./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor4272031871
<...>
Warning: Permanently added '10.128.1.133' (ED25519) to the list of known hosts.
execve("./syz-executor4272031871", ["./syz-executor4272031871"], 0x7ffe26603200 /* 10 vars */) = 0
brk(NULL) = 0x55555c7d5000
brk(0x55555c7d5d00) = 0x55555c7d5d00
arch_prctl(ARCH_SET_FS, 0x55555c7d5380) = 0
set_tid_address(0x55555c7d5650) = 5848
set_robust_list(0x55555c7d5660, 24) = 0
rseq(0x55555c7d5ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor4272031871", 4096) = 28
getrandom("\x4d\xba\x12\xf1\x63\xe3\xb9\x47", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55555c7d5d00
brk(0x55555c7f6d00) = 0x55555c7f6d00
brk(0x55555c7f7000) = 0x55555c7f7000
mprotect(0x7f5016c6c000, 16384, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5849 attached
, child_tidptr=0x55555c7d5650) = 5849
[pid 5849] set_robust_list(0x55555c7d5660, 24) = 0
[pid 5849] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5849] setpgid(0, 0) = 0
[pid 5849] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5849] write(3, "1000", 4) = 4
[pid 5849] close(3) = 0
[pid 5849] write(1, "executing program\n", 18executing program
) = 18
[pid 5849] memfd_create("syzkaller", 0) = 3
[pid 5849] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f500e7ae000
[pid 5849] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 8388608) = 8388608
[pid 5849] munmap(0x7f500e7ae000, 138412032) = 0
[pid 5849] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5849] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5849] close(3) = 0
[pid 5849] close(4) = 0
[pid 5849] mkdir("./file0", 0777) = 0
[ 103.699078][ T5849] loop0: detected capacity change from 0 to 16384
[ 103.858311][ T5849] bcachefs (loop0): starting version 1.13: inode_has_child_snapshots opts=metadata_checksum=none,data_checksum=none
[ 103.858333][ T5849] features: new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes
[ 103.858366][ T5849] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0
[ 103.858713][ T5849] bcachefs (loop0): recovering from clean shutdown, journal seq 15
[ 103.858865][ T5849] bcachefs (loop0): Doing compatible version upgrade from 1.13: inode_has_child_snapshots to 1.28: inode_has_case_insensitive
[ 103.858865][ T5849] running recovery passes: check_allocations,check_extents_to_backpointers,check_inodes
[ 103.938377][ T5849] bcachefs (loop0): invalid bkey in btree_node btree=subvolumes level=0: u64s 10 type subvolume 0:1970324836974593:0 len 0 [ 103.938377][ T5849] bcachefs (loop0): invalid bkey in btree_node btree=subvolumes level=0: u64s 10 type subvolume 0:1970324836974593:0 len 0 ver 0: root 4096 snapshot id 4294967295 creation_parent 0 fs_parent 0
[ 103.938398][ T5849] invalid pos, deleting
[ 103.941413][ T5849] bcachefs (loop0): error reading btree root btree=subvolumes level=0: btree_node_read_error, fixing
