[syzbot] [bcachefs?] kernel BUG in __bkey_unpack_pos

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 850925a8133c Merge tag '9p-for-6.12-rc5' of https://github..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13772a87980000
kernel config: https://syzkaller.appspot.com/x/.config?x=309bb816d40abc28
dashboard link: https://syzkaller.appspot.com/bug?extid=4d722d3c539d77c7bc82
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=160c44a7980000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120e7e40580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-850925a8.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c831c931f29c/vmlinux-850925a8.xz
kernel image: https://storage.googleapis.com/syzbot-assets/85f584e52a7f/bzImage-850925a8.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/b2e9e371ca38/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4d722d...@syzkaller.appspotmail.com

bcachefs (loop0): accounting_read... done
bcachefs (loop0): alloc_read... done
bcachefs (loop0): stripes_read... done
bcachefs (loop0): snapshots_read...
------------[ cut here ]------------
kernel BUG at fs/bcachefs/bkey.c:297!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5311 Comm: syz-executor213 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__bkey_unpack_pos+0x779/0x790 fs/bcachefs/bkey.c:297
Code: b6 e4 00 e9 ad fb ff ff e8 24 ea 83 fd 48 c7 c7 40 b1 f3 8e 4c 89 e6 48 89 da e8 f2 b5 e4 00 e9 f4 fc ff ff e8 08 ea 83 fd 90 <0f> 0b e8 00 ea 83 fd 90 0f 0b e8 f8 e9 83 fd 90 0f 0b 0f 1f 44 00
RSP: 0018:ffffc9000cdfe360 EFLAGS: 00010293
RAX: ffffffff84110068 RBX: 0000000000000001 RCX: ffff888000d4a440
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
RBP: 0000000000000000 R08: ffffffff8410f998 R09: 0000000000000000
R10: ffffc9000cdfe400 R11: fffff520019bfc82 R12: ffffc9000cdfe400
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffc9000cdfe840
FS: 0000555574f49380(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc52831f40 CR3: 000000004475a000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bkey_unpack_pos_format_checked fs/bcachefs/bkey.h:456 [inline]
__bch2_bkey_cmp_left_packed_format_checked fs/bcachefs/bkey.c:1029 [inline]
__bch2_bkey_cmp_left_packed+0xed/0x790 fs/bcachefs/bkey.c:1049
bkey_cmp_left_packed fs/bcachefs/bkey.h:88 [inline]
bch2_bkey_pack_pos_lossy+0xa08/0x1990 fs/bcachefs/bkey.c:532
bch2_btree_node_iter_init+0x894/0x4280 fs/bcachefs/bset.c:1313
__btree_path_level_init fs/bcachefs/btree_iter.c:615 [inline]
bch2_btree_path_level_init+0x4d2/0x9f0 fs/bcachefs/btree_iter.c:635
btree_path_lock_root fs/bcachefs/btree_iter.c:769 [inline]
bch2_btree_path_traverse_one+0x10de/0x2940 fs/bcachefs/btree_iter.c:1170
bch2_btree_path_traverse fs/bcachefs/btree_iter.h:247 [inline]
__bch2_btree_iter_peek fs/bcachefs/btree_iter.c:2197 [inline]
bch2_btree_iter_peek_upto+0xb58/0x70e0 fs/bcachefs/btree_iter.c:2297
bch2_btree_iter_peek_upto_type fs/bcachefs/btree_iter.h:685 [inline]
bch2_snapshots_read+0x4ac/0x15f0 fs/bcachefs/snapshot.c:1785
bch2_run_recovery_pass+0xf0/0x1e0 fs/bcachefs/recovery_passes.c:185
bch2_run_recovery_passes+0x387/0x870 fs/bcachefs/recovery_passes.c:232
bch2_fs_recovery+0x25cc/0x39c0 fs/bcachefs/recovery.c:862
bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1036
bch2_fs_get_tree+0xd68/0x1710 fs/bcachefs/fs.c:2170
vfs_get_tree+0x90/0x2b0 fs/super.c:1800
do_new_mount+0x2be/0xb40 fs/namespace.c:3507
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4057 [inline]
__se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe43d8e1cba
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff67207cf8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fff67207d10 RCX: 00007fe43d8e1cba
RDX: 00000000200058c0 RSI: 0000000020005900 RDI: 00007fff67207d10
RBP: 0000000000000004 R08: 00007fff67207d50 R09: 0000000000005946
R10: 0000000001000000 R11: 0000000000000282 R12: 0000000001000000
R13: 00007fff67207d50 R14: 0000000000000003 R15: 0000000001000000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__bkey_unpack_pos+0x779/0x790 fs/bcachefs/bkey.c:297
Code: b6 e4 00 e9 ad fb ff ff e8 24 ea 83 fd 48 c7 c7 40 b1 f3 8e 4c 89 e6 48 89 da e8 f2 b5 e4 00 e9 f4 fc ff ff e8 08 ea 83 fd 90 <0f> 0b e8 00 ea 83 fd 90 0f 0b e8 f8 e9 83 fd 90 0f 0b 0f 1f 44 00
RSP: 0018:ffffc9000cdfe360 EFLAGS: 00010293
RAX: ffffffff84110068 RBX: 0000000000000001 RCX: ffff888000d4a440
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
RBP: 0000000000000000 R08: ffffffff8410f998 R09: 0000000000000000
R10: ffffc9000cdfe400 R11: fffff520019bfc82 R12: ffffc9000cdfe400
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffc9000cdfe840
FS: 0000555574f49380(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc52831f40 CR3: 000000004475a000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Kent Overstreet]

