program: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f0000000180)={"9c6b0693", 0x8bb9, 0xf, 0x2, 0x3, 0xc, "6d4f527e27f93b00e079cdcf02e091", '\x00', "008000", "0000d300", ["7e1524900700", "791651a7d8736002190359f7", '\x00', "d800"]}) sendfile(r1, r1, 0x0, 0xc) r3 = openat$cgroup_procs(r0, &(0x7f0000000240)='cgroup.procs\x00', 0x2, 0x0) syz_mount_image$bcachefs(&(0x7f00000058c0), &(0x7f0000005900)='./file0\x00', 0x1000040, &(0x7f0000000140)={[{@errors_continue}], [{@smackfshat={'smackfshat', 0x3d, '2\x96\xe2\f\xc6\xf2\b\\I\xe1\xbfN9\xec*\xb8\xbf\xe2\xcb\x13(\x89\x1d\nX:\x96?\x81\xa7a\x97\x84\x8e\xb9\xdd\xd5\'N\xe5\x8e\x03\x01\xecC\xaf\xf3\xa9\xf2K\xf5\xd9u\xfc\xb3^5\xd1kl\x92\x82\x8e\xc7\x9fi\xa1\xf0\x8e\xe1\xe08\x15\x17\x8cr\xf6\x1b'}}, {@obj_type={'obj_type', 0x3d, '(\xaa)#!'}}, {@smackfsroot={'smackfsroot', 0x3d, '&\xeb\xa2\x16 u64s 17 type inode_v3 0:4097:U32_MAX len 0 ver 0, fixing [ 70.216973][ T5327] bcachefs (loop0): bcachefs (loop0): error validating btree node at btree inodes level 0/0 [ 70.216988][ T5327] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 [ 70.216997][ T5327] node offset 16/24 bset u64s 110 bset byte offset 536: bad k->u64s 0 (min 3 max 253), fixing [ 70.232317][ T5327] bcachefs (loop0): bcachefs (loop0): error validating btree node at btree inodes level 0/0 [ 70.232338][ T5327] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 [ 70.232347][ T5327] node offset 16/24 bset u64s 99 bset byte offset 696: key extends past end of bset, fixing [ 70.247895][ T5327] bcachefs (loop0): invalid bkey in btree_node btree=inodes level=0: u64s 18 type inode_v3 0:4098:U32_MAX len 0 ver 0: (unpack error) [ 70.247912][ T5327] invalid variable length fields, deleting [ 70.258214][ T5327] bcachefs (loop0): invalid bkey in btree_node btree=inodes level=0: u64s 16 type inode_v3 0:3940649673953280:U32_MAX len 0 ver 0: (unpack error) [ 70.258232][ T5327] invalid variable length fields, deleting [ 70.269895][ T5327] bcachefs (loop0): btree_node_read_work: rewriting btree node at due to error [ 70.269895][ T5327] btree=inodes level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 [ 70.281941][ T5327] bcachefs (loop0): invalid bkey in btree_node btree=dirents level=0: u64s 7 type dirent 4098:5675548428000973578:U32_MAX len 0 ver 0: -> 25895697857384452 type unknown [ 70.281958][ T5327] dirent has stray data after name's NUL, deleting [ 70.294633][ T5327] bcachefs (loop0): running explicit recovery pass check_topology (2), currently at recovery_pass_empty (0) [ 70.300398][ T5327] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree alloc level 0/0 [ 70.300416][ T5327] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 70.300427][ T5327] node offset 0/24 bset u64s 0: invalid bkey format: field 4 too large: 0 + 72057594037927936 > 4294967295 [ 70.300435][ T5327] u64s 3 fields 64:0, 64:0, 32:0, 0:0, 0:72057594037927936, 0:0, btree topology error: [ 70.322894][ T5327] bcachefs (loop0): flagging btree alloc lost data [ 70.325853][ T5327] bcachefs (loop0): running explicit recovery pass check_lrus (14), currently at recovery_pass_empty (0) [ 70.331307][ T5327] bcachefs (loop0): running explicit recovery pass check_backpointers_to_extents (16), currently at recovery_pass_empty (0) [ 70.336480][ T5327] bcachefs (loop0): running explicit recovery pass check_alloc_info (13), currently at recovery_pass_empty (0) [ 70.343715][ T5327] bcachefs (loop0): error reading btree root btree=alloc level=0: btree_node_read_error, fixing [ 70.350970][ T5327] bcachefs (loop0): bcachefs (loop0): error validating btree node on loop0 at btree snapshots level 0/0 [ 70.350985][ T5327] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ebb8d5a9e3463bdb written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0 [ 70.350993][ T5327] node offset 0/16 bset u64s 0: incorrect max key U64_MAX:U64_MAX:4278583295, btree topology error: [ 70.365178][ T5327] bcachefs (loop0): flagging btree snapshots lost data [ 70.367785][ T5327] bcachefs (loop0): running explicit recovery pass scan_for_btree_nodes (1), currently at recovery_pass_empty (0) [ 70.376564][ T5327] bcachefs (loop0): error reading btree root btree=snapshots level=0: btree_node_read_error, fixing [ 70.388959][ T5327] bcachefs (loop0): scan_for_btree_nodes... [ 70.392113][ T5327] bcachefs (loop0): btree node scan found 3 nodes after overwrites [ 70.397750][ T5327] done [ 70.400356][ T5327] bcachefs (loop0): check_topology... [ 70.401757][ T5327] bcachefs (loop0): btree root snapshots unreadable, must recover from scan [ 70.407514][ T5327] bcachefs (loop0): no nodes found for btree snapshots, continuing [ 70.411921][ T5327] done [ 70.413542][ T5327] bcachefs (loop0): accounting_read... done [ 70.416447][ T5327] bcachefs (loop0): alloc_read... done [ 70.418765][ T5327] bcachefs (loop0): snapshots_read... [ 70.419985][ T5327] bcachefs (loop0): running explicit recovery pass reconstruct_snapshots (21), currently at snapshots_read (7) [ 70.426655][ T5327] done [ 70.427807][ T5327] bcachefs (loop0): check_allocations... [ 70.432275][ T5327] bcachefs (loop0): bucket 0:34 data type user ptr gen 0 missing in alloc btree [ 70.432294][ T5327] while marking u64s 7 type extent 4099:8:U32_MAX len 8 ver 0: durability: 1 crc: c_size 8 size 8 offset 0 nonce 0 csum none 0:0 compress incompressible ptr: 0:34:0 gen 0, fixing [ 70.446779][ T5327] bcachefs (loop0): bucket 0:27 data type btree ptr gen 0 missing in alloc btree [ 70.446794][ T5327] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c6c25c03258c59c5 written 16 min_key POS_MIN durability: 1 ptr: 0:27:0 gen 0, fixing [ 70.457781][ T5327] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI [ 70.462362][ T5327] KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] [ 70.465548][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted 6.15.0-rc1-syzkaller-00060-ga24588245776 #0 PREEMPT(full) [ 70.469569][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 70.473289][ T5327] RIP: 0010:bch2_snapshot_tree_oldest_subvol+0x1d3/0x6a0 [ 70.475909][ T5327] Code: e6 e8 f1 ba 36 fd 4c 39 e5 0f 86 c9 03 00 00 e8 83 b8 36 fd 49 6b c4 38 49 01 c6 49 83 c6 18 49 83 c6 20 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 c6 03 00 00 41 8b 2e 31 ff 89 ee e8 94 [ 70.487410][ T5327] RSP: 0018:ffffc9000d5be040 EFLAGS: 00010202 [ 70.489791][ T5327] RAX: 0000000000000004 RBX: 0000000000000001 RCX: 0000000000100000 [ 70.492727][ T5327] RDX: ffffc9000df7a000 RSI: 00000000000885b0 RDI: 00000000000885b1 [ 70.495734][ T5327] RBP: ffffffff848cab5b R08: ffffffff848cac89 R09: 0000000000000000 [ 70.498746][ T5327] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffeb487f [ 70.501609][ T5327] R13: dffffc0000000000 R14: 0000000000000020 R15: 000000000014b780 [ 70.504842][ T5327] FS: 00007f9138cc46c0(0000) GS:ffff88808c596000(0000) knlGS:0000000000000000 [ 70.508190][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 70.510811][ T5327] CR2: 000055b4277d0048 CR3: 00000000442aa000 CR4: 0000000000352ef0 [ 70.513985][ T5327] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 70.516959][ T5327] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 70.519920][ T5327] Call Trace: [ 70.521366][ T5327] [ 70.522537][ T5327] ? bch2_snapshot_tree_oldest_subvol+0x2b/0x6a0 [ 70.524925][ T5327] bch2_inum_snap_offset_err_msg_trans+0x374/0x680 [ 70.527523][ T5327] ? bch2_inum_snap_offset_err_msg_trans+0xe8/0x680 [ 70.530130][ T5327] ? __pfx_bch2_inum_snap_offset_err_msg_trans+0x10/0x10 [ 70.532815][ T5327] bch2_indirect_extent_missing_error+0x411/0x1290 [ 70.535270][ T5327] ? __pfx_bch2_indirect_extent_missing_error+0x10/0x10 [ 70.537952][ T5327] ? bch2_btree_iter_verify_ret+0x154/0x1630 [ 70.540248][ T5327] ? __asan_memset+0x23/0x50 [ 70.541963][ T5327] ? __bch2_bkey_cmp_left_packed+0x305/0x7a0 [ 70.543901][ T5327] ? __pfx_bch2_btree_iter_verify_ret+0x10/0x10 [ 70.546114][ T5327] __trigger_reflink_p+0x1960/0x1cb0 [ 70.547912][ T5327] ? __pfx___bch2_btree_path_set_pos+0x10/0x10 [ 70.550153][ T5327] ? bch2_btree_path_verify_locks+0x85d/0xb40 [ 70.552361][ T5327] ? bch2_btree_iter_peek_max+0x4caf/0x61a0 [ 70.554691][ T5327] ? bch2_btree_iter_verify_entry_exit+0x37d/0xb60 [ 70.557264][ T5327] ? __pfx___trigger_reflink_p+0x10/0x10 [ 70.559494][ T5327] bch2_trigger_reflink_p+0x299/0x380 [ 70.561564][ T5327] ? __pfx_bch2_trigger_reflink_p+0x10/0x10 [ 70.563885][ T5327] ? gc_pos_set+0x5c2/0x810 [ 70.565731][ T5327] ? gc_pos_set+0x5c2/0x810 [ 70.567545][ T5327] ? bch2_gc_mark_key+0x2f5/0x1170 [ 70.569593][ T5327] ? __pfx_bch2_trigger_reflink_p+0x10/0x10 [ 70.571900][ T5327] bch2_gc_mark_key+0x6b9/0x1170 [ 70.573936][ T5327] ? __pfx_bch2_gc_mark_key+0x10/0x10 [ 70.576043][ T5327] ? gc_pos_set+0x5c2/0x810 [ 70.578206][ T5327] ? bch2_btree_iter_advance+0x373/0x820 [ 70.580552][ T5327] ? bch2_check_allocations+0x13b2/0x6930 [ 70.582807][ T5327] bch2_check_allocations+0x1439/0x6930 [ 70.584961][ T5327] ? this_cpu_in_panic+0x4f/0x80 [ 70.586484][ T5327] ? _prb_read_valid+0xb13/0xbb0 [ 70.588093][ T5327] ? __pfx__prb_read_valid+0x10/0x10 [ 70.589982][ T5327] ? __pfx_data_push_tail+0x10/0x10 [ 70.591893][ T5327] ? __lock_acquire+0xad5/0xd80 [ 70.593742][ T5327] ? record_print_text+0x273/0x430 [ 70.595730][ T5327] ? record_print_text+0x315/0x430 [ 70.597670][ T5327] ? prb_read_valid+0xab/0xf0 [ 70.599576][ T5327] ? __pfx_bch2_check_allocations+0x10/0x10 [ 70.601987][ T5327] ? desc_read+0x1a8/0x400 [ 70.603723][ T5327] ? prb_first_seq+0x133/0x210 [ 70.605558][ T5327] ? __pfx_prb_first_seq+0x10/0x10 [ 70.607549][ T5327] ? this_cpu_in_panic+0x4f/0x80 [ 70.609448][ T5327] ? _prb_read_valid+0xb13/0xbb0 [ 70.611532][ T5327] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 70.614192][ T5327] ? console_flush_all+0xda3/0xec0 [ 70.616237][ T5327] ? up+0x111/0x1c0 [ 70.617851][ T5327] ? bch2_check_allocations+0x121f/0x6930 [ 70.619764][ T5327] ? prb_read_valid+0xab/0xf0 [ 70.621544][ T5327] ? __pfx___console_unlock+0x10/0x10 [ 70.623622][ T5327] ? bch2_check_allocations+0x18ea/0x6930 [ 70.625732][ T5327] ? __lock_acquire+0xad5/0xd80 [ 70.627708][ T5327] ? irq_work_queue+0xd1/0x150 [ 70.629587][ T5327] ? __bch2_print+0x17c/0x220 [ 70.631503][ T5327] ? bch2_run_recovery_pass+0x6d/0x1e0 [ 70.633723][ T5327] ? __pfx___bch2_print+0x10/0x10 [ 70.635675][ T5327] bch2_run_recovery_pass+0xf0/0x1e0 [ 70.637878][ T5327] bch2_run_recovery_passes+0x2ad/0xa90 [ 70.640055][ T5327] bch2_fs_recovery+0x292a/0x3e20 [ 70.642086][ T5327] ? __pfx_bch2_fs_recovery+0x10/0x10 [ 70.644038][ T5327] ? __lock_acquire+0xad5/0xd80 [ 70.645836][ T5327] ? __lock_acquire+0xad5/0xd80 [ 70.647718][ T5327] ? bch2_fs_start+0x279/0x620 [ 70.649448][ T5327] ? up_write+0x1ab/0x590 [ 70.651098][ T5327] ? bch2_get_next_online_dev+0x4ab/0x4e0 [ 70.653281][ T5327] ? bch2_get_next_online_dev+0x2e/0x4e0 [ 70.655368][ T5327] ? __pfx_up_write+0x10/0x10 [ 70.657166][ T5327] ? llist_reverse_order+0x72/0x90 [ 70.659152][ T5327] bch2_fs_start+0x310/0x620 [ 70.660996][ T5327] bch2_fs_get_tree+0x113e/0x18f0 [ 70.662989][ T5327] ? __pfx_bch2_fs_get_tree+0x10/0x10 [ 70.665095][ T5327] ? vfs_parse_monolithic_sep+0x427/0x460 [ 70.667297][ T5327] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 70.669429][ T5327] ? rcu_is_watching+0x15/0xb0 [ 70.671246][ T5327] ? apparmor_capable+0x13b/0x1b0 [ 70.673228][ T5327] vfs_get_tree+0x90/0x2b0 [ 70.674992][ T5327] do_new_mount+0x2cf/0xb70 [ 70.676833][ T5327] ? __pfx_do_new_mount+0x10/0x10 [ 70.678839][ T5327] __se_sys_mount+0x38c/0x400 [ 70.680962][ T5327] ? __pfx___se_sys_mount+0x10/0x10 [ 70.683568][ T5327] ? __x64_sys_mount+0x20/0xc0 [ 70.686042][ T5327] do_syscall_64+0xf3/0x230 [ 70.688445][ T5327] ? clear_bhb_loop+0x45/0xa0 [ 70.690805][ T5327] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.693030][ T5327] RIP: 0033:0x7f9137d8e90a [ 70.694786][ T5327] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 70.702194][ T5327] RSP: 002b:00007f9138cc3e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 70.705464][ T5327] RAX: ffffffffffffffda RBX: 00007f9138cc3ef0 RCX: 00007f9137d8e90a [ 70.708542][ T5327] RDX: 00002000000058c0 RSI: 0000200000005900 RDI: 00007f9138cc3eb0 [ 70.711509][ T5327] RBP: 00002000000058c0 R08: 00007f9138cc3ef0 R09: 0000000001000040 [ 70.714209][ T5327] R10: 0000000001000040 R11: 0000000000000246 R12: 0000200000005900 [ 70.716971][ T5327] R13: 00007f9138cc3eb0 R14: 0000000000005944 R15: 0000200000000140 [ 70.719522][ T5327] [ 70.720805][ T5327] Modules linked in: [ 70.722897][ T5327] ---[ end trace 0000000000000000 ]--- [ 70.735774][ T5327] RIP: 0010:bch2_snapshot_tree_oldest_subvol+0x1d3/0x6a0 [ 70.738553][ T5327] Code: e6 e8 f1 ba 36 fd 4c 39 e5 0f 86 c9 03 00 00 e8 83 b8 36 fd 49 6b c4 38 49 01 c6 49 83 c6 18 49 83 c6 20 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 c6 03 00 00 41 8b 2e 31 ff 89 ee e8 94 [ 70.753713][ T5327] RSP: 0018:ffffc9000d5be040 EFLAGS: 00010202 [ 70.755921][ T5327] RAX: 0000000000000004 RBX: 0000000000000001 RCX: 0000000000100000 [ 70.758865][ T5327] RDX: ffffc9000df7a000 RSI: 00000000000885b0 RDI: 00000000000885b1 [ 70.762338][ T5327] RBP: ffffffff848cab5b R08: ffffffff848cac89 R09: 0000000000000000 [ 70.765738][ T5327] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffeb487f [ 70.769838][ T5327] R13: dffffc0000000000 R14: 0000000000000020 R15: 000000000014b780 [ 70.773006][ T5327] FS: 00007f9138cc46c0(0000) GS:ffff88808c596000(0000) knlGS:0000000000000000 [ 70.776659][ T5327] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 70.780363][ T5327] CR2: 000055b4277d0048 CR3: 00000000442aa000 CR4: 0000000000352ef0 [ 70.783631][ T5327] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 70.786866][ T5327] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 70.790388][ T5327] Kernel panic - not syncing: Fatal exception [ 70.793049][ T5327] Kernel Offset: disabled [ 70.794725][ T5327] Rebooting in 86400 seconds..