bcachefs (loop1): stripes_read... done
bcachefs (loop1): snapshots_read... done
bcachefs (loop1): going read-write
bcachefs (loop1): journal_replay...
------------[ cut here ]------------
kernel BUG at fs/bcachefs/recovery.c:129!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 6691 Comm: syz.1.92 Not tainted 6.10.0-rc7-syzkaller-gc912bf709078 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : replay_now_at fs/bcachefs/recovery.c:129 [inline]
pc : bch2_journal_replay+0xf2c/0x10bc fs/bcachefs/recovery.c:268
lr : replay_now_at fs/bcachefs/recovery.c:129 [inline]
lr : bch2_journal_replay+0xf2c/0x10bc fs/bcachefs/recovery.c:268
sp : ffff80009fcf6c20
x29: ffff80009fcf6d30 x28: ffff0000f1ecab00 x27: ffff0000f1ecaaf8
x26: dfff800000000000 x25: 00000000ffffffff x24: ffff0000f1eca440
x23: ffff0000dc590000 x22: 1fffe0001e3d955f x21: 0000000000000001
x20: fffffffffeffff0b x19: ffff0000dc827018 x18: ffff0000eb9787f4
x17: 0000000000000000 x16: ffff80008032b884 x15: 0000000000000001
x14: 0000000000000002 x13: 0000000000000003 x12: ffff0000d2541e40
x11: 0000000000040000 x10: 000000000003ffff x9 : ffff8000a39ac000
x8 : 0000000000040000 x7 : 0000000000000000 x6 : 000000000000003f
x5 : ffff80009fcf6ba0 x4 : 0000000000000003 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 00000000ffffffff x0 : fffffffffeffff0b
Call trace:
 replay_now_at fs/bcachefs/recovery.c:129 [inline]
 bch2_journal_replay+0xf2c/0x10bc fs/bcachefs/recovery.c:268
 bch2_run_recovery_pass+0xe4/0x1d4 fs/bcachefs/recovery_passes.c:182
 bch2_run_recovery_passes+0x258/0x6e0 fs/bcachefs/recovery_passes.c:225
 bch2_fs_recovery+0x31f0/0x5488 fs/bcachefs/recovery.c:813
 bch2_fs_start+0x30c/0x53c fs/bcachefs/super.c:1035
 bch2_fs_open+0x8b4/0xb64 fs/bcachefs/super.c:2132
 bch2_mount+0x4fc/0xe68 fs/bcachefs/fs.c:1926
 legacy_get_tree+0xd4/0x16c fs/fs_context.c:662
 vfs_get_tree+0x90/0x288 fs/super.c:1789
 do_new_mount+0x278/0x900 fs/namespace.c:3352
 path_mount+0x590/0xe04 fs/namespace.c:3679
 do_mount fs/namespace.c:3692 [inline]
 __do_sys_mount fs/namespace.c:3898 [inline]
 __se_sys_mount fs/namespace.c:3875 [inline]
 __arm64_sys_mount+0x3c4/0x488 fs/namespace.c:3875
 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:48
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:131
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:150
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
Code: d4210000 97700ed6 d4210000 97700ed4 (d4210000) 
---[ end trace 0000000000000000 ]---