------------[ cut here ]------------ UBSAN: shift-out-of-bounds in fs/bcachefs/alloc_background.h:165:13 shift exponent 60 is too large for 32-bit type 'unsigned int' CPU: 1 UID: 0 PID: 8265 Comm: syz.0.173 Not tainted 6.12.0-rc5-syzkaller-g5283dc78f4da #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:484 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x2f4/0x36c lib/ubsan.c:468 data_type_movable fs/bcachefs/alloc_background.h:165 [inline] alloc_lru_idx_fragmentation fs/bcachefs/alloc_background.h:171 [inline] bch2_alloc_to_text+0x848/0x84c fs/bcachefs/alloc_background.c:369 bch2_val_to_text fs/bcachefs/bkey_methods.c:304 [inline] bch2_bkey_val_to_text+0xfc/0x140 fs/bcachefs/bkey_methods.c:314 __bch2_bkey_fsck_err+0x3d4/0xf18 fs/bcachefs/error.c:457 bch2_alloc_v4_validate+0x700/0xc54 fs/bcachefs/alloc_background.c:249 bch2_bkey_val_validate+0x114/0x1c0 fs/bcachefs/bkey_methods.c:143 bch2_btree_node_read_done+0x2f90/0x4b78 fs/bcachefs/btree_io.c:1223 btree_node_read_work+0x50c/0xe04 fs/bcachefs/btree_io.c:1327 bch2_btree_node_read+0x1f3c/0x27f8 fs/bcachefs/btree_io.c:1712 __bch2_btree_root_read fs/bcachefs/btree_io.c:1753 [inline] bch2_btree_root_read+0x2b0/0x40c fs/bcachefs/btree_io.c:1775 read_btree_roots+0x24c/0x794 fs/bcachefs/recovery.c:524 bch2_fs_recovery+0x328c/0x55a0 fs/bcachefs/recovery.c:854 bch2_fs_start+0x30c/0x53c fs/bcachefs/super.c:1036 bch2_fs_get_tree+0x938/0x1030 fs/bcachefs/fs.c:2170 vfs_get_tree+0x90/0x28c fs/super.c:1800 do_new_mount+0x278/0x900 fs/namespace.c:3507 path_mount+0x590/0xe04 fs/namespace.c:3834 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount fs/namespace.c:4034 [inline] __arm64_sys_mount+0x45c/0x5a8 fs/namespace.c:4034 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 ---[ end trace ]--- invalid bkey u64s 11 type alloc_v4 0:4:0 len 0 ver 0: gen 212 oldest_gen 54 data_type (unknown data_type 60) journal_seq 1 need_discard 1 need_inc_gen 0 dirty_sectors 256 stripe_sectors 5 cached_sectors 0 stripe 0 stripe_redundancy 1 io_time[READ] 1 io_time[WRITE] 1 fragmentation 0 bp_start 8 bad val size (246 > 6): delete?, fixing bcachefs (loop0): accounting_read... done bcachefs (loop0): alloc_read... done bcachefs (loop0): stripes_read... done bcachefs (loop0): snapshots_read... done bcachefs (loop0): check_allocations... bucket 0:4 gen 0 has wrong data_type: got free, should be sb, fixing bucket 0:4 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing bucket 0:120 gen 0 data type sb has wrong dirty_sectors: got 514006, should be 256, fixing done bcachefs (loop0): going read-write bcachefs (loop0): journal_replay... done bcachefs (loop0): check_alloc_info... done bcachefs (loop0): check_lrus... done bcachefs (loop0): check_btree_backpointers... done bcachefs (loop0): check_backpointers_to_extents... done bcachefs (loop0): check_extents_to_backpointers... missing backpointer for btree=inodes l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2a20405ac3f40602 written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 got: u64s 5 type deleted 0:9961472:0 len 0 ver 0 want: u64s 9 type backpointer 0:9961472:0 len 0 ver 0: bucket=0:38:0 btree=inodes l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing missing backpointer for btree=dirents l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 267fcf747c875937 written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0 got: u64s 5 type deleted 0:10747904:0 len 0 ver 0 want: u64s 9 type backpointer 0:10747904:0 len 0 ver 0: bucket=0:41:0 btree=dirents l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing missing backpointer for btree=alloc l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1818ce08861e3527 written 56 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 