[ 103.950060][ T5849] bcachefs (loop0): invalid bkey in btree_node btree=snapshot_trees level=0: u64s 6 type snapshot_tree POS_MIN len 0 ver 0: subvol 1 root snapshot 4294967295
[ 103.950086][ T5849] bad pos, deleting
[ 103.954012][ T5849] bcachefs (loop0): error reading btree root btree=snapshot_trees level=0: btree_node_read_error, fixing
[ 103.956093][ T5849] ------------[ cut here ]------------
[ 103.956106][ T5849] UBSAN: array-index-out-of-bounds in fs/bcachefs/disk_accounting.c:238:2
[ 103.956127][ T5849] index 175 is out of range for type 'const unsigned int[9]'
[ 103.956161][ T5849] CPU: 0 UID: 0 PID: 5849 Comm: syz-executor427 Tainted: G W 6.16.0-syzkaller-11322-g352af6a011d5 #0 PREEMPT_{RT,(full)}
[ 103.956197][ T5849] Tainted: [W]=WARN
[ 103.956206][ T5849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[ 103.956222][ T5849] Call Trace:
[ 103.956231][ T5849]
[ 103.956243][ T5849] dump_stack_lvl+0x189/0x250
[ 103.956292][ T5849] ? __pfx_dump_stack_lvl+0x10/0x10
[ 103.956332][ T5849] ? __pfx__printk+0x10/0x10
[ 103.956375][ T5849] ubsan_epilogue+0xa/0x40
[ 103.956402][ T5849] __ubsan_handle_out_of_bounds+0xe9/0xf0
[ 103.956446][ T5849] bch2_accounting_validate+0x112f/0x1400
[ 103.956494][ T5849] ? reacquire_held_locks+0x50/0x1d0
[ 103.956532][ T5849] ? __pfx_bch2_accounting_validate+0x10/0x10
[ 103.956589][ T5849] ? __pfx_bch2_accounting_validate+0x10/0x10
[ 103.956651][ T5849] bch2_bkey_val_validate+0x202/0x3e0
[ 103.956688][ T5849] ? __pfx_bch2_bkey_val_validate+0x10/0x10
[ 103.956720][ T5849] ? __asan_memset+0x22/0x50
[ 103.956747][ T5849] ? __bch2_bkey_unpack_key+0x98b/0xe10
[ 103.956785][ T5849] bch2_btree_node_read_done+0x4051/0x5550
[ 103.956864][ T5849] ? __pfx_bch2_btree_node_read_done+0x10/0x10
[ 103.956905][ T5849] ? bch2_extent_ptr_to_text+0x5a/0x890
[ 103.956952][ T5849] ? bch2_bkey_ptrs_to_text+0x1161/0x1310
[ 103.956992][ T5849] ? bch2_printbuf_make_room+0xdb/0x360
[ 103.957028][ T5849] ? enumerated_ref_put+0xbe/0x270
[ 103.957065][ T5849] btree_node_read_work+0x40e/0xe60
[ 103.957117][ T5849] ? __pfx_btree_node_read_work+0x10/0x10
[ 103.957146][ T5849] ? bch2_latency_acct+0x436/0x520
[ 103.957186][ T5849] ? __pfx_bch2_latency_acct+0x10/0x10
[ 103.957220][ T5849] ? bio_associate_blkg+0x6d/0x230
[ 103.957258][ T5849] bch2_btree_node_read+0x887/0x2a00
[ 103.957299][ T5849] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.957327][ T5849] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 103.957354][ T5849] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 103.957377][ T5849] ? __bch2_btree_node_hash_insert+0x142d/0x1ab0
[ 103.957424][ T5849] ? __pfx_bch2_btree_node_read+0x10/0x10
[ 103.957462][ T5849] ? bch2_trans_unlock+0x8a/0x580
[ 103.957507][ T5849] ? bch2_trans_unlock+0x491/0x580
[ 103.957561][ T5849] bch2_btree_root_read+0x5f0/0x760
[ 103.957600][ T5849] ? __pfx_bch2_btree_root_read+0x10/0x10
[ 103.957650][ T5849] ? bch2_current_has_btree_trans+0x169/0x1a0
[ 103.957685][ T5849] read_btree_roots+0x2c6/0x840
[ 103.957736][ T5849] ? __pfx_read_btree_roots+0x10/0x10
[ 103.957801][ T5849] bch2_fs_recovery+0x261f/0x3a50
[ 103.957861][ T5849] ? __pfx_bch2_fs_recovery+0x10/0x10
[ 103.957902][ T5849] ? lockdep_unlock+0x89/0x120
[ 103.957931][ T5849] ? validate_chain+0x897/0x2140
[ 103.957977][ T5849] ? __lock_acquire+0xab9/0xd20
[ 103.958020][ T5849] ? do_raw_spin_lock+0x121/0x290
[ 103.958060][ T5849] ? _raw_spin_unlock_irqrestore+0x85/0x110
[ 103.958086][ T5849] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.958113][ T5849] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 103.958137][ T5849] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 103.958162][ T5849] ? do_raw_spin_lock+0x121/0x290
[ 103.958202][ T5849] ? rt_mutex_slowunlock+0x493/0x8a0
[ 103.958231][ T5849] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.958257][ T5849] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 103.958284][ T5849] ? __pfx_rt_mutex_slowunlock+0x10/0x10
[ 103.958319][ T5849] ? bch2_fs_start+0xa0f/0xda0
[ 103.958350][ T5849] bch2_fs_start+0xaaf/0xda0
[ 103.958376][ T5849] ? bch2_fs_start+0x5e7/0xda0
[ 103.958403][ T5849] ? __pfx_bch2_fs_start+0x10/0x10
[ 103.958454][ T5849] ? sget+0x267/0x620
[ 103.958500][ T5849] bch2_fs_get_tree+0xb39/0x1520
[ 103.958572][ T5849] ? __pfx_bch2_fs_get_tree+0x10/0x10
[ 103.958643][ T5849] ? __pfx_vfs_parse_comma_sep+0x10/0x10
[ 103.958685][ T5849] ? rcu_is_watching+0x15/0xb0
[ 103.958724][ T5849] ? cap_capable+0x11f/0x460
[ 103.958781][ T5849] ? safesetid_security_capable+0xa9/0x1a0
[ 103.958828][ T5849] vfs_get_tree+0x92/0x2b0
[ 103.958882][ T5849] do_new_mount+0x2a2/0x9e0
[ 103.958921][ T5849] ? ns_capable+0x8a/0xf0
[ 103.958952][ T5849] ? __pfx_do_new_mount+0x10/0x10
[ 103.958984][ T5849] ? path_mount+0x61c/0xfe0
[ 103.959031][ T5849] __se_sys_mount+0x317/0x410
[ 103.959077][ T5849] ? __pfx___se_sys_mount+0x10/0x10
[ 103.959111][ T5849] ? rcu_is_watching+0x15/0xb0
[ 103.959158][ T5849] ? __x64_sys_mount+0x20/0xc0
[ 103.959195][ T5849] do_syscall_64+0xfa/0x3b0
[ 103.959220][ T5849] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.959244][ T5849] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.959270][ T5849] ? clear_bhb_loop+0x60/0xb0
[ 103.959300][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.959325][ T5849] RIP: 0033:0x7f5016bf5eaa
[ 103.959357][ T5849] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 103.959383][ T5849] RSP: 002b:00007ffd552f5c58 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
[ 103.959418][ T5849] RAX: ffffffffffffffda RBX: 00007ffd552f5c70 RCX: 00007f5016bf5eaa
[ 103.959437][ T5849] RDX: 0000200000001000 RSI: 0000200000000000 RDI: 00007ffd552f5c70
[ 103.959455][ T5849] RBP: 0000200000000000 R08: 00007ffd552f5cb0 R09: 000000000000492c
[ 103.959471][ T5849] R10: 0000000000000000 R11: 0000000000000282 R12: 0000200000001000
[ 103.959487][ T5849] R13: 00007ffd552f5cb0 R14: 0000000000000003 R15: 0000000000000000
[ 103.959523][ T5849]
