Re: KASAN: use-after-free Read in poly1305_update_arch

[Eric Biggers]

This is a bcachefs issue.

+linux-bcachefs@xxxxxxxxxxxxxxx

In the future, when fuzzing a filesystem please direct any bugs found directly
to the mailing list for the corresponding filesystem.

On Mon, Mar 24, 2025 at 08:05:29PM +0800, Hui Guo wrote:
> Hi Kernel Maintainers,
> we found a crash "KASAN: use-after-free Read in poly1305_update_arch"
> (it is a KASAN and makes the kernel reboot) in upstream, we also have
> successfully reproduced it manually:
> 
> HEAD Commit: 586de92313fcab8ed84ac5f78f4d2aae2db92c59
> kernel config: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/a29967be967eebf049e89edb14c4edf9991bc929/.config
> 
> console output:
> https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/586de92313fcab8ed84ac5f78f4d2aae2db92c59/f3745555675b1b16c0ddf549fbd72fb975100195/repro.log
> repro report: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/586de92313fcab8ed84ac5f78f4d2aae2db92c59/f3745555675b1b16c0ddf549fbd72fb975100195/repro.report
> syz reproducer:
> https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/586de92313fcab8ed84ac5f78f4d2aae2db92c59/f3745555675b1b16c0ddf549fbd72fb975100195/repro.prog
> c reproducer: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/586de92313fcab8ed84ac5f78f4d2aae2db92c59/f3745555675b1b16c0ddf549fbd72fb975100195/repro.cprog
> 
> Please let me know if there is anything I can help with.
> Best,
> Hui Guo
> 
> 
> This is the crash log I got by reproducing the bug based on the above
> environment，
> I have piped this log through decode_stacktrace.sh to better
> understand the cause of the bug.
> =============================================================================================
> 2025/03/24 11:50:17 parsed 1 programs
> [ 84.317117][ T9599] Adding 124996k swap on ./swap-file. Priority:0
> extents:1 across:124996k
> [ 85.846374][ T60] audit: type=1400 audit(1742817027.690:8): avc:
> denied { execmem } for pid=9615 comm="syz-executor"
> scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> tclass=process permissive=1
> [ 85.970995][ T9653] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
> [ 85.974096][ T9653] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
> [ 85.980118][ T9653] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
> [ 85.997135][ T9653] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
> [ 85.998658][ T9653] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
> [ 86.000139][ T9653] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
> [ 86.273149][ T60] audit: type=1401 audit(1742817028.110:9):
> op=setxattr invalid_context="u:object_r:app_data_file:s0:c512,c768"
> [ 86.464134][ T1151] wlan0: Created IBSS using preconfigured BSSID
> 50:50:50:50:50:50
> [ 86.465682][ T1151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
> [ 86.504503][ T96] wlan1: Created IBSS using preconfigured BSSID
> 50:50:50:50:50:50
> [ 86.505750][ T96] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
> [ 86.526978][ T9637] chnl_net:caif_netlink_parms(): no params data found
> [ 86.589108][ T9637] bridge0: port 1(bridge_slave_0) entered blocking state
> [ 86.590934][ T9637] bridge0: port 1(bridge_slave_0) entered disabled state
> [ 86.591956][ T9637] bridge_slave_0: entered allmulticast mode
> [ 86.593729][ T9637] bridge_slave_0: entered promiscuous mode
> [ 86.596288][ T9637] bridge0: port 2(bridge_slave_1) entered blocking state
> [ 86.597273][ T9637] bridge0: port 2(bridge_slave_1) entered disabled state
> [ 86.598304][ T9637] bridge_slave_1: entered allmulticast mode
> [ 86.599650][ T9637] bridge_slave_1: entered promiscuous mode
> [ 86.625741][ T9637] bond0: (slave bond_slave_0): Enslaving as an
> active interface with an up link
> [ 86.628209][ T9637] bond0: (slave bond_slave_1): Enslaving as an
> active interface with an up link
> [ 86.655584][ T9637] team0: Port device team_slave_0 added
> [ 86.657634][ T9637] team0: Port device team_slave_1 added
> [ 86.688129][ T9637] batman_adv: batadv0: Adding interface: batadv_slave_0
> [ 86.688984][ T9637] batman_adv: batadv0: The MTU of interface
> batadv_slave_0 is too small (1500) to handle the transport of
> batman-adv packets. Packets going over this interface will be
> fragmented on layer2 which could impact the performance. Setting the
> MTU to 1560 would solve the problem.
> [ 86.691855][ T9637] batman_adv: batadv0: Not using interface
> batadv_slave_0 (retrying later): interface not active
> [ 86.696337][ T9637] batman_adv: batadv0: Adding interface: batadv_slave_1
> [ 86.697241][ T9637] batman_adv: batadv0: The MTU of interface
> batadv_slave_1 is too small (1500) to handle the transport of
> batman-adv packets. Packets going over this interface will be
> fragmented on layer2 which could impact the performance. Setting the
> MTU to 1560 would solve the problem.
