bcachefs (loop0): Detected missing backpointers in bucket 34, now have 1/128 with missing running recovery pass check_extents_to_backpointers (17), currently at resume_logged_ops (39) ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in bch2_bucket_bitmap_test fs/bcachefs/backpointers.h:194 [inline] BUG: KASAN: slab-use-after-free in bch2_bucket_is_movable fs/bcachefs/movinggc.c:78 [inline] BUG: KASAN: slab-use-after-free in bch2_copygc_get_buckets fs/bcachefs/movinggc.c:157 [inline] BUG: KASAN: slab-use-after-free in bch2_copygc+0xfb1/0x4380 fs/bcachefs/movinggc.c:221 Read of size 8 at addr ffff888043a07600 by task bch-copygc/loop/5361 CPU: 0 UID: 0 PID: 5361 Comm: bch-copygc/loop Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x230 mm/kasan/report.c:480 kasan_report+0x118/0x150 mm/kasan/report.c:593 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] bch2_bucket_bitmap_test fs/bcachefs/backpointers.h:194 [inline] bch2_bucket_is_movable fs/bcachefs/movinggc.c:78 [inline] bch2_copygc_get_buckets fs/bcachefs/movinggc.c:157 [inline] bch2_copygc+0xfb1/0x4380 fs/bcachefs/movinggc.c:221 bch2_copygc_thread+0x97a/0xe00 fs/bcachefs/movinggc.c:409 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 5361: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4328 [inline] __kvmalloc_node_noprof+0x30d/0x5f0 mm/slub.c:5015 kvmalloc_array_node_noprof include/linux/slab.h:1065 [inline] bch2_bucket_bitmap_set+0x9a/0x1a0 fs/bcachefs/backpointers.c:1351 check_bucket_backpointer_mismatch+0x1bdf/0x23a0 fs/bcachefs/backpointers.c:964 check_bucket_backpointer_pos_mismatch fs/bcachefs/backpointers.c:1193 [inline] bch2_check_bucket_backpointer_mismatch+0x36c/0x690 fs/bcachefs/backpointers.c:1205 __bch2_move_data_phys+0x17a7/0x1c50 fs/bcachefs/move.c:922 bch2_evacuate_bucket+0x228/0x3a0 fs/bcachefs/move.c:1082 bch2_copygc+0x3a89/0x4380 fs/bcachefs/movinggc.c:234 bch2_copygc_thread+0x97a/0xe00 fs/bcachefs/movinggc.c:409 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888043a07600 which belongs to the cache kmalloc-16 of size 16 The buggy address is located 0 bytes inside of freed 16-byte region [ffff888043a07600, ffff888043a07610) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43a07 anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88801a441640 0000000000000000 0000000000000001 raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5323, tgid 5323 (syz-executor), ts 82252312484, free_ts 82242882103 create_dummy_stack mm/page_owner.c:94 [inline] register_dummy_stack+0x89/0xe0 mm/page_owner.c:100 init_page_owner+0x29/0x7d0 mm/page_owner.c:118 invoke_init_callbacks mm/page_ext.c:148 [inline] page_ext_init+0x7ec/0x850 mm/page_ext.c:497 mm_core_init+0x5b/0x70 mm/mm_init.c:2783 page last free pid 5318 tgid 5318 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1248 [inline] __free_frozen_pages+0xc71/0xe70 mm/page_alloc.c:2706 __slab_free+0x326/0x400 mm/slub.c:4554 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4148 [inline] slab_alloc_node mm/slub.c:4197 [inline] kmem_cache_alloc_noprof+0x1c1/0x3c0 mm/slub.c:4204 getname_flags+0xb8/0x540 fs/namei.c:146 getname include/linux/fs.h:2907 [inline] do_sys_openat2+0xbc/0x1c0 fs/open.c:1431 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888043a07500: 00 00 fc fc 00 00 fc fc fa fb fc fc 00 00 fc fc ffff888043a07580: fa fb fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc >ffff888043a07600: fb fb fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc ^ ffff888043a07680: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc ffff888043a07700: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc ==================================================================