[ 103.959869][ T5849] ---[ end trace ]---
[ 103.959888][ T5849] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 103.959907][ T5849] CPU: 0 UID: 0 PID: 5849 Comm: syz-executor427 Tainted: G W 6.16.0-syzkaller-11322-g352af6a011d5 #0 PREEMPT_{RT,(full)}
[ 103.959939][ T5849] Tainted: [W]=WARN
[ 103.959946][ T5849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[ 103.959960][ T5849] Call Trace:
[ 103.959969][ T5849]
[ 103.959978][ T5849] dump_stack_lvl+0x99/0x250
[ 103.960023][ T5849] ? __asan_memcpy+0x40/0x70
[ 103.960048][ T5849] ? __pfx_dump_stack_lvl+0x10/0x10
[ 103.960082][ T5849] ? __pfx__printk+0x10/0x10
[ 103.960119][ T5849] vpanic+0x27a/0x730
[ 103.960150][ T5849] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.960174][ T5849] ? __pfx_vpanic+0x10/0x10
[ 103.960222][ T5849] panic+0xb9/0xc0
[ 103.960256][ T5849] ? __pfx_panic+0x10/0x10
[ 103.960293][ T5849] ? __pfx__printk+0x10/0x10
[ 103.960326][ T5849] check_panic_on_warn+0x89/0xb0
[ 103.960352][ T5849] __ubsan_handle_out_of_bounds+0xe9/0xf0
[ 103.960391][ T5849] bch2_accounting_validate+0x112f/0x1400
[ 103.960434][ T5849] ? reacquire_held_locks+0x50/0x1d0
[ 103.960470][ T5849] ? __pfx_bch2_accounting_validate+0x10/0x10
[ 103.960521][ T5849] ? __pfx_bch2_accounting_validate+0x10/0x10
[ 103.960557][ T5849] bch2_bkey_val_validate+0x202/0x3e0
[ 103.960590][ T5849] ? __pfx_bch2_bkey_val_validate+0x10/0x10
[ 103.960621][ T5849] ? __asan_memset+0x22/0x50
[ 103.960644][ T5849] ? __bch2_bkey_unpack_key+0x98b/0xe10
[ 103.960673][ T5849] bch2_btree_node_read_done+0x4051/0x5550
[ 103.960758][ T5849] ? __pfx_bch2_btree_node_read_done+0x10/0x10
[ 103.960805][ T5849] ? bch2_extent_ptr_to_text+0x5a/0x890
[ 103.960845][ T5849] ? bch2_bkey_ptrs_to_text+0x1161/0x1310
[ 103.960879][ T5849] ? bch2_printbuf_make_room+0xdb/0x360
[ 103.960909][ T5849] ? enumerated_ref_put+0xbe/0x270
[ 103.960955][ T5849] btree_node_read_work+0x40e/0xe60
[ 103.961004][ T5849] ? __pfx_btree_node_read_work+0x10/0x10
[ 103.961033][ T5849] ? bch2_latency_acct+0x436/0x520
[ 103.961081][ T5849] ? __pfx_bch2_latency_acct+0x10/0x10
[ 103.961117][ T5849] ? bio_associate_blkg+0x6d/0x230
[ 103.961154][ T5849] bch2_btree_node_read+0x887/0x2a00
[ 103.961196][ T5849] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.961219][ T5849] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 103.961243][ T5849] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 103.961264][ T5849] ? __bch2_btree_node_hash_insert+0x142d/0x1ab0
[ 103.961344][ T5849] ? __pfx_bch2_btree_node_read+0x10/0x10
[ 103.961377][ T5849] ? bch2_trans_unlock+0x8a/0x580
[ 103.961417][ T5849] ? bch2_trans_unlock+0x491/0x580
[ 103.961464][ T5849] bch2_btree_root_read+0x5f0/0x760
[ 103.961500][ T5849] ? __pfx_bch2_btree_root_read+0x10/0x10
[ 103.961543][ T5849] ? bch2_current_has_btree_trans+0x169/0x1a0
[ 103.961573][ T5849] read_btree_roots+0x2c6/0x840
[ 103.961615][ T5849] ? __pfx_read_btree_roots+0x10/0x10