> [ 86.700500][ T9637] batman_adv: batadv0: Not using interface
> batadv_slave_1 (retrying later): interface not active
> [ 86.739582][ T9637] hsr_slave_0: entered promiscuous mode
> [ 86.740760][ T9637] hsr_slave_1: entered promiscuous mode
> [ 86.870829][ T9637] netdevsim netdevsim7 netdevsim0: renamed from eth0
> [ 86.875475][ T9637] netdevsim netdevsim7 netdevsim1: renamed from eth1
> [ 86.878531][ T9637] netdevsim netdevsim7 netdevsim2: renamed from eth2
> [ 86.881574][ T9637] netdevsim netdevsim7 netdevsim3: renamed from eth3
> [ 86.897919][ T9637] bridge0: port 2(bridge_slave_1) entered blocking state
> [ 86.898935][ T9637] bridge0: port 2(bridge_slave_1) entered forwarding state
> [ 86.900314][ T9637] bridge0: port 1(bridge_slave_0) entered blocking state
> [ 86.901516][ T9637] bridge0: port 1(bridge_slave_0) entered forwarding state
> [ 86.936584][ T9637] 8021q: adding VLAN 0 to HW filter on device bond0
> [ 86.950832][ T96] bridge0: port 1(bridge_slave_0) entered disabled state
> [ 86.955164][ T96] bridge0: port 2(bridge_slave_1) entered disabled state
> [ 86.966527][ T9637] 8021q: adding VLAN 0 to HW filter on device team0
> [ 86.972683][ T3579] bridge0: port 1(bridge_slave_0) entered blocking state
> [ 86.973793][ T3579] bridge0: port 1(bridge_slave_0) entered forwarding state
> [ 86.978878][ T96] bridge0: port 2(bridge_slave_1) entered blocking state
> [ 86.979967][ T96] bridge0: port 2(bridge_slave_1) entered forwarding state
> [ 87.008199][ T9637] hsr0: Slave B (hsr_slave_1) is not up; please
> bring it up to get a fully working HSR network
> [ 87.108957][ T9637] 8021q: adding VLAN 0 to HW filter on device batadv0
> [ 87.256320][ T9637] veth0_vlan: entered promiscuous mode
> [ 87.260969][ T9637] veth1_vlan: entered promiscuous mode
> [ 87.277472][ T9637] veth0_macvtap: entered promiscuous mode
> [ 87.280374][ T9637] veth1_macvtap: entered promiscuous mode
> [ 87.290443][ T9637] batman_adv: batadv0: Interface activated: batadv_slave_0
> [ 87.295969][ T9637] batman_adv: batadv0: Interface activated: batadv_slave_1
> [ 87.299447][ T9637] netdevsim netdevsim7 netdevsim0: set [1, 0] type
> 2 family 0 port 6081 - 0
> [ 87.300756][ T9637] netdevsim netdevsim7 netdevsim1: set [1, 0] type
> 2 family 0 port 6081 - 0
> [ 87.301968][ T9637] netdevsim netdevsim7 netdevsim2: set [1, 0] type
> 2 family 0 port 6081 - 0
> [ 87.304774][ T9637] netdevsim netdevsim7 netdevsim3: set [1, 0] type
> 2 family 0 port 6081 - 0
> 2025/03/24 11:50:29 executed programs: 0
> [ 87.415821][ T85] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
> [ 87.418787][ T85] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
> [ 87.420546][ T85] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
> [ 87.422241][ T85] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
> [ 87.424108][ T85] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
> [ 87.425385][ T85] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
> [ 87.509901][T11019] chnl_net:caif_netlink_parms(): no params data found
> [ 87.563201][T11019] bridge0: port 1(bridge_slave_0) entered blocking state
> [ 87.564637][T11019] bridge0: port 1(bridge_slave_0) entered disabled state
> [ 87.565479][T11019] bridge_slave_0: entered allmulticast mode
> [ 87.566585][T11019] bridge_slave_0: entered promiscuous mode
> [ 87.568503][T11019] bridge0: port 2(bridge_slave_1) entered blocking state
> [ 87.569538][T11019] bridge0: port 2(bridge_slave_1) entered disabled state
> [ 87.570614][T11019] bridge_slave_1: entered allmulticast mode
> [ 87.571860][T11019] bridge_slave_1: entered promiscuous mode
> [ 87.602767][T11019] bond0: (slave bond_slave_0): Enslaving as an
> active interface with an up link
> [ 87.608519][T11019] bond0: (slave bond_slave_1): Enslaving as an
> active interface with an up link
> [ 87.634579][T11019] team0: Port device team_slave_0 added
> [ 87.636573][T11019] team0: Port device team_slave_1 added
> [ 87.660148][T11019] batman_adv: batadv0: Adding interface: batadv_slave_0
> [ 87.661048][T11019] batman_adv: batadv0: The MTU of interface
> batadv_slave_0 is too small (1500) to handle the transport of
> batman-adv packets. Packets going over this interface will be
> fragmented on layer2 which could impact the performance. Setting the
> MTU to 1560 would solve the problem.
> [ 87.665631][T11019] batman_adv: batadv0: Not using interface
> batadv_slave_0 (retrying later): interface not active
> [ 87.667657][T11019] batman_adv: batadv0: Adding interface: batadv_slave_1
> [ 87.668523][T11019] batman_adv: batadv0: The MTU of interface
> batadv_slave_1 is too small (1500) to handle the transport of
> batman-adv packets. Packets going over this interface will be
> fragmented on layer2 which could impact the performance. Setting the
> MTU to 1560 would solve the problem.
> [ 87.671697][T11019] batman_adv: batadv0: Not using interface
> batadv_slave_1 (retrying later): interface not active
> [ 87.717200][T11019] hsr_slave_0: entered promiscuous mode
> [ 87.718492][T11019] hsr_slave_1: entered promiscuous mode
> [ 87.719592][T11019] debugfs: Directory 'hsr0' with parent 'hsr'
> already present!
> [ 87.720959][T11019] Cannot create hsr debugfs directory
> [ 87.827241][T11019] netdevsim netdevsim0 netdevsim0: renamed from eth0
> [ 87.829744][T11019] netdevsim netdevsim0 netdevsim1: renamed from eth1
> [ 87.832224][T11019] netdevsim netdevsim0 netdevsim2: renamed from eth2
> [ 87.835215][T11019] netdevsim netdevsim0 netdevsim3: renamed from eth3
> [ 87.847029][T11019] bridge0: port 2(bridge_slave_1) entered blocking state
> [ 87.847885][T11019] bridge0: port 2(bridge_slave_1) entered forwarding state
> [ 87.848778][T11019] bridge0: port 1(bridge_slave_0) entered blocking state
> [ 87.849602][T11019] bridge0: port 1(bridge_slave_0) entered forwarding state
> [ 87.872807][T11019] 8021q: adding VLAN 0 to HW filter on device bond0
> [ 87.880118][ T13] bridge0: port 1(bridge_slave_0) entered disabled state
> [ 87.883677][ T13] bridge0: port 2(bridge_slave_1) entered disabled state
> [ 87.895124][T11019] 8021q: adding VLAN 0 to HW filter on device team0
> [ 87.900930][ T97] bridge0: port 1(bridge_slave_0) entered blocking state
> [ 87.902120][ T97] bridge0: port 1(bridge_slave_0) entered forwarding state
> [ 87.908002][T11294] bridge0: port 2(bridge_slave_1) entered blocking state
> [ 87.909741][T11294] bridge0: port 2(bridge_slave_1) entered forwarding state
> [ 88.032278][T11019] 8021q: adding VLAN 0 to HW filter on device batadv0
> [ 88.034050][ T85] Bluetooth: hci0: command tx timeout
> [ 88.055135][T11019] veth0_vlan: entered promiscuous mode
> [ 88.059506][T11019] veth1_vlan: entered promiscuous mode
> [ 88.074272][T11019] veth0_macvtap: entered promiscuous mode
> [ 88.077239][T11019] veth1_macvtap: entered promiscuous mode
> [ 88.085062][T11019] batman_adv: The newly added mac address
> (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
> [ 88.086633][T11019] batman_adv: It is strongly recommended to keep
> mac addresses unique to avoid problems!
> [ 88.088956][T11019] batman_adv: batadv0: Interface activated: batadv_slave_0
> [ 88.094524][T11019] batman_adv: The newly added mac address
> (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
> [ 88.095959][T11019] batman_adv: It is strongly recommended to keep
> mac addresses unique to avoid problems!
> [ 88.098273][T11019] batman_adv: batadv0: Interface activated: batadv_slave_1
> [ 88.101977][T11019] netdevsim netdevsim0 netdevsim0: set [1, 0] type
> 2 family 0 port 6081 - 0
> [ 88.104171][T11019] netdevsim netdevsim0 netdevsim1: set [1, 0] type
> 2 family 0 port 6081 - 0
> [ 88.105401][T11019] netdevsim netdevsim0 netdevsim2: set [1, 0] type
> 2 family 0 port 6081 - 0
> [ 88.106599][T11019] netdevsim netdevsim0 netdevsim3: set [1, 0] type
> 2 family 0 port 6081 - 0
> [ 88.140817][ T13] wlan0: Created IBSS using preconfigured BSSID
> 50:50:50:50:50:50
> [ 88.142392][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
> [ 88.155795][ T96] wlan1: Created IBSS using preconfigured BSSID
> 50:50:50:50:50:50
> [ 88.156973][ T96] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
> [ 88.314757][T12039] loop0: detected capacity change from 0 to 32768
> [ 88.346885][T12039] bcachefs (loop0): starting version 1.7:
> mi_btree_bitmap
> opts=metadata_checksum=none,data_checksum=xxhash,nojournal_transaction_names
> [ 88.348824][T12039] bcachefs (loop0): recovering from clean shutdown,
> journal seq 10
> [ 88.349815][T12039] bcachefs (loop0): Doing compatible version
> upgrade from 1.7: mi_btree_bitmap to 1.20: directory_size
> [ 88.349815][T12039] running recovery passes:
> check_allocations,check_extents_to_backpointers,check_inodes
> [ 88.360566][T12039] bcachefs (loop0): error validating btree node on
> loop0 at btree alloc level 0/0
> [ 88.360581][T12039] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0:
> seq 4fe84214937890c3 written 32 min_key POS_MIN durability: 1 ptr:
> 0:26:0 gen 0
> [ 88.360589][T12039] node offset 8/32 bset u64s 375: checksum error,
> type chacha20_poly1305_128: got 5125f248dce6c8583c1006bcb40e6d91
> should be 56f8c5dd15dee062262778682ebef4d2, shutting down
> [ 88.367016][T12039] bcachefs (loop0): inconsistency detected -
> emergency read only at journal seq 10
> [ 88.368285][T12039] bcachefs (loop0): flagging btree alloc lost data
> [ 88.369242][T12039] bcachefs (loop0): running explicit recovery pass
> check_topology (2), currently at recovery_pass_empty (0)
> [ 88.370747][T12039] bcachefs (loop0): running explicit recovery pass
> check_lrus (14), currently at recovery_pass_empty (0)
> [ 88.372157][T12039] bcachefs (loop0): running explicit recovery pass
> check_backpointers_to_extents (16), currently at recovery_pass_empty
> (0)
> [ 88.373924][T12039] bcachefs (loop0): running explicit recovery pass
> check_alloc_info (13), currently at recovery_pass_empty (0)
> [ 88.377400][T12039] error reading btree root btree=alloc level=0:
> btree_node_read_error, fixing
> [ 88.380073][T12039]
> ==================================================================
> [88.381083][T12039] BUG: KASAN: use-after-free in poly1305_update_arch
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:198)
> [ 88.382059][T12039] Read of size 8 at addr ffff8880496c7050 by task
> syz.0.15/12039
> [ 88.383042][T12039]
> [ 88.383346][T12039] CPU: 3 UID: 0 PID: 12039 Comm: syz.0.15 Not
> tainted 6.14.0-rc7-00205-g586de92313fc #1
