bcachefs (loop0): Detected missing backpointers in bucket 34, now have 1/128 with missing running recovery pass check_extents_to_backpointers (17), currently at delete_dead_snapshots (26) ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in bch2_bucket_bitmap_test fs/bcachefs/backpointers.h:194 [inline] BUG: KASAN: slab-use-after-free in bch2_bucket_is_movable fs/bcachefs/movinggc.c:78 [inline] BUG: KASAN: slab-use-after-free in bch2_copygc_get_buckets fs/bcachefs/movinggc.c:157 [inline] BUG: KASAN: slab-use-after-free in bch2_copygc+0x105d/0x4510 fs/bcachefs/movinggc.c:221 Read of size 8 at addr ffff888051c5c220 by task bch-copygc/loop/5369 CPU: 0 UID: 0 PID: 5369 Comm: bch-copygc/loop Not tainted 6.17.0-rc1-syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x2b0/0x2c0 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] bch2_bucket_bitmap_test fs/bcachefs/backpointers.h:194 [inline] bch2_bucket_is_movable fs/bcachefs/movinggc.c:78 [inline] bch2_copygc_get_buckets fs/bcachefs/movinggc.c:157 [inline] bch2_copygc+0x105d/0x4510 fs/bcachefs/movinggc.c:221 bch2_copygc_thread+0x97a/0xe00 fs/bcachefs/movinggc.c:409 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 5369: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kvmalloc_node_noprof+0x30d/0x5f0 mm/slub.c:5052 kvmalloc_array_node_noprof include/linux/slab.h:1065 [inline] bch2_bucket_bitmap_set+0x9a/0x1d0 fs/bcachefs/backpointers.c:1351 check_bucket_backpointer_mismatch+0x1bdf/0x23a0 fs/bcachefs/backpointers.c:964 check_bucket_backpointer_pos_mismatch fs/bcachefs/backpointers.c:1193 [inline] bch2_check_bucket_backpointer_mismatch+0x36c/0x690 fs/bcachefs/backpointers.c:1205 __bch2_move_data_phys+0x17a7/0x1c50 fs/bcachefs/move.c:922 bch2_evacuate_bucket+0x228/0x3a0 fs/bcachefs/move.c:1082 bch2_copygc+0x3be3/0x4510 fs/bcachefs/movinggc.c:234 bch2_copygc_thread+0x97a/0xe00 fs/bcachefs/movinggc.c:409 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888051c5c220 which belongs to the cache kmalloc-16 of size 16 The buggy address is located 0 bytes inside of freed 16-byte region [ffff888051c5c220, ffff888051c5c230) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x51c5c flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88801a441640 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080800080 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 134, tgid 134 (kworker/u4:5), ts 77698909749, free_ts 77697065708 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851 prep_new_page mm/page_alloc.c:1859 [inline] get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416 alloc_slab_page mm/slub.c:2487 [inline] allocate_slab+0x8a/0x370 mm/slub.c:2655 new_slab mm/slub.c:2709 [inline] ___slab_alloc+0xbeb/0x1410 mm/slub.c:3891 __slab_alloc mm/slub.c:3981 [inline] __slab_alloc_node mm/slub.c:4056 [inline] slab_alloc_node mm/slub.c:4217 [inline] __do_kmalloc_node mm/slub.c:4364 [inline] __kmalloc_noprof+0x305/0x4f0 mm/slub.c:4377 kmalloc_noprof include/linux/slab.h:909 [inline] kmalloc_array_noprof include/linux/slab.h:948 [inline] __bch2_sb_replicas_v0_to_cpu_replicas+0x131/0xad0 fs/bcachefs/replicas.c:563 bch2_sb_replicas_v0_validate+0x48/0xb0 fs/bcachefs/replicas.c:774 bch2_sb_field_validate+0x143/0x280 fs/bcachefs/super-io.c:1375 bch2_sb_validate+0x1569/0x1980 fs/bcachefs/super-io.c:560 bch2_write_super+0xd68/0x2d30 fs/bcachefs/super-io.c:1089 btree_update_new_nodes_mark_sb fs/bcachefs/btree_update_interior.c:613 [inline] btree_update_nodes_written fs/bcachefs/btree_update_interior.c:683 [inline] btree_interior_update_work+0x43a/0x27d0 fs/bcachefs/btree_update_interior.c:867 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 page last free pid 5356 tgid 5355 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1395 [inline] __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895 discard_slab mm/slub.c:2753 [inline] __put_partials+0x156/0x1a0 mm/slub.c:3218 put_cpu_partial+0x17c/0x250 mm/slub.c:3293 __slab_free+0x2d5/0x3c0 mm/slub.c:4550 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:340 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4180 [inline] slab_alloc_node mm/slub.c:4229 [inline] __do_kmalloc_node mm/slub.c:4364 [inline] __kmalloc_node_track_caller_noprof+0x216/0x4e0 mm/slub.c:4384 __do_krealloc mm/slub.c:4942 [inline] krealloc_noprof+0x124/0x340 mm/slub.c:4995 bch2_printbuf_make_room+0x1f5/0x360 fs/bcachefs/printbuf.c:59 bch2_prt_printf+0x282/0x740 fs/bcachefs/printbuf.c:186 bch2_bkey_to_text+0x62/0x260 fs/bcachefs/bkey_methods.c:300 bch2_bkey_val_to_text+0x34/0x150 fs/bcachefs/bkey_methods.c:327 check_snapshot fs/bcachefs/snapshot.c:795 [inline] bch2_check_snapshots+0x1035/0x1fe0 fs/bcachefs/snapshot.c:852 bch2_run_recovery_pass fs/bcachefs/recovery_passes.c:484 [inline] __bch2_run_recovery_passes+0x3ba/0x1060 fs/bcachefs/recovery_passes.c:539 bch2_run_recovery_passes+0x184/0x210 fs/bcachefs/recovery_passes.c:610 Memory state around the buggy address: ffff888051c5c100: 00 00 fc fc 00 00 fc fc fa fb fc fc 00 00 fc fc ffff888051c5c180: 00 00 fc fc fa fb fc fc fa fb fc fc fa fb fc fc >ffff888051c5c200: fa fb fc fc fb fb fc fc 00 00 fc fc 00 00 fc fc ^ ffff888051c5c280: 00 00 fc fc fa fb fc fc fa fb fc fc 00 00 fc fc ffff888051c5c300: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc ==================================================================