc90003f96200 EFLAGS: 00010293 [ 71.929657][ T5832] RAX: ffffffff84157779 RBX: 0000000000000000 RCX: ffff8880345c0000 [ 71.937681][ T5832] RDX: 0000000000000000 RSI: 0000000001000000 RDI: 0000000000000000 [ 71.946129][ T5832] RBP: dffffc0000000000 R08: ffffffff84156fcc R09: 0000000000000000 [ 71.954105][ T5832] R10: dffffc0000000000 R11: fffffbfff2037ba6 R12: ffff8880272f7800 [ 71.962122][ T5832] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888074100033 [ 71.970135][ T5832] FS: 000055555b041380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 [ 71.979109][ T5832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 71.985696][ T5832] CR2: 00005572bc554058 CR3: 000000003127c000 CR4: 00000000003526f0 [ 71.993779][ T5832] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 72.001819][ T5832] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 72.009820][ T5832] Kernel panic - not syncing: Fatal exception [ 72.016031][ T5832] Kernel Offset: disabled [ 72.020350][ T5832] Rebooting in 86400 seconds..