> [ 88.383357][T12039] Hardware name: QEMU Standard PC (i440FX + PIIX,
> 1996), BIOS 1.15.0-1 04/01/2014
> [ 88.383363][T12039] Call Trace:
> [ 88.383367][T12039] <TASK>
> [88.383371][T12039] dump_stack_lvl
> (/data/ghui/docker_data/linux_kernel/upstream/linux/lib/dump_stack.c:123)
> [88.383385][T12039] print_report
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/report.c:409
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/report.c:521)
> [88.383398][T12039] ? __phys_addr
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/mm/physaddr.c:32
> (discriminator 4))
> [88.383408][T12039] ? poly1305_update_arch
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:198)
> [88.383420][T12039] ? poly1305_update_arch
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:198)
> [88.383432][T12039] kasan_report
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/report.c:636)
> [88.383443][T12039] ? poly1305_update_arch
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:196)
> [88.383455][T12039] ? poly1305_update_arch
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:198)
> [88.383468][T12039] kasan_check_range
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/generic.c:183
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/generic.c:189)
> [88.383481][T12039] __asan_memcpy
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/shadow.c:105)
> [88.383490][T12039] poly1305_update_arch
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:198)
> [88.383503][T12039] crypto_poly1305_update
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:232)
> [88.383515][T12039] bch2_checksum
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/checksum.c:240)
> [88.383527][T12039] ? __pfx_bch2_checksum
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/checksum.c:213)
> [88.383539][T12039] ? rcu_is_watching
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/context_tracking.h:128
> /data/ghui/docker_data/linux_kernel/upstream/linux/kernel/rcu/tree.c:716)
> [88.383550][T12039] ? kfree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/trace/events/kmem.h:94
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/slub.c:4744)
> [88.383566][T12039] ? bch2_journal_seq_is_blacklisted
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/journal_seq_blacklist.c:131)
> [88.383580][T12039] bch2_btree_node_read_done
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1130)
> [88.383598][T12039] ? bch2_bkey_pick_read_device
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/rcupdate.h:347
> /data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/rcupdate.h:880
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/extents.c:173)
> [88.383611][T12039] ? __pfx_bch2_btree_node_read_done
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1009)
> [88.383625][T12039] ? bch2_bkey_pick_read_device
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/extents.c:119)
> [88.383634][T12039] ? __pfx___lock_acquire
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:5079)
> [88.383650][T12039] ? __pfx_bch2_bkey_pick_read_device
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/extents.c:119)
> [88.383661][T12039] ? bch2_mark_io_failure
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/extents.c:61
> (discriminator 2))
> [88.383672][T12039] ? btree_node_read_work
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1357
> (discriminator 1))
> [88.383680][T12039] btree_node_read_work
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1357
> (discriminator 1))
> [88.383688][T12039] ? lockdep_hardirqs_on
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:4470)
> [88.383702][T12039] ? __pfx_btree_node_read_work
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1312)
> [88.383711][T12039] ? bch2_latency_acct
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/io_write.c:66)
> [88.383723][T12039] ? __pfx_bch2_latency_acct
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/io_write.c:66)
> [88.383735][T12039] bch2_btree_node_read
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1748)
> [88.383745][T12039] ? __pfx_bch2_btree_node_read
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1685)
> [88.383753][T12039] ? find_held_lock
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:5341)
> [88.383765][T12039] ? __pfx_lock_release
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:5859)
> [88.383777][T12039] ? __bch2_trans_unlock
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_iter.h:111
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_locking.c:725)
> [88.383787][T12039] ? __pfx_bch2_btree_cache_cmp_fn
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_cache.c:135)
> [88.383799][T12039] bch2_btree_root_read
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/instrumented.h:68
> /data/ghui/docker_data/linux_kernel/upstream/linux/./include/asm-generic/bitops/instrumented-non-atomic.h:141
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_types.h:628
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1791
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1811)
> [88.383808][T12039] ? __pfx___mutex_unlock_slowpath
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/mutex.c:885)
> [88.383820][T12039] ? __pfx_bch2_btree_root_read
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1810)
> [88.383832][T12039] bch2_fs_recovery
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/recovery.c:581
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/recovery.c:928)
> [88.383848][T12039] ? __pfx_bch2_fs_recovery