#syz test

commit ebd089435e043938bab81d6810ab43505adb8fb3
Author: Kent Overstreet <kent.ov...@linux.dev>
Date: Thu Oct 31 02:36:21 2024 -0400

bcachefs: Ancient versions with bad bkey_formats are no longer supported

Syzbot found an assertion pop, by generating an ancient filesystem
version with an invalid bkey_format (with fields that can overflow) as
well as packed keys that aren't representable unpacked.

This breaks key comparisons in all sorts of painful ways.

Filesystems have been automatically rewriting nodes with such invalid
formats for years; we can safely drop support for them.

Reported-by: syzbot+8a0109...@syzkaller.appspotmail.com
Signed-off-by: Kent Overstreet <kent.ov...@linux.dev>

diff --git a/fs/bcachefs/bkey.c b/fs/bcachefs/bkey.c
index 587d7318a2e8..995ba32e9b6e 100644
--- a/fs/bcachefs/bkey.c
+++ b/fs/bcachefs/bkey.c
@@ -643,7 +643,7 @@ int bch2_bkey_format_invalid(struct bch_fs *c,
enum bch_validate_flags flags,
struct printbuf *err)
{
- unsigned i, bits = KEY_PACKED_BITS_START;
+ unsigned bits = KEY_PACKED_BITS_START;

if (f->nr_fields != BKEY_NR_FIELDS) {
prt_printf(err, "incorrect number of fields: got %u, should be %u",
@@ -655,9 +655,8 @@ int bch2_bkey_format_invalid(struct bch_fs *c,
* Verify that the packed format can't represent fields larger than the
* unpacked format:
*/
- for (i = 0; i < f->nr_fields; i++) {
- if ((!c || c->sb.version_min >= bcachefs_metadata_version_snapshot) &&
- bch2_bkey_format_field_overflows(f, i)) {
+ for (unsigned i = 0; i < f->nr_fields; i++) {
+ if (bch2_bkey_format_field_overflows(f, i)) {
unsigned unpacked_bits = bch2_bkey_format_current.bits_per_field[i];
u64 unpacked_max = ~((~0ULL << 1) << (unpacked_bits - 1));
unsigned packed_bits = min(64, f->bits_per_field[i]);