[ 103.961666][ T5849] bch2_fs_recovery+0x261f/0x3a50
[ 103.961718][ T5849] ? __pfx_bch2_fs_recovery+0x10/0x10
[ 103.961848][ T5849] ? lockdep_unlock+0x89/0x120
[ 103.961875][ T5849] ? validate_chain+0x897/0x2140
[ 103.961920][ T5849] ? __lock_acquire+0xab9/0xd20
[ 103.961960][ T5849] ? do_raw_spin_lock+0x121/0x290
[ 103.961990][ T5849] ? _raw_spin_unlock_irqrestore+0x85/0x110
[ 103.962009][ T5849] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.962027][ T5849] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 103.962045][ T5849] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[ 103.962079][ T5849] ? do_raw_spin_lock+0x121/0x290
[ 103.962105][ T5849] ? rt_mutex_slowunlock+0x493/0x8a0
[ 103.962125][ T5849] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.962143][ T5849] ? _raw_spin_unlock_irqrestore+0xad/0x110
[ 103.962160][ T5849] ? __pfx_rt_mutex_slowunlock+0x10/0x10
[ 103.962185][ T5849] ? bch2_fs_start+0xa0f/0xda0
[ 103.962207][ T5849] bch2_fs_start+0xaaf/0xda0
[ 103.962225][ T5849] ? bch2_fs_start+0x5e7/0xda0
[ 103.962243][ T5849] ? __pfx_bch2_fs_start+0x10/0x10
[ 103.962276][ T5849] ? sget+0x267/0x620
[ 103.962300][ T5849] bch2_fs_get_tree+0xb39/0x1520
[ 103.962353][ T5849] ? __pfx_bch2_fs_get_tree+0x10/0x10
[ 103.962409][ T5849] ? __pfx_vfs_parse_comma_sep+0x10/0x10
[ 103.962440][ T5849] ? rcu_is_watching+0x15/0xb0
[ 103.962472][ T5849] ? cap_capable+0x11f/0x460
[ 103.962502][ T5849] ? safesetid_security_capable+0xa9/0x1a0
[ 103.962538][ T5849] vfs_get_tree+0x92/0x2b0
[ 103.962565][ T5849] do_new_mount+0x2a2/0x9e0
[ 103.962597][ T5849] ? ns_capable+0x8a/0xf0
[ 103.962622][ T5849] ? __pfx_do_new_mount+0x10/0x10
[ 103.962650][ T5849] ? path_mount+0x61c/0xfe0
[ 103.962687][ T5849] __se_sys_mount+0x317/0x410
[ 103.962721][ T5849] ? __pfx___se_sys_mount+0x10/0x10
[ 103.962748][ T5849] ? rcu_is_watching+0x15/0xb0
[ 103.962793][ T5849] ? __x64_sys_mount+0x20/0xc0
[ 103.962822][ T5849] do_syscall_64+0xfa/0x3b0
[ 103.962842][ T5849] ? lockdep_hardirqs_on+0x9c/0x150
[ 103.962861][ T5849] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.962882][ T5849] ? clear_bhb_loop+0x60/0xb0
[ 103.962907][ T5849] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.962928][ T5849] RIP: 0033:0x7f5016bf5eaa
[ 103.962947][ T5849] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 103.962964][ T5849] RSP: 002b:00007ffd552f5c58 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
[ 103.962982][ T5849] RAX: ffffffffffffffda RBX: 00007ffd552f5c70 RCX: 00007f5016bf5eaa
[ 103.962996][ T5849] RDX: 0000200000001000 RSI: 0000200000000000 RDI: 00007ffd552f5c70
[ 103.963009][ T5849] RBP: 0000200000000000 R08: 00007ffd552f5cb0 R09: 000000000000492c
[ 103.963021][ T5849] R10: 0000000000000000 R11: 0000000000000282 R12: 0000200000001000
[ 103.963033][ T5849] R13: 00007ffd552f5cb0 R14: 0000000000000003 R15: 0000000000000000
[ 103.963062][ T5849]
[ 103.963485][ T5849] Kernel Offset: disabled