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/recovery.c:699)
> [88.383863][T12039] ? bch2_get_next_online_dev
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/rcupdate.h:347
> /data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/rcupdate.h:880
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/sb-members.h:157)
> [88.383874][T12039] ? __pfx_lock_release
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:5859)
> [88.383889][T12039] ? bch2_get_next_online_dev
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/sb-members.h:160)
> [88.383900][T12039] ? llist_reverse_order
> (/data/ghui/docker_data/linux_kernel/upstream/linux/lib/llist.c:115)
> [88.383915][T12039] ? __closure_wake_up
> (/data/ghui/docker_data/linux_kernel/upstream/linux/lib/closure.c:89)
> [88.383925][T12039] bch2_fs_start
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:1041)
> [88.383940][T12039] bch2_fs_get_tree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/fs.c:2204)
> [88.383950][T12039] ? __pfx_bch2_fs_get_tree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/fs.c:2160)
> [88.383958][T12039] ? lock_acquire
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:5824)
> [88.383974][T12039] ? rcu_is_watching
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/context_tracking.h:128
> /data/ghui/docker_data/linux_kernel/upstream/linux/kernel/rcu/tree.c:716)
> [88.383986][T12039] ? bpf_lsm_capable
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/lsm_hook_defs.h:44)
> [88.383999][T12039] ? security_capable
> (/data/ghui/docker_data/linux_kernel/upstream/linux/security/security.c:1143
> (discriminator 120))
> [88.384013][T12039] vfs_get_tree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/super.c:1815)
> [88.384027][T12039] path_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3561
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3887)
> [88.384039][T12039] ? kmem_cache_free
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/slub.c:4609
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/slub.c:4711)
> [88.384048][T12039] ? __pfx_path_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3814)
> [88.384060][T12039] ? putname.part.0
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namei.c:297)
> [88.384073][T12039] __x64_sys_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3901
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4111
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4088
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4088)
> [88.384084][T12039] ? __pfx___x64_sys_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4088)
> [88.384097][T12039] do_syscall_64
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/common.c:52
> /data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/common.c:83)
> [88.384109][T12039] entry_SYSCALL_64_after_hwframe
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/entry_64.S:130)
> [ 88.384123][T12039] RIP: 0033:0x7f7c16f9e49e
> [ 88.384131][T12039] Code: 48 c7 c0 ff ff ff ff eb aa e8 5e 20 00 00
> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5
> 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8
> 64 89 01 48
> All code
> ========
> 0: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
> 7: eb aa jmp 0xffffffffffffffb3
> 9: e8 5e 20 00 00 call 0x206c
> e: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
> 15: 00 00 00
> 18: 0f 1f 40 00 nopl 0x0(%rax)
> 1c: f3 0f 1e fa endbr64
> 20: 49 89 ca mov %rcx,%r10
> 23: b8 a5 00 00 00 mov $0xa5,%eax
> 28: 0f 05 syscall
> 2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
> 30: 73 01 jae 0x33
> 32: c3 ret
> 33: 48 c7 c1 a8 ff ff ff mov $0xffffffffffffffa8,%rcx
> 3a: f7 d8 neg %eax
> 3c: 64 89 01 mov %eax,%fs:(%rcx)
> 3f: 48 rex.W
> 
> Code starting with the faulting instruction
> ===========================================
> 0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
> 6: 73 01 jae 0x9
> 8: c3 ret
> 9: 48 c7 c1 a8 ff ff ff mov $0xffffffffffffffa8,%rcx
> 10: f7 d8 neg %eax
> 12: 64 89 01 mov %eax,%fs:(%rcx)
> 15: 48 rex.W
> [ 88.384140][T12039] RSP: 002b:00007f7c17ce4da8 EFLAGS: 00000246
> ORIG_RAX: 00000000000000a5
> [ 88.384149][T12039] RAX: ffffffffffffffda RBX: 00000000000119f4 RCX:
> 00007f7c16f9e49e
> [ 88.384156][T12039] RDX: 0000000020011a00 RSI: 0000000020000000 RDI:
> 00007f7c17ce4e00
> [ 88.384162][T12039] RBP: 00007f7c17ce4e40 R08: 00007f7c17ce4e40 R09:
> 0000000000000000
> [ 88.384167][T12039] R10: 0000000000000000 R11: 0000000000000246 R12:
> 0000000020011a00
> [ 88.384173][T12039] R13: 0000000020000000 R14: 00007f7c17ce4e00 R15:
> 0000000020000100
> [ 88.384195][T12039] </TASK>
> [ 88.384198][T12039]
> [ 88.434820][T12039] The buggy address belongs to the physical page:
> [ 88.435543][T12039] page: refcount:0 mapcount:0
> mapping:0000000000000000 index:0x0 pfn:0x496c7
> [ 88.436519][T12039] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
> [ 88.437336][T12039] raw: 00fff00000000000 0000000000000000
> dead000000000122 0000000000000000
> [ 88.438312][T12039] raw: 0000000000000000 0000000000000000
> 00000000ffffffff 0000000000000000
> [ 88.439298][T12039] page dumped because: kasan: bad access detected
> [ 88.440027][T12039] page_owner tracks the page as freed
> [ 88.440651][T12039] page last allocated via order 5, migratetype
> Reclaimable, gfp_mask
> 0x452cd0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_RECLAIMABLE),
> pid 12039, tgid 12038 (syz.0.15), ts 88328445083, free_ts 88379542461
> [88.443083][T12039] post_alloc_hook
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/page_owner.h:32
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/page_alloc.c:1551)