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in __bkey_unpack_pos

bcachefs (loop0): accounting_read... done
bcachefs (loop0): alloc_read... done
bcachefs (loop0): stripes_read... done
bcachefs (loop0): snapshots_read...
------------[ cut here ]------------
kernel BUG at fs/bcachefs/bkey.c:297!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI

CPU: 0 UID: 0 PID: 5828 Comm: syz.0.15 Not tainted 6.12.0-rc5-syzkaller-g0fc810ae3ae1-dirty #0

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__bkey_unpack_pos+0x779/0x790 fs/bcachefs/bkey.c:297

Code: b4 e4 00 e9 ad fb ff ff e8 e4 df 83 fd 48 c7 c7 c0 b2 f3 8e 4c 89 e6 48 89 da e8 c2 b4 e4 00 e9 f4 fc ff ff e8 c8 df 83 fd 90 <0f> 0b e8 c0 df 83 fd 90 0f 0b e8 b8 df 83 fd 90 0f 0b 0f 1f 44 00
RSP: 0018:ffffc9000cc6e360 EFLAGS: 00010293
RAX: ffffffff8410fa58 RBX: 0000000000000001 RCX: ffff888000b48000

RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006

RBP: 0000000000000000 R08: ffffffff8410f388 R09: 0000000000000000
R10: ffffc9000cc6e400 R11: fffff5200198dc82 R12: ffffc9000cc6e400
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffc9000cc6e840
FS: 00007fcbcb3da6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055d92780f000 CR3: 000000004e52e000 CR4: 0000000000352ef0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bkey_unpack_pos_format_checked fs/bcachefs/bkey.h:456 [inline]

__bch2_bkey_cmp_left_packed_format_checked fs/bcachefs/bkey.c:1028 [inline]
__bch2_bkey_cmp_left_packed+0xed/0x790 fs/bcachefs/bkey.c:1048

RIP: 0033:0x7fcbca57feba
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcbcb3d9e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fcbcb3d9ef0 RCX: 00007fcbca57feba
RDX: 00000000200058c0 RSI: 0000000020005900 RDI: 00007fcbcb3d9eb0
RBP: 00000000200058c0 R08: 00007fcbcb3d9ef0 R09: 0000000001000000
R10: 0000000001000000 R11: 0000000000000246 R12: 0000000020005900
R13: 00007fcbcb3d9eb0 R14: 000000000000594c R15: 0000000020000280

</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__bkey_unpack_pos+0x779/0x790 fs/bcachefs/bkey.c:297

Code: b4 e4 00 e9 ad fb ff ff e8 e4 df 83 fd 48 c7 c7 c0 b2 f3 8e 4c 89 e6 48 89 da e8 c2 b4 e4 00 e9 f4 fc ff ff e8 c8 df 83 fd 90 <0f> 0b e8 c0 df 83 fd 90 0f 0b e8 b8 df 83 fd 90 0f 0b 0f 1f 44 00
RSP: 0018:ffffc9000cc6e360 EFLAGS: 00010293
RAX: ffffffff8410fa58 RBX: 0000000000000001 RCX: ffff888000b48000

RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006

RBP: 0000000000000000 R08: ffffffff8410f388 R09: 0000000000000000
R10: ffffc9000cc6e400 R11: fffff5200198dc82 R12: ffffc9000cc6e400
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffc9000cc6e840
FS: 00007fcbcb3da6c0(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055d92780f000 CR3: 000000004e52e000 CR4: 0000000000352ef0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Tested on:

commit: 0fc810ae x86/uaccess: Avoid barrier_nospec() in 64-bit..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16942e87980000
kernel config: https://syzkaller.appspot.com/x/.config?x=4aec7739e14231a7

dashboard link: https://syzkaller.appspot.com/bug?extid=4d722d3c539d77c7bc82
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=11afc630580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject:
Author: kent.ov...@linux.dev

#syz fix: bcachefs: Fix validate_bset() repair path