[moderation] [bcachefs?] BUG: unable to handle kernel paging request in bch2_btree_cache_scan (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: bf45a62baffc Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=12cac5e2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=bd2356106f507975
dashboard link: https://syzkaller.appspot.com/bug?extid=da827a1a0cf88a0b3a36
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
userspace arch: arm64
CC: [kent.ov...@linux.dev linux-b...@vger.kernel.org linux-...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f0d4874557e9/disk-bf45a62b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0bf44a13b5b2/vmlinux-bf45a62b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/18db8bc9907c/Image-bf45a62b.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+da827a...@syzkaller.appspotmail.com

BTRFS info (device loop3): enabling free space tree
BTRFS info (device loop3): enabling auto defrag
Unable to handle kernel paging request at virtual address fffffdffbf6f10c0
KASAN: maybe wild-memory-access in range [0x0003effdfb788600-0x0003effdfb788607]
Mem abort info:
ESR = 0x0000000096000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000206b5f000
[fffffdffbf6f10c0] pgd=0000000000000000, p4d=100000023ea69403, pud=10000001031ad403, pmd=10000001031ae403, pte=0000000000000000
Internal error: Oops: 0000000096000007 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 7608 Comm: syz.3.168 Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __percpu_add_case_64 arch/arm64/include/asm/percpu.h:127 [inline]
pc : bch2_btree_cache_scan+0x9f4/0xdc4 fs/bcachefs/btree_cache.c:560
lr : bch2_btree_cache_scan+0x984/0xdc4 fs/bcachefs/btree_cache.c:556
sp : ffff8000a52673c0
x29: ffff8000a5267470 x28: dfff800000000000 x27: 1ffff00014a4ced9
x26: ffff8000a52676c8 x25: 0000000000000000 x24: 1fffe0001a06db71
x23: ffff0000d036db80 x22: ffff0000f7b01ce8 x21: ffff0000f7b4b5c0
x20: ffff0000d036db88 x19: 00000000fffbffff x18: 1fffe00033771c88
x17: ffff80008f85e000 x16: ffff80008b065ce0 x15: 0000000000000001
x14: 1ffff00014a4ce60 x13: 0000000000000000 x12: 0000000000000000
x11: ffff700014a4ce61 x10: dfff800000000000 x9 : 0000000000000001
x8 : fffffdffbf6f10c0 x7 : ffff80008283cbc8 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80008b075be8
x2 : 0000000000000001 x1 : 0000000000000008 x0 : 0000000000000001
Call trace:
bch2_btree_cache_scan+0x9f4/0xdc4 fs/bcachefs/btree_cache.c:560 (P)
do_shrink_slab+0x650/0x11b0 mm/shrinker.c:437
shrink_slab+0xc68/0xfb8 mm/shrinker.c:664
drop_slab_node mm/vmscan.c:441 [inline]
drop_slab+0x120/0x248 mm/vmscan.c:459
drop_caches_sysctl_handler+0x170/0x300 fs/drop_caches.c:68
proc_sys_call_handler+0x460/0x7e8 fs/proc/proc_sysctl.c:600
proc_sys_write+0x2c/0x3c fs/proc/proc_sysctl.c:626
do_iter_readv_writev+0x4c0/0x724 fs/read_write.c:-1
vfs_writev+0x29c/0x7cc fs/read_write.c:1057
do_writev+0x128/0x290 fs/read_write.c:1103
__do_sys_writev fs/read_write.c:1171 [inline]
__se_sys_writev fs/read_write.c:1168 [inline]
__arm64_sys_writev+0x80/0x94 fs/read_write.c:1168
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:744
el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:763
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Code: d538d089 8b090108 52800029 91030108 (f829011f)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: d538d089 mrs x9, tpidr_el1
4: 8b090108 add x8, x8, x9
8: 52800029 mov w9, #0x1 // #1
c: 91030108 add x8, x8, #0xc0
* 10: f829011f stadd x9, [x8] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup