------------[ cut here ]------------ CPU 1 old state 6 new state 1 WARNING: CPU: 1 PID: 8581 at kernel/rcu/srcutree.c:708 srcu_check_nmi_safety+0xe8/0x1b0 kernel/rcu/srcutree.c:708 Modules linked in: CPU: 1 UID: 0 PID: 8581 Comm: syz.7.364 Not tainted 6.12.0-rc6-syzkaller-g563047e691f2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : srcu_check_nmi_safety+0xe8/0x1b0 kernel/rcu/srcutree.c:708 lr : srcu_check_nmi_safety+0xe8/0x1b0 kernel/rcu/srcutree.c:708 sp : ffff80009f1e6ed0 x29: ffff80009f1e6ee0 x28: ffff0000d50a3c80 x27: dfff800000000000 x26: 0000000000000000 x25: 1fffe0001961a808 x24: 0000000000000002 x23: 0000000000000000 x22: 0000000000000001 x21: 0000000000000000 x20: dfff800000000000 x19: fffffdffbf7546c8 x18: 0000000000000008 x17: 0000000000000000 x16: ffff8000830cb670 x15: 0000000000000001 x14: 1fffe000366cb4e2 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000040000 x10: 000000000003ffff x9 : 16cc17327e722400 x8 : 16cc17327e722400 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff80009f1e65f8 x4 : ffff80008f8fd0c0 x3 : ffff80008062728c x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 Call trace: srcu_check_nmi_safety+0xe8/0x1b0 kernel/rcu/srcutree.c:708 (P) srcu_check_nmi_safety+0xe8/0x1b0 kernel/rcu/srcutree.c:708 (L) srcu_read_lock include/linux/srcu.h:248 [inline] __bch2_trans_get+0x6c4/0xa64 fs/bcachefs/btree_iter.c:3228 bch2_btree_root_read+0xbc/0x40c fs/bcachefs/btree_io.c:1775 read_btree_roots+0x24c/0x794 fs/bcachefs/recovery.c:523 bch2_fs_recovery+0x328c/0x55a0 fs/bcachefs/recovery.c:853 bch2_fs_start+0x30c/0x53c fs/bcachefs/super.c:1036 bch2_fs_get_tree+0x938/0x1030 fs/bcachefs/fs.c:2170 vfs_get_tree+0x90/0x28c fs/super.c:1814 do_new_mount+0x278/0x900 fs/namespace.c:3507 path_mount+0x590/0xe04 fs/namespace.c:3834 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount fs/namespace.c:4034 [inline] __arm64_sys_mount+0x4d4/0x5ac fs/namespace.c:4034 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 irq event stamp: 71958 hardirqs last enabled at (71957): [] __up_console_sem kernel/printk/printk.c:344 [inline] hardirqs last enabled at (71957): [] __console_unlock+0x70/0xc4 kernel/printk/printk.c:2844 hardirqs last disabled at (71958): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:488 softirqs last enabled at (69892): [] softirq_handle_end kernel/softirq.c:400 [inline] softirqs last enabled at (69892): [] handle_softirqs+0xa38/0xbf8 kernel/softirq.c:582 softirqs last disabled at (69855): [] __do_softirq+0x14/0x20 kernel/softirq.c:588 ---[ end trace 0000000000000000 ]--- bcachefs (loop7): check_topology... done bcachefs (loop7): accounting_read... done bcachefs (loop7): alloc_read... done bcachefs (loop7): stripes_read... done bcachefs (loop7): snapshots_read... done bcachefs (loop7): check_allocations... bucket 0:26 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0, fixing bucket 0:38 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0, fixing bucket 0:41 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0, fixing bucket 0:35 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0, fixing bucket 0:29 data type btree ptr gen 0 missing in alloc btree while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq e81e1ed936acf3df written 32 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0, fixing bucket 0:1 gen 0 has wrong data_type: got free, should be sb, fixing bucket 0:1 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing bucket 0:2 gen 0 has wrong data_type: got free, should be sb, fixing bucket 0:2 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing bucket 0:3 gen 0 has wrong data_type: got free, should be sb, fixing bucket 0:3 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing bucket 0:4 gen 0 has wrong data_type: got free, should be sb, fixing bucket 0:4 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing bucket 0:5 gen 0 has wrong data_type: got free, should be sb, fixing bucket 0:5 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing bucket 0:6 gen 0 has wrong data_type: got free, should be sb, fixing bucket 0:6 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing bucket 0:7 gen 0 has wrong data_type: got free, should be sb, fixing bucket 0:7 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing bucket 0:8 gen 0 has wrong data_type: got free, should be sb, fixing bucket 0:8 gen 0 data type sb has wrong dirty_sectors: got 0, should be 8, fixing bucket 0:9 gen 0 has wrong data_type: got free, should be journal, fixing bucket 0:9 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing bucket 0:10 gen 0 has wrong data_type: got free, should be journal, fixing bucket 0:10 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing bucket 0:11 gen 0 has wrong data_type: got free, should be journal, fixing bcachefs (loop7): Ratelimiting new instances of previous error bucket 0:11 gen 0 data type journal has wrong dirty_sectors: got 0, should be 256, fixing bcachefs (loop7): Ratelimiting new instances of previous error done bcachefs (loop7): going read-write bcachefs (loop7): journal_replay... done bcachefs (loop7): check_alloc_info... done bcachefs (loop7): check_lrus... done bcachefs (loop7): check_btree_backpointers... done bcachefs (loop7): check_backpointers_to_extents... done bcachefs (loop7): check_extents_to_backpointers... missing backpointer for btree=inodes l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 got: u64s 5 type deleted 0:9961472:0 len 0 ver 0 want: u64s 9 type backpointer 0:9961472:0 len 0 ver 0: bucket=0:38:0 btree=inodes l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing missing backpointer for btree=dirents l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0 got: u64s 5 type deleted 0:10747904:0 len 0 ver 0 want: u64s 9 type backpointer 0:10747904:0 len 0 ver 0: bucket=0:41:0 btree=dirents l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing missing backpointer for btree=alloc l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 got: u64s 5 type deleted 0:6815744:0 len 0 ver 0 want: u64s 9 type backpointer 0:6815744:0 len 0 ver 0: bucket=0:26:0 btree=alloc l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing missing backpointer for btree=subvolumes l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0 got: u64s 5 type deleted 0:9175040:0 len 0 ver 0 want: u64s 9 type backpointer 0:9175040:0 len 0 ver 0: bucket=0:35:0 btree=subvolumes l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing missing backpointer for btree=snapshots l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ebb8d5a9e3463bdb written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0 got: u64s 5 type deleted 0:8388608:0 len 0 ver 0 want: u64s 9 type backpointer 0:8388608:0 len 0 ver 0: bucket=0:32:0 btree=snapshots l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing missing backpointer for btree=freespace l=1 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq e81e1ed936acf3df written 32 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0 got: u64s 5 type deleted 0:7602176:0 len 0 ver 0 want: u64s 9 type backpointer 0:7602176:0 len 0 ver 0: bucket=0:29:0 btree=freespace l=1 offset=0:0 len=256 pos=SPOS_MAX, fixing done bcachefs (loop7): check_alloc_to_lru_refs... done bcachefs (loop7): bucket_gens_init... done bcachefs (loop7): check_snapshot_trees... done bcachefs (loop7): check_snapshots... snapshot points to missing/incorrect tree: u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent 0 children 0 0 subvol 1 tree 0, fixing done bcachefs (loop7): check_subvols... done bcachefs (loop7): check_subvol_children... done bcachefs (loop7): delete_dead_snapshots... done bcachefs (loop7): check_inodes... done bcachefs (loop7): check_extents... done bcachefs (loop7): check_indirect_extents... done bcachefs (loop7): check_dirents... done bcachefs (loop7): check_xattrs... done bcachefs (loop7): check_root... done bcachefs (loop7): check_unreachable_inodes... done bcachefs (loop7): check_subvolume_structure... done bcachefs (loop7): check_directory_structure... done bcachefs (loop7): check_nlinks... inode 536870914 type reg has wrong i_nlink (2780562353, should be 1), fixing done bcachefs (loop7): resume_logged_ops... done bcachefs (loop7): delete_dead_inodes... done bcachefs (loop7): set_fs_needs_rebalance... done bcachefs (loop7): Fixed errors, running fsck a second time to verify fs is clean bcachefs (loop7): check_alloc_info... done bcachefs (loop7): check_lrus... done bcachefs (loop7): check_btree_backpointers... done bcachefs (loop7): check_backpointers_to_extents... done bcachefs (loop7): check_extents_to_backpointers... done bcachefs (loop7): check_alloc_to_lru_refs... done bcachefs (loop7): bucket_gens_init... done bcachefs (loop7): check_snapshot_trees... done bcachefs (loop7): check_snapshots... done bcachefs (loop7): check_subvols... done bcachefs (loop7): check_subvol_children... done bcachefs (loop7): delete_dead_snapshots... done bcachefs (loop7): check_inodes... done bcachefs (loop7): check_extents... done bcachefs (loop7): check_indirect_extents... done bcachefs (loop7): check_dirents... done bcachefs (loop7): check_xattrs... done bcachefs (loop7): check_root... done bcachefs (loop7): check_unreachable_inodes... done bcachefs (loop7): check_subvolume_structure... done bcachefs (loop7): check_directory_structure... done bcachefs (loop7): check_nlinks... done bcachefs (loop7): resume_logged_ops... done bcachefs (loop7): delete_dead_inodes... done bcachefs (loop7): set_fs_needs_rebalance... done bcachefs (loop7): going read-only bcachefs (loop7): finished waiting for writes to stop bcachefs (loop7): flushing journal and stopping allocators, journal seq 28 bcachefs (loop7): flushing journal and stopping allocators complete, journal seq 28 bcachefs (loop7): shutdown complete, journal seq 29 bcachefs (loop7): marking filesystem clean bcachefs (loop7): done starting filesystem