slab kmalloc-32 start ffff88804440f0c0 pointer offset 0 size 32
list_add corruption. prev->next should be next (ffff888052a98668), but was 0000000000000000. (prev=ffff88804440f0c0).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:34!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__list_add_valid_or_report+0x123/0x130 lib/list_debug.c:32
Code: 73 e9 0a fd 42 80 3c 2b 00 74 08 4c 89 e7 e8 54 dd 2c fd 49 8b 14 24 48 c7 c7 c0 ef 80 8c 4c 89 f6 4c 89 e1 e8 be e8 2a fc 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000007a28 EFLAGS: 00010046
RAX: 0000000000000075 RBX: 1ffff11008881e18 RCX: d3da822991cd7300
RDX: 0000000000000100 RSI: 0000000080000102 RDI: 0000000000000000
RBP: 1ffff1100a5530ce R08: ffffffff81a1108c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: ffff88804440f0c0
R13: dffffc0000000000 R14: ffff888052a98668 R15: ffff88801e3505c0
FS: 00007fd15b1226c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ffc1a67098 CR3: 0000000043780000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add_tail include/linux/list.h:183 [inline]
list_move_tail include/linux/list.h:311 [inline]
ref_tracker_free+0x2b4/0x7e0 lib/ref_tracker.c:262
netdev_tracker_free include/linux/netdevice.h:4301 [inline]
netdev_put include/linux/netdevice.h:4318 [inline]
dst_destroy+0x105/0x360 net/core/dst.c:114
rcu_do_batch kernel/rcu/tree.c:2546 [inline]
rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2802
handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 1e f6 1d f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 e3 5c 84 f5 65 8b 05 84 d1 f8 73 85 c0 74 43 48 c7 04 24 0e 36
RSP: 0018:ffffc900019b6580 EFLAGS: 00000206
RAX: d3da822991cd7300 RBX: 1ffff92000336cb4 RCX: ffffffff819d265a
RDX: dffffc0000000000 RSI: ffffffff8c2aa440 RDI: 0000000000000001
RBP: ffffc900019b6608 R08: ffffffff9454694f R09: 1ffffffff28a8d29
R10: dffffc0000000000 R11: fffffbfff28a8d2a R12: dffffc0000000000
R13: 1ffff92000336cb0 R14: ffffc900019b65a0 R15: 0000000000000246
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
free_one_page mm/page_alloc.c:1260 [inline]
__free_pages_ok+0x5cf/0xe40 mm/page_alloc.c:1272
__folio_put+0x2b3/0x360 mm/swap.c:112
folio_put include/linux/mm.h:1489 [inline]
free_large_kmalloc+0xfe/0x180 mm/slub.c:4728
kfree+0x212/0x430 mm/slub.c:4751
__btree_node_data_free+0x30e/0x550 fs/bcachefs/btree_cache.c:113
btree_node_data_free fs/bcachefs/btree_cache.c:130 [inline]
bch2_btree_node_evict+0x8db/0x990 fs/bcachefs/btree_cache.c:1381
bch2_btree_repair_topology_recurse+0x1365/0x6b10 fs/bcachefs/btree_gc.c:356
bch2_check_topology+0x92f/0xe30 fs/bcachefs/btree_gc.c:554
bch2_run_recovery_pass+0xf0/0x1e0 fs/bcachefs/recovery_passes.c:226
bch2_run_recovery_passes+0x2ad/0xa90 fs/bcachefs/recovery_passes.c:291
bch2_fs_recovery+0x265a/0x3de0 fs/bcachefs/recovery.c:936
bch2_fs_start+0x37c/0x610 fs/bcachefs/super.c:1041
bch2_fs_get_tree+0xdb7/0x17a0 fs/bcachefs/fs.c:2203
vfs_get_tree+0x90/0x2b0 fs/super.c:1814
do_new_mount+0x2be/0xb40 fs/namespace.c:3560
do_mount fs/namespace.c:3900 [inline]
__do_sys_mount fs/namespace.c:4111 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd15a38e58a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd15b121e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fd15b121ef0 RCX: 00007fd15a38e58a
RDX: 00004000000058c0 RSI: 0000400000005900 RDI: 00007fd15b121eb0
RBP: 00004000000058c0 R08: 00007fd15b121ef0 R09: 0000000000010000
R10: 0000000000010000 R11: 0000000000000246 R12: 0000400000005900
R13: 00007fd15b121eb0 R14: 0000000000005912 R15: 00004000000001c0
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report+0x123/0x130 lib/list_debug.c:32
Code: 73 e9 0a fd 42 80 3c 2b 00 74 08 4c 89 e7 e8 54 dd 2c fd 49 8b 14 24 48 c7 c7 c0 ef 80 8c 4c 89 f6 4c 89 e1 e8 be e8 2a fc 90 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000007a28 EFLAGS: 00010046
RAX: 0000000000000075 RBX: 1ffff11008881e18 RCX: d3da822991cd7300
RDX: 0000000000000100 RSI: 0000000080000102 RDI: 0000000000000000
RBP: 1ffff1100a5530ce R08: ffffffff81a1108c R09: 1ffff11003f8519a
R10: dffffc0000000000 R11: ffffed1003f8519b R12: ffff88804440f0c0
R13: dffffc0000000000 R14: ffff888052a98668 R15: ffff88801e3505c0
FS: 00007fd15b1226c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ffc1a67098 CR3: 0000000043780000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 9c pushf
1: 8f 44 24 20 pop 0x20(%rsp)
5: 42 80 3c 23 00 cmpb $0x0,(%rbx,%r12,1)
a: 74 08 je 0x14
c: 4c 89 f7 mov %r14,%rdi
f: e8 1e f6 1d f6 call 0xf61df632
14: f6 44 24 21 02 testb $0x2,0x21(%rsp)
19: 75 52 jne 0x6d
1b: 41 f7 c7 00 02 00 00 test $0x200,%r15d
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 e3 5c 84 f5 call 0xf5845d12 <-- trapping instruction
2f: 65 8b 05 84 d1 f8 73 mov %gs:0x73f8d184(%rip),%eax # 0x73f8d1ba
36: 85 c0 test %eax,%eax
38: 74 43 je 0x7d
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 04 24 add $0x24,%al
3e: 0e (bad)
3f: 36 ss