bcachefs (loop2): stripes_read... done bcachefs (loop2): snapshots_read... done bcachefs (loop2): check_allocations... done bcachefs (loop2): going read-write bcachefs (loop2): journal_replay... BUG: kernel NULL pointer dereference, address: 0000000000000098 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 800000017968b067 P4D 800000017968b067 PUD 10a703067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 UID: 0 PID: 3346 Comm: syz.2.15 Not tainted 6.12.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:btree_path_lock_root fs/bcachefs/btree_iter.c:732 [inline] RIP: 0010:bch2_btree_path_traverse_one+0x38e/0xee0 fs/bcachefs/btree_iter.c:1170 Code: e5 1f 66 83 fd 14 0f 87 82 07 00 00 48 c1 e5 07 48 8d ac 28 58 0f 00 00 48 8b 44 24 38 80 38 00 0f 85 35 0b 00 00 4c 8b 6d 00 <41> 0f b6 85 98 00 00 00 83 e0 07 89 c6 c1 e6 0a 89 d1 81 e1 ff e3 RSP: 0018:ffffc90003836a90 EFLAGS: 00010246 RAX: ffff88810e338402 RBX: ffff88810e3381c8 RCX: ffff88810e338400 RDX: 000000000000110b RSI: 0000000000000004 RDI: ffff88810e338000 RBP: ffff888111a014d8 R08: ffff88810e3381c8 R09: 0000000000000000 R10: 0000000000000000 R11: 818df71900000000 R12: ffff88810e338000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000004 FS: 00007f9bb2e396c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000098 CR3: 00000001087e0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bch2_btree_path_traverse fs/bcachefs/btree_iter.h:247 [inline] __bch2_btree_iter_peek fs/bcachefs/btree_iter.c:2197 [inline] bch2_btree_iter_peek_upto+0x37e/0xfe0 fs/bcachefs/btree_iter.c:2297 bch2_btree_iter_peek_upto_type fs/bcachefs/btree_iter.h:685 [inline] bch2_bucket_alloc_freelist fs/bcachefs/alloc_foreground.c:491 [inline] bch2_bucket_alloc_trans+0x47a/0xf20 fs/bcachefs/alloc_foreground.c:644 bch2_bucket_alloc_set_trans+0x2c7/0x590 fs/bcachefs/alloc_foreground.c:804 __open_bucket_add_buckets+0x6c6/0xa70 fs/bcachefs/alloc_foreground.c:1049 open_bucket_add_buckets+0xe6/0x160 fs/bcachefs/alloc_foreground.c:1093 bch2_alloc_sectors_start_trans+0x590/0xc70 __bch2_btree_node_alloc fs/bcachefs/btree_update_interior.c:343 [inline] bch2_btree_reserve_get+0x318/0x6c0 fs/bcachefs/btree_update_interior.c:554 bch2_btree_update_start+0x5c6/0x810 fs/bcachefs/btree_update_interior.c:1252 bch2_btree_split_leaf+0x4e/0x1f0 fs/bcachefs/btree_update_interior.c:1850 bch2_trans_commit_error+0x20a/0x5d0 fs/bcachefs/btree_trans_commit.c:942 __bch2_trans_commit+0x1b3d/0x1fc0 fs/bcachefs/btree_trans_commit.c:1140 bch2_trans_commit fs/bcachefs/btree_update.h:184 [inline] bch2_journal_replay+0x713/0xbc0 fs/bcachefs/recovery.c:317 bch2_run_recovery_pass fs/bcachefs/recovery_passes.c:185 [inline] bch2_run_recovery_passes+0x14f/0x240 fs/bcachefs/recovery_passes.c:232 bch2_fs_recovery+0xfe2/0x1900 fs/bcachefs/recovery.c:861 bch2_fs_start+0x1b9/0x270 fs/bcachefs/super.c:1037 bch2_fs_get_tree+0x2b5/0x640 fs/bcachefs/fs.c:2080 vfs_get_tree+0x24/0xb0 fs/super.c:1800 do_new_mount+0x15a/0x3a0 fs/namespace.c:3507 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4055 [inline] __se_sys_mount+0x148/0x1b0 fs/namespace.c:4032 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x8d/0x190 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9bb1f7feba Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9bb2e38e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f9bb2e38ef0 RCX: 00007f9bb1f7feba RDX: 00000000200058c0 RSI: 0000000020005900 RDI: 00007f9bb2e38eb0 RBP: 00000000200058c0 R08: 00007f9bb2e38ef0 R09: 0000000000010000 R10: 0000000000010000 R11: 0000000000000246 R12: 0000000020005900 R13: 00007f9bb2e38eb0 R14: 00000000000058e3 R15: 0000000020000000 Modules linked in: CR2: 0000000000000098 ---[ end trace 0000000000000000 ]--- RIP: 0010:btree_path_lock_root fs/bcachefs/btree_iter.c:732 [inline] RIP: 0010:bch2_btree_path_traverse_one+0x38e/0xee0 fs/bcachefs/btree_iter.c:1170 Code: e5 1f 66 83 fd 14 0f 87 82 07 00 00 48 c1 e5 07 48 8d ac 28 58 0f 00 00 48 8b 44 24 38 80 38 00 0f 85 35 0b 00 00 4c 8b 6d 00 <41> 0f b6 85 98 00 00 00 83 e0 07 89 c6 c1 e6 0a 89 d1 81 e1 ff e3 RSP: 0018:ffffc90003836a90 EFLAGS: 00010246 RAX: ffff88810e338402 RBX: ffff88810e3381c8 RCX: ffff88810e338400 RDX: 000000000000110b RSI: 0000000000000004 RDI: ffff88810e338000 RBP: ffff888111a014d8 R08: ffff88810e3381c8 R09: 0000000000000000 R10: 0000000000000000 R11: 818df71900000000 R12: ffff88810e338000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000004 FS: 00007f9bb2e396c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000098 CR3: 00000001087e0000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: e5 1f in $0x1f,%eax 2: 66 83 fd 14 cmp $0x14,%bp 6: 0f 87 82 07 00 00 ja 0x78e c: 48 c1 e5 07 shl $0x7,%rbp 10: 48 8d ac 28 58 0f 00 lea 0xf58(%rax,%rbp,1),%rbp 17: 00 18: 48 8b 44 24 38 mov 0x38(%rsp),%rax 1d: 80 38 00 cmpb $0x0,(%rax) 20: 0f 85 35 0b 00 00 jne 0xb5b 26: 4c 8b 6d 00 mov 0x0(%rbp),%r13 * 2a: 41 0f b6 85 98 00 00 movzbl 0x98(%r13),%eax <-- trapping instruction 31: 00 32: 83 e0 07 and $0x7,%eax 35: 89 c6 mov %eax,%esi 37: c1 e6 0a shl $0xa,%esi 3a: 89 d1 mov %edx,%ecx 3c: 81 .byte 0x81 3d: e1 ff loope 0x3e 3f: e3 .byte 0xe3