bcachefs (loop0): running recovery pass scan_for_btree_nodes (1), currently at check_topology (2) - rewinding bcachefs (loop0): bch2_check_root(): error restart_recovery bcachefs (loop0): scan_for_btree_nodes... bcachefs (loop0): btree node scan found 1 nodes after overwrites done bcachefs (loop0): check_topology... bcachefs (loop0): btree root extents unreadable, must recover from scan bcachefs (loop0): bch2_get_scanned_nodes(): recovery btree=extents level=0 POS_MIN - SPOS_MAX bcachefs (loop0): bch2_get_scanned_nodes(): recovering u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c70ab18f40f86f94 written 24 min_key POS_MIN durability: 1 ptr: 0:167:0 gen 0 bcachefs (loop0): empty interior btree node at btree=extents level=1 u64s 5 type btree_ptr SPOS_MAX len 0 ver 0, fixing bcachefs (loop0): bch2_btree_repair_topology_recurse(): error ECHILD bcachefs (loop0): empty btree root extents bcachefs (loop0): btree node with incorrect max_key at: btree=alloc level=1 parent: u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 3a29d24e27fd9a2e written 16 min_key POS_MIN durability: 1 ptr: 0:178:0 gen 0 child: u64s 11 type btree_ptr_v2 0:82:0 len 0 ver 0: seq af8d2de42da20fd1 written 16 min_key POS_MIN durability: 1 ptr: 0:141:0 gen 0, fixing bcachefs (loop0): set_node_max(): u64s 11 type btree_ptr_v2 0:82:0 len 0 ver 0: seq af8d2de42da20fd1 written 16 min_key POS_MIN durability: 1 ptr: 0:141:0 gen 0 -> SPOS_MAX done bcachefs (loop0): accounting_read... done bcachefs (loop0): alloc_read... done bcachefs (loop0): snapshots_read... done bcachefs (loop0): check_allocations... bcachefs (loop0): bucket 0:141 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq af8d2de42da20fd1 written 16 min_key R POS_MIN durability: 1 ptr: 0:141:0 gen 0, fixing bcachefs (loop0): bucket 0:178 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 3a29d24e27fd9a2e written 16 min_key POS_MIN durability: 1 ptr: 0:178:0 gen 0, fixing bcachefs (loop0): bucket 0:143 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 5d378a20ed8f0947 written 16 min_key POS_MIN durability: 1 ptr: 0:143:0 gen 0, fixing bcachefs (loop0): bucket 0:164 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq bd007a8741d8c109 written 16 min_key POS_MIN durability: 1 ptr: 0:164:0 gen 0, fixing bcachefs (loop0): bucket 0:170 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq cbff1a530fbe26e1 written 16 min_key POS_MIN durability: 1 ptr: 0:170:0 gen 0, fixing bcachefs (loop0): bucket 0:158 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 1bbb38bb41ebb0c1 written 16 min_key POS_MIN durability: 1 ptr: 0:158:0 gen 0, fixing bcachefs (loop0): bucket 0:155 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 3196d4ed4f54a98a written 16 min_key POS_MIN durability: 1 ptr: 0:155:0 gen 0, fixing bcachefs (loop0): bucket 0:180 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq cae06db3fbb516d6 written 8 min_key POS_MIN durability: 1 ptr: 0:180:0 gen 0, fixing bcachefs (loop0): bucket 0:139 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 463d0552c48df05f written 16 min_key POS_MIN durability: 1 ptr: 0:139:0 gen 0, fixing bcachefs (loop0): bucket 0:182 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7b096ba3ebf8a2de written 16 min_key POS_MIN durability: 1 ptr: 0:182:0 gen 0, fixing bcachefs (loop0): bucket 0:140 data type btree ptr gen 1 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq d3bff37d43c58aa3 written 16 min_key POS_MIN durability: 1 ptr: 0:140:0 gen 1, fixing Ratelimiting new instances of previous error done bcachefs (loop0): going read-write bcachefs (loop0): journal_replay... ------------[ cut here ]------------ kernel BUG at fs/bcachefs/btree_iter.c:633! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5379 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:bch2_btree_path_level_init+0xa11/0xa20 fs/bcachefs/btree_iter.c:633 Code: fd 90 0f 0b e8 d0 b2 97 fd 90 0f 0b e8 c8 b2 97 fd 90 0f 0b e8 c0 b2 97 fd 90 0f 0b e8 b8 b2 97 fd 90 0f 0b e8 b0 b2 97 fd 90 <0f> 0b 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 RSP: 0018:ffffc9000d506320 EFLAGS: 00010246 RAX: ffffffff84280b10 RBX: ffff888055180608 RCX: 0000000000100000 RDX: ffffc9000ee1a000 RSI: 00000000000fffff RDI: 0000000000100000 RBP: ffff888051f369a7 R08: 0000000000000052 R09: 1ffff1100a3e6d16 R10: dffffc0000000000 R11: ffffed100a3e6d17 R12: 0000000000000091 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888051f36800 FS: 00007f33f2aca6c0(0000) GS:ffff88808d20d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff14ab5e000 CR3: 0000000042f8a000 CR4: 0000000000352ef0 Call Trace: btree_path_down fs/bcachefs/btree_iter.c:994 [inline] bch2_btree_path_traverse_one+0x1367/0x21d0 fs/bcachefs/btree_iter.c:1202 bch2_btree_path_traverse fs/bcachefs/btree_iter.h:250 [inline] bch2_btree_iter_peek_slot+0x760/0x2290 fs/bcachefs/btree_iter.c:2828 btree_key_cache_fill+0x1cb/0x3010 fs/bcachefs/btree_key_cache.c:333 bch2_btree_path_traverse_cached+0xc5d/0x10d0 fs/bcachefs/btree_key_cache.c:399 bch2_btree_path_traverse_one+0x372/0x21d0 fs/bcachefs/btree_iter.c:1179 bch2_btree_path_traverse_all fs/bcachefs/btree_iter.c:1047 [inline] bch2_trans_begin+0x1379/0x2310 fs/bcachefs/btree_iter.c:3406 bch2_journal_replay+0x170f/0x2630 fs/bcachefs/recovery.c:407 bch2_run_recovery_pass fs/bcachefs/recovery_passes.c:484 [inline] __bch2_run_recovery_passes+0x3bd/0x1060 fs/bcachefs/recovery_passes.c:539 bch2_run_recovery_passes+0x184/0x210 fs/bcachefs/recovery_passes.c:610 bch2_fs_recovery+0x2690/0x3a50 fs/bcachefs/recovery.c:1016 bch2_fs_start+0xaaf/0xda0 fs/bcachefs/super.c:1213 bch2_fs_get_tree+0xb39/0x1520 fs/bcachefs/fs.c:2488 vfs_get_tree+0x92/0x2b0 fs/super.c:1815 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808 do_mount fs/namespace.c:4136 [inline] __do_sys_mount fs/namespace.c:4347 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4324 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f33f1b9038a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f33f2ac9e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f33f2ac9ef0 RCX: 00007f33f1b9038a RDX: 0000200000000100 RSI: 0000200000004940 RDI: 00007f33f2ac9eb0 RBP: 0000200000000100 R08: 00007f33f2ac9ef0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000200000004940 R13: 00007f33f2ac9eb0 R14: 0000000000004982 R15: 00002000000000c0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:bch2_btree_path_level_init+0xa11/0xa20 fs/bcachefs/btree_iter.c:633 Code: fd 90 0f 0b e8 d0 b2 97 fd 90 0f 0b e8 c8 b2 97 fd 90 0f 0b e8 c0 b2 97 fd 90 0f 0b e8 b8 b2 97 fd 90 0f 0b e8 b0 b2 97 fd 90 <0f> 0b 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 RSP: 0018:ffffc9000d506320 EFLAGS: 00010246 RAX: ffffffff84280b10 RBX: ffff888055180608 RCX: 0000000000100000 RDX: ffffc9000ee1a000 RSI: 00000000000fffff RDI: 0000000000100000 RBP: ffff888051f369a7 R08: 0000000000000052 R09: 1ffff1100a3e6d16 R10: dffffc0000000000 R11: ffffed100a3e6d17 R12: 0000000000000091 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff888051f36800 FS: 00007f33f2aca6c0(0000) GS:ffff88808d20d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff14ab5e000 CR3: 0000000042f8a000 CR4: 0000000000352ef0