linux-kernel - WARNING in bch2_dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAHOo4gLPB_crF_TV3zXXNRJ7_DMaS-LGDPwnC0KeEAPA9Ofw+g@mail.gmail.com>
Date: Sun, 6 Apr 2025 10:42:58 +0800
From: Hui Guo <guohui.study@...il.com>
To: Kent Overstreet <kent.overstreet@...ux.dev>, linux-bcachefs@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Cc: syzkaller-bugs@...glegroups.com
Subject: WARNING in bch2_dev_free

Hi Kernel Maintainers,
we found a crash "WARNING in bch2_dev_free" in upstream, the detailed
information is as follows:

HEAD Commit: 9f867ba24d3665d9ac9d9ef1f51844eb4479b291
kernel config: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/9f867ba24d3665d9ac9d9ef1f51844eb4479b291/.config

console output:
https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/9f867ba24d3665d9ac9d9ef1f51844eb4479b291/0a9dd8e75f0f178fec81b7793432b6246c869988/repro.log
repro report: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/9f867ba24d3665d9ac9d9ef1f51844eb4479b291/0a9dd8e75f0f178fec81b7793432b6246c869988/repro.report
syz reproducer:
https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/9f867ba24d3665d9ac9d9ef1f51844eb4479b291/0a9dd8e75f0f178fec81b7793432b6246c869988/repro.prog
c reproducer: https://raw.githubusercontent.com/androidAppGuard/KernelBugs/refs/heads/main/9f867ba24d3665d9ac9d9ef1f51844eb4479b291/0a9dd8e75f0f178fec81b7793432b6246c869988/repro.cprog

Please let me know if there is anything I can help with.
Best,
Hui Guo

This is the report log.
=============================================================================================
------------[ cut here ]------------
WARNING: CPU: 2 PID: 39261 at fs/bcachefs/super.c:1229
bch2_dev_free+0x27b/0x2d0
data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:1229
Modules linked in:
CPU: 2 UID: 0 PID: 39261 Comm: syz.22.217 Not tainted
6.14.0-13408-g9f867ba24d36 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:bch2_dev_free+0x27b/0x2d0
data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:1229
Code: e3 02 89 de e8 76 7c 65 fd 84 db 0f 84 df fe ff ff e9 cd fe ff
ff e8 a4 81 65 fd 90 0f 0b 90 e9 e6 fd ff ff e8 96 81 65 fd 90 <0f> 0b
90 e9 b1 fd ff ff 4c 89 f7 e8 b5 44 c9 fd e9 07 fe ff ff e8
RSP: 0018:ffffc900040ef210 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8453d31c
RDX: ffff88802a070000 RSI: ffffffff8453d56a RDI: 0000000000000001
RBP: ffff8880326c6000 R08: 00000000fffffffc R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880326c60c0
R13: ffffc900040ef368 R14: 0000000000000000 R15: 0000000000000000
FS: 00007fb1a3364640(0000) GS:ffff8880cf059000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc315791fc8 CR3: 0000000040d9c000 CR4: 0000000000350ef0
Call Trace:
<TASK>
__bch2_dev_alloc+0xa56/0xe10
data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:1398
bch2_dev_alloc+0xba/0x170
data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:1424
bch2_fs_alloc+0x1b7d/0x2430
data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:969
bch2_fs_open+0x92c/0x1110
data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/super.c:2219
bch2_fs_get_tree+0x10d0/0x1770
data/ghui/docker_data/linux_kernel/upstream/linux/fs/bcachefs/fs.c:2172
vfs_get_tree+0x93/0x340
data/ghui/docker_data/linux_kernel/upstream/linux/fs/super.c:1759
do_new_mount data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:3879
[inline]
path_mount+0x6b0/0x1eb0
data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4206
do_mount data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4219
[inline]
__do_sys_mount data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4430
[inline]
__se_sys_mount data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4407
[inline]
__x64_sys_mount+0x27b/0x300
data/ghui/docker_data/linux_kernel/upstream/linux/fs/namespace.c:4407
do_syscall_x64 data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/syscall_64.c:63
[inline]
do_syscall_64+0xcb/0x250
data/ghui/docker_data/linux_kernel/upstream/linux/arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb1a259fdfe
Code: 48 c7 c0 ff ff ff ff eb aa e8 5e 20 00 00 66 2e 0f 1f 84 00 00
00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d
01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb1a3363da8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 000000000000fe88 RCX: 00007fb1a259fdfe
RDX: 000000002000fec0 RSI: 000000002000ff00 RDI: 00007fb1a3363e00
RBP: 00007fb1a3363e40 R08: 00007fb1a3363e40 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000002000fec0
R13: 000000002000ff00 R14: 00007fb1a3363e00 R15: 000000002000ff40
</TASK>