> [88.443647][T12039] get_page_from_freelist
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/page_alloc.c:1561
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/page_alloc.c:3477)
> [88.444281][T12039] __alloc_frozen_pages_noprof
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/page_alloc.c:4741)
> [88.444952][T12039] __alloc_pages_noprof
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/page_alloc.c:4775)
> [88.445534][T12039] ___kmalloc_large_node
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/slub.c:4232)
> [88.446133][T12039] __kmalloc_large_node_noprof
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./arch/x86/include/asm/bitops.h:417
> /data/ghui/docker_data/linux_kernel/upstream/linux/./include/asm-generic/getorder.h:46
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/slub.c:4268)
> [88.446800][T12039] __kmalloc_node_noprof
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./arch/x86/include/asm/bitops.h:417
> /data/ghui/docker_data/linux_kernel/upstream/linux/./include/asm-generic/getorder.h:46
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/slub.c:4284
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/slub.c:4300)
> [88.447416][T12039] __kvmalloc_node_noprof
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/util.c:668)
> [88.448024][T12039] btree_node_data_alloc.constprop.0
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_cache.c:156)
> [88.448747][T12039] __bch2_btree_node_mem_alloc
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_cache.c:201)
> [88.449392][T12039] bch2_fs_btree_cache_init
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_cache.c:655)
> [88.450026][T12039] bch2_fs_alloc
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:919)
> [88.450582][T12039] bch2_fs_open
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/err.h:116
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:2066)
> [88.451115][T12039] bch2_fs_get_tree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/err.h:116
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/fs.c:2191)
> [88.451702][T12039] vfs_get_tree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/super.c:1815)
> [88.452226][T12039] path_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3561
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3887)
> [ 88.452735][T12039] page last free pid 12039 tgid 12038 stack trace:
> [88.453481][T12039] __free_pages_ok
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/page_owner.h:25
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/page_alloc.c:1127
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/page_alloc.c:1271)
> [88.454058][T12039] __folio_put
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/swap.c:112)
> [88.454577][T12039] kvfree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/util.c:709)
> [88.455012][T12039] bch2_btree_node_read_done
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:111
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1243)
> [88.455689][T12039] btree_node_read_work
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1357
> (discriminator 1))
> [88.456291][T12039] bch2_btree_node_read
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1748)
> [88.456878][T12039] bch2_btree_root_read
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/instrumented.h:68
> /data/ghui/docker_data/linux_kernel/upstream/linux/./include/asm-generic/bitops/instrumented-non-atomic.h:141
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_types.h:628
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1791
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1811)
> [88.457472][T12039] bch2_fs_recovery
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/recovery.c:581
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/recovery.c:928)
> [88.458035][T12039] bch2_fs_start
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:1041)
> [88.458565][T12039] bch2_fs_get_tree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/fs.c:2204)
> [88.459139][T12039] vfs_get_tree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/super.c:1815)
> [88.459647][T12039] path_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3561
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3887)
> [88.460144][T12039] __x64_sys_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3901
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4111
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4088
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4088)
> [88.460722][T12039] do_syscall_64
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/common.c:52
> /data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/common.c:83)
> [88.461243][T12039] entry_SYSCALL_64_after_hwframe
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/entry_64.S:130)
> [ 88.461903][T12039]
> [ 88.462174][T12039] Memory state around the buggy address:
> [ 88.462801][T12039] ffff8880496c6f00: ff ff ff ff ff ff ff ff ff ff
> ff ff ff ff ff ff
> [ 88.463717][T12039] ffff8880496c6f80: ff ff ff ff ff ff ff ff ff ff
> ff ff ff ff ff ff
> [ 88.464735][T12039] >ffff8880496c7000: ff ff ff ff ff ff ff ff ff ff
> ff ff ff ff ff ff
> [ 88.465763][T12039] ^
> [ 88.466619][T12039] ffff8880496c7080: ff ff ff ff ff ff ff ff ff ff
> ff ff ff ff ff ff
> [ 88.467647][T12039] ffff8880496c7100: ff ff ff ff ff ff ff ff ff ff
> ff ff ff ff ff ff
> [ 88.468677][T12039]
> ==================================================================
> [ 88.469819][T12039] Kernel panic - not syncing: KASAN: panic_on_warn set ...
