[syzbot] [bcachefs?] WARNING in bch2_writepage_io_done (3)
3 views
Skip to first unread message
syzbot
May 1, 2025, 5:53:32 PM5/1/25
to kent.ov...@linux.dev, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: b4432656b36e Linux 6.15-rc4
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=117c9270580000
kernel config: https://syzkaller.appspot.com/x/.config?x=714654674710be70
dashboard link: https://syzkaller.appspot.com/bug?extid=0652cd10dc5ea0a2eb6f
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-b4432656.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/11ce2d7fde6b/vmlinux-b4432656.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8bb54830a28f/bzImage-b4432656.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0652cd...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5337 at fs/bcachefs/fs-io-buffered.c:464 bch2_writepage_io_done+0x765/0x800 fs/bcachefs/fs-io-buffered.c:464
Modules linked in:
CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted 6.15.0-rc4-syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:bch2_writepage_io_done+0x765/0x800 fs/bcachefs/fs-io-buffered.c:464
Code: 0e 48 3b 84 24 80 00 00 00 75 72 4c 89 f7 48 81 c4 88 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 61 c6 61 00 e8 1c 7d 8b fd 90 <0f> 0b 90 42 80 3c 3b 00 74 08 4c 89 ef e8 09 72 ed fd 4d 8b 65 00
RSP: 0018:ffffc9000d637300 EFLAGS: 00010283
RAX: ffffffff843441b4 RBX: 1ffff11007d7402c RCX: 0000000000100000
RDX: ffffc9000efa4000 RSI: 000000000000183d RDI: 000000000000183e
RBP: 0000000000000008 R08: ffff88801e108303 R09: 1ffff11003c21060
R10: dffffc0000000000 R11: ffffed1003c21061 R12: 0000000000000008
R13: ffff88803eba0160 R14: ffff88803eba0368 R15: dffffc0000000000
FS: 00007fa079ff56c0(0000) GS:ffff88808d6cc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa0797d1fc8 CR3: 000000004210c000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bch2_write_data_inline fs/bcachefs/io_write.c:1611 [inline]
bch2_write+0xb8d/0x11e0 fs/bcachefs/io_write.c:1677
closure_queue include/linux/closure.h:270 [inline]
closure_call include/linux/closure.h:432 [inline]
bch2_writepage_do_io fs/bcachefs/fs-io-buffered.c:494 [inline]
bch2_writepages+0x269/0x360 fs/bcachefs/fs-io-buffered.c:677
do_writepages+0x3ae/0x7b0 mm/page-writeback.c:2656
filemap_fdatawrite_wbc mm/filemap.c:386 [inline]
__filemap_fdatawrite_range mm/filemap.c:419 [inline]
filemap_write_and_wait_range+0x217/0x310 mm/filemap.c:691
bchfs_truncate+0x6a8/0xb70 fs/bcachefs/fs-io.c:-1
notify_change+0xb33/0xe40 fs/attr.c:552
do_truncate+0x19a/0x220 fs/open.c:65
do_ftruncate+0x489/0x540 fs/open.c:192
do_sys_ftruncate fs/open.c:207 [inline]
__do_sys_ftruncate fs/open.c:212 [inline]
__se_sys_ftruncate fs/open.c:210 [inline]
__x64_sys_ftruncate+0x92/0xf0 fs/open.c:210
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa07db8e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa079ff5038 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
RAX: ffffffffffffffda RBX: 00007fa07ddb6160 RCX: 00007fa07db8e969
RDX: 0000000000000000 RSI: 00000000000081fd RDI: 0000000000000008
RBP: 00007fa07dc10ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fa07ddb6160 R15: 00007ffe9ece0348
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: b4432656b36e Linux 6.15-rc4
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=117c9270580000
kernel config: https://syzkaller.appspot.com/x/.config?x=714654674710be70
dashboard link: https://syzkaller.appspot.com/bug?extid=0652cd10dc5ea0a2eb6f
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7feb34a89c2a/non_bootable_disk-b4432656.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/11ce2d7fde6b/vmlinux-b4432656.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8bb54830a28f/bzImage-b4432656.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0652cd...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5337 at fs/bcachefs/fs-io-buffered.c:464 bch2_writepage_io_done+0x765/0x800 fs/bcachefs/fs-io-buffered.c:464
Modules linked in:
CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted 6.15.0-rc4-syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:bch2_writepage_io_done+0x765/0x800 fs/bcachefs/fs-io-buffered.c:464
Code: 0e 48 3b 84 24 80 00 00 00 75 72 4c 89 f7 48 81 c4 88 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 61 c6 61 00 e8 1c 7d 8b fd 90 <0f> 0b 90 42 80 3c 3b 00 74 08 4c 89 ef e8 09 72 ed fd 4d 8b 65 00
RSP: 0018:ffffc9000d637300 EFLAGS: 00010283
RAX: ffffffff843441b4 RBX: 1ffff11007d7402c RCX: 0000000000100000
RDX: ffffc9000efa4000 RSI: 000000000000183d RDI: 000000000000183e
RBP: 0000000000000008 R08: ffff88801e108303 R09: 1ffff11003c21060
R10: dffffc0000000000 R11: ffffed1003c21061 R12: 0000000000000008
R13: ffff88803eba0160 R14: ffff88803eba0368 R15: dffffc0000000000
FS: 00007fa079ff56c0(0000) GS:ffff88808d6cc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa0797d1fc8 CR3: 000000004210c000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
bch2_write_data_inline fs/bcachefs/io_write.c:1611 [inline]
bch2_write+0xb8d/0x11e0 fs/bcachefs/io_write.c:1677
closure_queue include/linux/closure.h:270 [inline]
closure_call include/linux/closure.h:432 [inline]
bch2_writepage_do_io fs/bcachefs/fs-io-buffered.c:494 [inline]
bch2_writepages+0x269/0x360 fs/bcachefs/fs-io-buffered.c:677
do_writepages+0x3ae/0x7b0 mm/page-writeback.c:2656
filemap_fdatawrite_wbc mm/filemap.c:386 [inline]
__filemap_fdatawrite_range mm/filemap.c:419 [inline]
filemap_write_and_wait_range+0x217/0x310 mm/filemap.c:691
bchfs_truncate+0x6a8/0xb70 fs/bcachefs/fs-io.c:-1
notify_change+0xb33/0xe40 fs/attr.c:552
do_truncate+0x19a/0x220 fs/open.c:65
do_ftruncate+0x489/0x540 fs/open.c:192
do_sys_ftruncate fs/open.c:207 [inline]
__do_sys_ftruncate fs/open.c:212 [inline]
__se_sys_ftruncate fs/open.c:210 [inline]
__x64_sys_ftruncate+0x92/0xf0 fs/open.c:210
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa07db8e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa079ff5038 EFLAGS: 00000246 ORIG_RAX: 000000000000004d
RAX: ffffffffffffffda RBX: 00007fa07ddb6160 RCX: 00007fa07db8e969
RDX: 0000000000000000 RSI: 00000000000081fd RDI: 0000000000000008
RBP: 00007fa07dc10ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fa07ddb6160 R15: 00007ffe9ece0348
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jun 4, 2025, 9:20:28 PM6/4/25
to kent.ov...@linux.dev, linux-b...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: d7fa1af5b33e Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15e45282580000
kernel config: https://syzkaller.appspot.com/x/.config?x=89c13de706fbf07a
dashboard link: https://syzkaller.appspot.com/bug?extid=0652cd10dc5ea0a2eb6f
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17d0cc0c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=163a6570580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/da97ad659b2c/disk-d7fa1af5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/659e123552a8/vmlinux-d7fa1af5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6ec5dbf4643e/Image-d7fa1af5.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/f4a821c168d9/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0652cd...@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6501 at fs/bcachefs/fs-io-buffered.c:464 bch2_writepage_io_done+0x6fc/0x7b4 fs/bcachefs/fs-io-buffered.c:464
Modules linked in:
CPU: 1 UID: 0 PID: 6501 Comm: kworker/u9:2 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: bcachefs bch2_write_point_do_index_updates
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : bch2_writepage_io_done+0x6fc/0x7b4 fs/bcachefs/fs-io-buffered.c:464
lr : bch2_writepage_io_done+0x6fc/0x7b4 fs/bcachefs/fs-io-buffered.c:464
sp : ffff8000a4b178d0
x29: ffff8000a4b17940 x28: dfff800000000000 x27: 0000000000000003
x26: ffff0000c9b8d7c8 x25: ffff0000c9b8d7c8 x24: ffff0000ddb80000
x23: ffff0000c9b8d920 x22: 0000000000000008 x21: ffff0000c9b8d940
x20: 1fffe00019371b24 x19: 0000000000000c00 x18: 00000000ffffffff
x17: ffff800092f39000 x16: ffff80008ad27e48 x15: 0000000000000006
