[syzbot] [bcachefs?] KMSAN: uninit-value in bch2_btree_node_check_topology

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 7758b206117d Merge tag 'tracefs-v6.12-rc6' of git://git.ke..
git tree: upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=13e72e30580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6fdf74cce377223b
dashboard link: https://syzkaller.appspot.com/bug?extid=494bcd3631a9f6759f91
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13a0df40580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15e1f6a7980000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cff7adedd889/disk-7758b206.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c3babec78429/vmlinux-7758b206.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9de747183951/bzImage-7758b206.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/c2654a9124db/mount_1.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+494bcd...@syzkaller.appspotmail.com

BUG: KMSAN: uninit-value in bch2_btree_node_check_topology+0x12cc/0x2e40 fs/bcachefs/btree_update_interior.c:96
bch2_btree_node_check_topology+0x12cc/0x2e40 fs/bcachefs/btree_update_interior.c:96
btree_split_insert_keys+0x4fd/0x630 fs/bcachefs/btree_update_interior.c:1573
btree_split+0xdc4/0x98e0 fs/bcachefs/btree_update_interior.c:1664
bch2_btree_insert_node+0xaba/0x2810 fs/bcachefs/btree_update_interior.c:1837
bch2_btree_node_rewrite+0x10f8/0x1930 fs/bcachefs/btree_update_interior.c:2164
async_btree_node_rewrite_trans fs/bcachefs/btree_update_interior.c:2230 [inline]
async_btree_node_rewrite_work+0x485/0x1710 fs/bcachefs/btree_update_interior.c:2243
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Uninit was created at:
___kmalloc_large_node+0x22c/0x370 mm/slub.c:4219
__kmalloc_large_node_noprof+0x3f/0x1e0 mm/slub.c:4236
__do_kmalloc_node mm/slub.c:4252 [inline]
__kmalloc_node_noprof+0x9d6/0xf50 mm/slub.c:4270
__kvmalloc_node_noprof+0xc0/0x2d0 mm/util.c:658
btree_node_data_alloc fs/bcachefs/btree_cache.c:125 [inline]
bch2_btree_node_mem_alloc+0xa68/0x2e30 fs/bcachefs/btree_cache.c:807
__bch2_btree_node_alloc fs/bcachefs/btree_update_interior.c:325 [inline]
bch2_btree_reserve_get+0x37f/0x2290 fs/bcachefs/btree_update_interior.c:554
bch2_btree_update_start+0x1af9/0x2d60 fs/bcachefs/btree_update_interior.c:1252
bch2_btree_node_rewrite+0x1da/0x1930 fs/bcachefs/btree_update_interior.c:2142
async_btree_node_rewrite_trans fs/bcachefs/btree_update_interior.c:2230 [inline]
async_btree_node_rewrite_work+0x485/0x1710 fs/bcachefs/btree_update_interior.c:2243
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xae0/0x1c40 kernel/workqueue.c:3310
worker_thread+0xea7/0x14f0 kernel/workqueue.c:3391
kthread+0x3e2/0x540 kernel/kthread.c:389
ret_from_fork+0x6d/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

CPU: 0 UID: 0 PID: 3761 Comm: kworker/u8:13 Not tainted 6.12.0-rc6-syzkaller-00099-g7758b206117d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: btree_node_rewrite async_btree_node_rewrite_work
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Gianfranco Trad]

#syz test

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in __bch2_btree_node_hash_insert

parent: u64s 5 type btree_ptr SPOS_MAX len 0 ver 0
child: u64s 11 type btree_ptr_v2 U64_MAX:18374686479671623680:50331647 len 0 ver 0: seq 2285c34bed0abe32 written 16 min_key POS_MIN durability: 1 ptr: 0:31:0 gen 0, fixing
bcachefs (loop0): bch2_get_scanned_nodes(): recovering xattrs l=0 U64_MAX:18374686479671623680:50331648 - SPOS_MAX
bcachefs (loop0): set_node_max(): u64s 11 type btree_ptr_v2 U64_MAX:18374686479671623680:50331647 len 0 ver 0: seq 2285c34bed0abe32 written 16 min_key POS_MIN durability: 1 ptr: 0:31:0 gen 0 -> SPOS_MAX
------------[ cut here ]------------
kernel BUG at fs/bcachefs/btree_cache.c:280!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 0 UID: 0 PID: 6643 Comm: syz.0.15 Not tainted 6.12.0-rc7-syzkaller-g2d5404caa8c7-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
RIP: 0010:__bch2_btree_node_hash_insert+0x1b3c/0x1b40 fs/bcachefs/btree_cache.c:280
Code: 45 00 00 41 c6 45 08 00 bf 02 00 00 00 e8 2c 23 7c fc 84 db 0f 84 b1 fe ff ff e8 1f 20 7c fc e9 bc ea ff ff e8 15 20 7c fc 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f
RSP: 0018:ffff88803ddceda8 EFLAGS: 00010293
RAX: ffffffff8538d21b RBX: ffff888042706400 RCX: ffff888118faa0c0
RDX: 0000000000000000 RSI: ffff88813fffab40 RDI: ffff8880427065c8
RBP: ffff88803ddceed0 R08: ffffea000000000f R09: 0000000000000058
R10: ffff888041f06520 R11: ffff88803d493180 R12: 0000000000000000
R13: ffff888118faabf8 R14: ffff888043f814f8 R15: ffff8880427065c8
FS: 00007f182314a6c0(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555567677e0 CR3: 000000004261c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
set_node_max+0xa7d/0xb00 fs/bcachefs/btree_gc.c:188
btree_repair_node_end fs/bcachefs/btree_gc.c:299 [inline]
bch2_btree_repair_topology_recurse+0x813d/0x8ac0 fs/bcachefs/btree_gc.c:425
bch2_check_topology+0xa2f/0x1200 fs/bcachefs/btree_gc.c:550
bch2_run_recovery_pass fs/bcachefs/recovery_passes.c:185 [inline]
bch2_run_recovery_passes+0xaf9/0xf80 fs/bcachefs/recovery_passes.c:238
bch2_fs_recovery+0x447b/0x5b00 fs/bcachefs/recovery.c:861
bch2_fs_start+0x7b2/0xbd0 fs/bcachefs/super.c:1036
bch2_fs_get_tree+0x13ea/0x22d0 fs/bcachefs/fs.c:2170
vfs_get_tree+0xb1/0x5a0 fs/super.c:1814
do_new_mount+0x71f/0x15e0 fs/namespace.c:3507
path_mount+0x742/0x1f10 fs/namespace.c:3834
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4057 [inline]
__se_sys_mount+0x722/0x810 fs/namespace.c:4034
__x64_sys_mount+0xe4/0x150 fs/namespace.c:4034
x64_sys_call+0x255a/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:166
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f182237feba
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1823149e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f1823149ef0 RCX: 00007f182237feba
RDX: 0000000020000180 RSI: 0000000020000000 RDI: 00007f1823149eb0
RBP: 0000000020000180 R08: 00007f1823149ef0 R09: 0000000000800008
R10: 0000000000800008 R11: 0000000000000246 R12: 0000000020000000
R13: 00007f1823149eb0 R14: 00000000000059bc R15: 0000000020000300
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__bch2_btree_node_hash_insert+0x1b3c/0x1b40 fs/bcachefs/btree_cache.c:280
Code: 45 00 00 41 c6 45 08 00 bf 02 00 00 00 e8 2c 23 7c fc 84 db 0f 84 b1 fe ff ff e8 1f 20 7c fc e9 bc ea ff ff e8 15 20 7c fc 90 <0f> 0b 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f
RSP: 0018:ffff88803ddceda8 EFLAGS: 00010293
RAX: ffffffff8538d21b RBX: ffff888042706400 RCX: ffff888118faa0c0
RDX: 0000000000000000 RSI: ffff88813fffab40 RDI: ffff8880427065c8
RBP: ffff88803ddceed0 R08: ffffea000000000f R09: 0000000000000058
R10: ffff888041f06520 R11: ffff88803d493180 R12: 0000000000000000
R13: ffff888118faabf8 R14: ffff888043f814f8 R15: ffff8880427065c8
FS: 00007f182314a6c0(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555567677e0 CR3: 000000004261c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


Tested on:

commit: 2d5404ca Linux 6.12-rc7
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14d63ea7980000
kernel config: https://syzkaller.appspot.com/x/.config?x=dcca673786a14715

dashboard link: https://syzkaller.appspot.com/bug?extid=494bcd3631a9f6759f91
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=10f368c0580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject:
Author: kent.ov...@linux.dev

#syz fix bcachefs: Disable asm memcpys when kmsan enabled