> [ 88.470749][T12039] CPU: 3 UID: 0 PID: 12039 Comm: syz.0.15 Not
> tainted 6.14.0-rc7-00205-g586de92313fc #1
> [ 88.471966][T12039] Hardware name: QEMU Standard PC (i440FX + PIIX,
> 1996), BIOS 1.15.0-1 04/01/2014
> [ 88.473133][T12039] Call Trace:
> 12039] <TASK>[T
> 
> [88.474112][T12039] dump_stack_lvl
> (/data/ghui/docker_data/linux_kernel/upstream/linux/lib/dump_stack.c:124
> (discriminator 7))
> essage f[ 88.474971][Tr12039] panic+0xo6fd/0x7b0
> m sy[ s 8l8.o4g75d6@12s]y[Tzk12a039l]l e ?r mark_held_locks
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:4323)
> at [ M a8r8. 4276440 2]1[1T:125003:9] ? __pfx_panic
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/panic.c:288)
> 70 [ . . 8.8.
> 71 1k2]e[rTn12e0l39] ? irqentry_exit
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/entry/common.c:358)
> :[ [8888..47748566]9[T819]12[039] ? lockdep_hardirqs_on
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:4470)
> T12[ 0 3889.47]86 66K][eTrn12e03l9] p ? check_panic_on_warn
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/panic.c:242)
> ani[ c 8-8.4 7945n4o][tT s12y0n3c9i] check_panic_on_warn
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/panic.c:243)
> ng:[ 8K8A.S4A8N024:9 ][pTa120n3i9]c end_report
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/report.c:227)
> _on[ _ w 8a8r.4n80 97s6]e[Tt12 03.9]. . ? poly1305_update_arch
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:198)
> 
> [88.481811][T12039] kasan_report
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./arch/x86/include/asm/smap.h:52
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/report.c:639)
> [88.482363][T12039] ? poly1305_update_arch
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:196)
> [88.483019][T12039] ? poly1305_update_arch
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:198)
> [88.483664][T12039] kasan_check_range
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/generic.c:183
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/generic.c:189)
> [88.484229][T12039] __asan_memcpy
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/kasan/shadow.c:105)
> [88.484735][T12039] poly1305_update_arch
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:198)
> [88.485333][T12039] crypto_poly1305_update
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/crypto/poly1305_glue.c:232)
> [88.485922][T12039] bch2_checksum
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/checksum.c:240)
> [88.486453][T12039] ? __pfx_bch2_checksum
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/checksum.c:213)
> [88.487035][T12039] ? rcu_is_watching
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/context_tracking.h:128
> /data/ghui/docker_data/linux_kernel/upstream/linux/kernel/rcu/tree.c:716)
> [88.487588][T12039] ? kfree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/trace/events/kmem.h:94
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/slub.c:4744)
> [88.488064][T12039] ? bch2_journal_seq_is_blacklisted
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/journal_seq_blacklist.c:131)
> [88.488806][T12039] bch2_btree_node_read_done
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1130)
> [88.489490][T12039] ? bch2_bkey_pick_read_device
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/rcupdate.h:347
> /data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/rcupdate.h:880
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/extents.c:173)
> [88.490261][T12039] ? __pfx_bch2_btree_node_read_done
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1009)
> [88.491058][T12039] ? bch2_bkey_pick_read_device
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/extents.c:119)
> [88.491835][T12039] ? __pfx___lock_acquire
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:5079)
> [88.492511][T12039] ? __pfx_bch2_bkey_pick_read_device
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/extents.c:119)
> [88.493328][T12039] ? bch2_mark_io_failure
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/extents.c:61
> (discriminator 2))
> [88.494005][T12039] ? btree_node_read_work
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1357
> (discriminator 1))
> [88.494747][T12039] btree_node_read_work
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1357
> (discriminator 1))
> [88.495440][T12039] ? lockdep_hardirqs_on
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:4470)
> [88.496116][T12039] ? __pfx_btree_node_read_work
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1312)
> [88.496858][T12039] ? bch2_latency_acct
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/io_write.c:66)
> [88.497530][T12039] ? __pfx_bch2_latency_acct
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/io_write.c:66)
> [88.498248][T12039] bch2_btree_node_read
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1748)
> [88.498921][T12039] ? __pfx_bch2_btree_node_read
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1685)
> [88.499664][T12039] ? find_held_lock
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:5341)
> [88.500290][T12039] ? __pfx_lock_release
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:5859)
> [88.500940][T12039] ? __bch2_trans_unlock
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_iter.h:111
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_locking.c:725)
> [88.501616][T12039] ? __pfx_bch2_btree_cache_cmp_fn
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_cache.c:135)
> [88.502392][T12039] bch2_btree_root_read
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/instrumented.h:68
> /data/ghui/docker_data/linux_kernel/upstream/linux/./include/asm-generic/bitops/instrumented-non-atomic.h:141