x14: 1ffff00014962f21 x13: 0000000000000000 x12: 0000000000000000
x11: ffff700014962f27 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : ffff0000d7f55b80 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff80009308cef8 x4 : 0000000000000008 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000008 x0 : 0000000000000000
Call trace:
bch2_writepage_io_done+0x6fc/0x7b4 fs/bcachefs/fs-io-buffered.c:464 (P)
bch2_write_done+0x2a4/0x914 fs/bcachefs/io_write.c:542
bch2_write_point_do_index_updates+0x7c/0x4f0 fs/bcachefs/io_write.c:708
process_one_work+0x7e8/0x156c kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x958/0xed8 kernel/workqueue.c:3400
kthread+0x5fc/0x75c kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
irq event stamp: 824
hardirqs last enabled at (823): [<ffff80008addfa48>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (823): [<ffff80008addfa48>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (824): [<ffff80008adb9eb8>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:511
softirqs last enabled at (0): [<ffff8000803acfb0>] copy_process+0x112c/0x318c kernel/fork.c:2375
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: d7fa1af5b33e Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=15e45282580000
kernel config: https://syzkaller.appspot.com/x/.config?x=89c13de706fbf07a
dashboard link: https://syzkaller.appspot.com/bug?extid=0652cd10dc5ea0a2eb6f
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17d0cc0c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=163a6570580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/da97ad659b2c/disk-d7fa1af5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/659e123552a8/vmlinux-d7fa1af5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6ec5dbf4643e/Image-d7fa1af5.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/f4a821c168d9/mount_0.gz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0652cd...@syzkaller.appspotmail.com
------------[ cut here ]------------
Modules linked in:
CPU: 1 UID: 0 PID: 6501 Comm: kworker/u9:2 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: bcachefs bch2_write_point_do_index_updates
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : bch2_writepage_io_done+0x6fc/0x7b4 fs/bcachefs/fs-io-buffered.c:464
lr : bch2_writepage_io_done+0x6fc/0x7b4 fs/bcachefs/fs-io-buffered.c:464
sp : ffff8000a4b178d0
x29: ffff8000a4b17940 x28: dfff800000000000 x27: 0000000000000003
x26: ffff0000c9b8d7c8 x25: ffff0000c9b8d7c8 x24: ffff0000ddb80000
x23: ffff0000c9b8d920 x22: 0000000000000008 x21: ffff0000c9b8d940
x20: 1fffe00019371b24 x19: 0000000000000c00 x18: 00000000ffffffff
x17: ffff800092f39000 x16: ffff80008ad27e48 x15: 0000000000000006
x14: 1ffff00014962f21 x13: 0000000000000000 x12: 0000000000000000
x11: ffff700014962f27 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : ffff0000d7f55b80 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff80009308cef8 x4 : 0000000000000008 x3 : 0000000000000020
x2 : 0000000000000008 x1 : 0000000000000008 x0 : 0000000000000000
Call trace:
bch2_writepage_io_done+0x6fc/0x7b4 fs/bcachefs/fs-io-buffered.c:464 (P)
bch2_write_done+0x2a4/0x914 fs/bcachefs/io_write.c:542
bch2_write_point_do_index_updates+0x7c/0x4f0 fs/bcachefs/io_write.c:708
process_one_work+0x7e8/0x156c kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x958/0xed8 kernel/workqueue.c:3400
kthread+0x5fc/0x75c kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
irq event stamp: 824
hardirqs last enabled at (823): [<ffff80008addfa48>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (823): [<ffff80008addfa48>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (824): [<ffff80008adb9eb8>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:511
softirqs last enabled at (0): [<ffff8000803acfb0>] copy_process+0x112c/0x318c kernel/fork.c:2375
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Dec 19, 2025, 4:04:18 AM12/19/25
to syzkall...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages