Dear Linux maintainers and reviewers:
We are reporting a Linux kernel bug titled **general protection fault in bch2_btree_path_traverse_one**, discovered using a modified version of Syzkaller.
### Affected Files
The affected files, as obtained from the VM log, are listed below. The corresponding maintainers were identified using `./scripts/get_maintainer.pl`:
fs/bcachefs/btree_update_interior.c
fs/bcachefs/alloc_foreground.c
fs/bcachefs/btree_iter.c
fs/bcachefs/btree_trans_commit.c
fs/namespace.c
arch/x86/entry/common.c
fs/bcachefs/recovery.c
fs/bcachefs/recovery_passes.c
fs/bcachefs/super.c
fs/bcachefs/fs.c
fs/super.c
### Kernel Versions
- **Kernel Version Tested:** v6.12-rc6:59b723cd2adbac2a34fc8e12c74ae26ae45bf230
- **Latest Kernel Version Reproduced On:** f44d154d6e3d633d4c49a5d6a8aed0e4684ae25e
### Environment Details
- **QEMU Version:** QEMU emulator version 4.2.1 (Debian 1:4.2-3ubuntu6.29)
- **GCC Version:** gcc (Ubuntu 11.4.0-2ubuntu1~20.04) 11.4.0
- **Syzkaller Version:** 2b3ef1577cde5da4fd1f7ece079731e140351177
### Attached Files
We have attached the following files to assist in reproducing and diagnosing the bug:
- **Bug Title:** `bugtitle`
- **Bug Report:** `report`
- **Machine Information:** `machineInfo`
- **Kernel Config:** `config`
- **Compiled Kernel Image:** `vmlinux`
- **C Reproducing Program:** `repro.c`
- **VM Log for C Reproducer:** `vm_c.log`
- **Syzkaller Reproducing Program:** `repro.txt`
- **VM Log for Syzkaller Reproducer:** `vm_syz.log`
### Reproduction Instructions
To reproduce the bug, please follow the instructions below. For additional details, refer to [Syzkaller Reproducing Crashes Documentation](https://github.com/google/syzkaller/blob/master/docs/reproducing_crashes.md).
Feel free to email us if any other information are needed. Hope the provided materials will help finding and fixing the
bug.
We also provide a brief documentation for how to execute the reproducing program:
#### Prepare the Linux Kernel Image
1. Clone the Linux kernel repository and checkout the latest kernel version:
```bash
cd /path/to/linux
git checkout f44d154d6e3d633d4c49a5d6a8aed0e4684ae25e
cp /path/to/config /path/to/linux/.config
make olddefconfig
make -j$(nproc)
```
#### Prepare the Root Filesystem
Follow the setup instructions at [Setting Up Ubuntu Host QEMU VM](https://github.com/google/syzkaller/blob/master/docs/linux/setup_ubuntu-host_qemu-vm_x86-64-kernel.md). Ensure the root filesystem is prepared at `/path/to/rootfs`.
#### Start the Virtual Machine
Use the following QEMU command to start the VM:
```bash
# start vm
# Here port is set to 10099, change it as needed
qemu-system-x86_64 \
-m 20G -qmp unix:/tmp/qmp-sock,server,nowait \
-smp 2 \
-kernel /path/to/linux/arch/x86/boot/bzImage\
-append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
-drive file=/path/to/rootfs/bullseye.img,format=raw \
-net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10099-:22 \
-net nic,model=e1000 \
-enable-kvm \
-nographic \
-pidfile vm.pid \
2>&1 | tee vm.log
```
#### Reproduce the Bug
- **For C Reproducing Program:**
1. Compile the reproducing program:
```bash
gcc -o repro repro.c
```
2. Transfer the program to the VM and execute it:
```bash
scp -i /path/to/rootfs/bullseye.id_rsa -P 10099 -o "StrictHostKeyChecking no" repro root@localhost:/root/
ssh -i /path/to/rootfs/bullseye.id_rsa -p 10099 -o "StrictHostKeyChecking no" root@localhost
cd /root && ./repro
```
- **For Syzkaller Reproducing Program:**
1. Install Syzkaller ([Setup Guide](https://github.com/google/syzkaller/blob/master/docs/linux/setup.md#go-and-syzkaller)):
```bash
git clone https://github.com/google/syzkaller
cd syzkaller
make
# if make command returns something like `cannot find package "github.com/google/syzkaller/` error, please run the following command, and try again
# go env -w GO111MODULE=on
```
2. Transfer the Syzkaller reproducing program and binary to the VM:
```bash
scp -i /path/to/rootfs/bullseye.id_rsa -P 10099 -o "StrictHostKeyChecking no" -r /path/to/repro.txt root@localhost:/root/
scp -i /path/to/rootfs/bullseye.id_rsa -P 10099 -o "StrictHostKeyChecking no" -r /path/to/syzkaller/bin/linux_amd64/* root@localhost:/root/
ssh -i /path/to/rootfs/bullseye.id_rsa -p 10099 -o "StrictHostKeyChecking no" root@localhost
cd root && ./syz-execprog repro.txt
```
Feel free to reach out if additional information or clarifications are needed. We hope this report aids in identifying and fixing the bug.
Best regards,
Haichi Wang
Tianjin University
Attachment:
vm_syz.log
Description: Binary data
Attachment:
report
Description: Binary data
Attachment:
config
Description: Binary data
Attachment:
machineInfo
Description: Binary data
Attachment:
vm_c.log
Description: Binary data