got: u64s 5 type deleted 0:6815744:0 len 0 ver 0 want: u64s 9 type backpointer 0:6815744:0 len 0 ver 0: bucket=0:26:0 btree=alloc l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing missing backpointer for btree=subvolumes l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq d682cebdf2a7eb26 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0 got: u64s 5 type deleted 0:9175040:0 len 0 ver 0 want: u64s 9 type backpointer 0:9175040:0 len 0 ver 0: bucket=0:35:0 btree=subvolumes l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing missing backpointer for btree=snapshots l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq d771a06d670df06c written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0 got: u64s 5 type deleted 0:8388608:0 len 0 ver 0 want: u64s 9 type backpointer 0:8388608:0 len 0 ver 0: bucket=0:32:0 btree=snapshots l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing missing backpointer for btree=freespace l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq b6c44d07df4e9bb7 written 56 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0 got: u64s 5 type deleted 0:7602176:0 len 0 ver 0 want: u64s 9 type backpointer 0:7602176:0 len 0 ver 0: bucket=0:29:0 btree=freespace l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing done bcachefs (loop0): check_alloc_to_lru_refs... done bcachefs (loop0): bucket_gens_init... done bcachefs (loop0): check_snapshot_trees... done bcachefs (loop0): check_snapshots... snapshot points to missing/incorrect tree: u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent 0 children 0 0 subvol 1 tree 0, fixing snapshot points to missing/incorrect tree: u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent 0 children 0 0 subvol 1 tree 0, fixing done bcachefs (loop0): check_subvols... done bcachefs (loop0): check_subvol_children... done bcachefs (loop0): delete_dead_snapshots... done bcachefs (loop0): check_inodes... done bcachefs (loop0): check_extents... done bcachefs (loop0): check_indirect_extents... done bcachefs (loop0): check_dirents... done bcachefs (loop0): check_xattrs... done bcachefs (loop0): check_root... done bcachefs (loop0): check_unreachable_inodes... done bcachefs (loop0): check_subvolume_structure... done bcachefs (loop0): check_directory_structure... done bcachefs (loop0): check_nlinks... done bcachefs (loop0): resume_logged_ops... done bcachefs (loop0): delete_dead_inodes... done bcachefs (loop0): set_fs_needs_rebalance... done bcachefs (loop0): Fixed errors, running fsck a second time to verify fs is clean bcachefs (loop0): check_alloc_info... done bcachefs (loop0): check_lrus... done bcachefs (loop0): check_btree_backpointers... done bcachefs (loop0): check_backpointers_to_extents... done bcachefs (loop0): check_extents_to_backpointers... done bcachefs (loop0): check_alloc_to_lru_refs... done bcachefs (loop0): bucket_gens_init... done bcachefs (loop0): check_snapshot_trees... done bcachefs (loop0): check_snapshots... done bcachefs (loop0): check_subvols... done bcachefs (loop0): check_subvol_children... done bcachefs (loop0): delete_dead_snapshots... done bcachefs (loop0): check_inodes... done bcachefs (loop0): check_extents... done bcachefs (loop0): check_indirect_extents... done bcachefs (loop0): check_dirents... done bcachefs (loop0): check_xattrs... done bcachefs (loop0): check_root... done bcachefs (loop0): check_unreachable_inodes... done bcachefs (loop0): check_subvolume_structure... done bcachefs (loop0): check_directory_structure... done bcachefs (loop0): check_nlinks... done bcachefs (loop0): resume_logged_ops... done bcachefs (loop0): delete_dead_inodes... done bcachefs (loop0): set_fs_needs_rebalance... done bcachefs (loop0): done starting filesystem