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_types.h:628
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1791
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1811)
> [88.503064][T12039] ? __pfx___mutex_unlock_slowpath
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/mutex.c:885)
> [88.503849][T12039] ? __pfx_bch2_btree_root_read
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/btree_io.c:1810)
> [88.504562][T12039] bch2_fs_recovery
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/recovery.c:581
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/recovery.c:928)
> [88.505228][T12039] ? __pfx_bch2_fs_recovery
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/recovery.c:699)
> [88.505862][T12039] ? bch2_get_next_online_dev
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/rcupdate.h:347
> /data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/rcupdate.h:880
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/sb-members.h:157)
> [88.506608][T12039] ? __pfx_lock_release
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:5859)
> [88.507271][T12039] ? bch2_get_next_online_dev
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/sb-members.h:160)
> [88.508010][T12039] ? llist_reverse_order
> (/data/ghui/docker_data/linux_kernel/upstream/linux/lib/llist.c:115)
> [88.508649][T12039] ? __closure_wake_up
> (/data/ghui/docker_data/linux_kernel/upstream/linux/lib/closure.c:89)
> [88.509258][T12039] bch2_fs_start
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:1041)
> [88.509806][T12039] bch2_fs_get_tree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/fs.c:2204)
> [88.510403][T12039] ? __pfx_bch2_fs_get_tree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/fs.c:2160)
> [88.511023][T12039] ? lock_acquire
> (/data/ghui/docker_data/linux_kernel/upstream/linux/kernel/locking/lockdep.c:5824)
> [88.511565][T12039] ? rcu_is_watching
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/context_tracking.h:128
> /data/ghui/docker_data/linux_kernel/upstream/linux/kernel/rcu/tree.c:716)
> [88.512125][T12039] ? bpf_lsm_capable
> (/data/ghui/docker_data/linux_kernel/upstream/linux/./include/linux/lsm_hook_defs.h:44)
> [88.512683][T12039] ? security_capable
> (/data/ghui/docker_data/linux_kernel/upstream/linux/security/security.c:1143
> (discriminator 120))
> [88.513382][T12039] vfs_get_tree
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/super.c:1815)
> [88.513927][T12039] path_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3561
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3887)
> [88.514518][T12039] ? kmem_cache_free
> (/data/ghui/docker_data/linux_kernel/upstream/linux/mm/slub.c:4609
> /data/ghui/docker_data/linux_kernel/upstream/linux/mm/slub.c:4711)
> [88.515169][T12039] ? __pfx_path_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3814)
> [88.515828][T12039] ? putname.part.0
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namei.c:297)
> [88.516481][T12039] __x64_sys_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3901
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4111
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4088
> /data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4088)
> [88.517116][T12039] ? __pfx___x64_sys_mount
> (/data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4088)
> [88.517828][T12039] do_syscall_64
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/common.c:52
> /data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/common.c:83)
> [88.518441][T12039] entry_SYSCALL_64_after_hwframe
> (/data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/entry_64.S:130)
> [ 88.519229][T12039] RIP: 0033:0x7f7c16f9e49e
> [ 88.519814][T12039] Code: 48 c7 c0 ff ff ff ff eb aa e8 5e 20 00 00
> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5
> 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8
> 64 89 01 48
> All code
> ========
> 0: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
> 7: eb aa jmp 0xffffffffffffffb3
> 9: e8 5e 20 00 00 call 0x206c
> e: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
> 15: 00 00 00
> 18: 0f 1f 40 00 nopl 0x0(%rax)
> 1c: f3 0f 1e fa endbr64
> 20: 49 89 ca mov %rcx,%r10
> 23: b8 a5 00 00 00 mov $0xa5,%eax
> 28: 0f 05 syscall
> 2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
> 30: 73 01 jae 0x33
> 32: c3 ret
> 33: 48 c7 c1 a8 ff ff ff mov $0xffffffffffffffa8,%rcx
> 3a: f7 d8 neg %eax
> 3c: 64 89 01 mov %eax,%fs:(%rcx)
> 3f: 48 rex.W
> 
> Code starting with the faulting instruction
> ===========================================
> 0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
> 6: 73 01 jae 0x9
> 8: c3 ret
> 9: 48 c7 c1 a8 ff ff ff mov $0xffffffffffffffa8,%rcx
> 10: f7 d8 neg %eax
> 12: 64 89 01 mov %eax,%fs:(%rcx)
> 15: 48 rex.W
> [ 88.522326][T12039] RSP: 002b:00007f7c17ce4da8 EFLAGS: 00000246
> ORIG_RAX: 00000000000000a5
> [ 88.523371][T12039] RAX: ffffffffffffffda RBX: 00000000000119f4 RCX:
> 00007f7c16f9e49e
> [ 88.524293][T12039] RDX: 0000000020011a00 RSI: 0000000020000000 RDI:
> 00007f7c17ce4e00
> [ 88.525203][T12039] RBP: 00007f7c17ce4e40 R08: 00007f7c17ce4e40 R09:
> 0000000000000000
> [ 88.526106][T12039] R10: 0000000000000000 R11: 0000000000000246 R12:
> 0000000020011a00
> [ 88.527079][T12039] R13: 0000000020000000 R14: 00007f7c17ce4e00 R15:
> 0000000020000100
> [ 88.528111][T12039] </TASK>
> [ 88.528793][T12039] Kernel Offset: disabled
> [ 88.529305][T12039] Rebooting in 86400 seconds..
> 
> -- 
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@xxxxxxxxxxxxxxxx.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-bugs/CAHOo4gLWAbArwg%2Bw%2BAqqkxGmOFX6cm8Tvy85tb4igN6V7Z9BZQ%40mail.gmail.com.