live-kbench/live-kbench huggingface dataset:
Kernel bug: KASAN: null-ptr-deref Write in jbd2_journal_update_sb_log_tail
Subsystem: ext4
Status: fixed

Crash report:
(syz-executor198,5100,0):ocfs2_check_volume:2481 ERROR: status = -22
(syz-executor198,5100,0):ocfs2_mount_volume:1821 ERROR: status = -22
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in test_and_set_bit_lock include/asm-generic/bitops/instrumented-lock.h:57 [inline]
BUG: KASAN: null-ptr-deref in trylock_buffer include/linux/buffer_head.h:420 [inline]
BUG: KASAN: null-ptr-deref in lock_buffer include/linux/buffer_head.h:426 [inline]
BUG: KASAN: null-ptr-deref in jbd2_journal_update_sb_log_tail+0x19b/0x360 fs/jbd2/journal.c:1889
Write of size 8 at addr 0000000000000000 by task syz-executor198/5100

CPU: 0 UID: 0 PID: 5100 Comm: syz-executor198 Not tainted 6.11.0-rc3-syzkaller-00338-gc3f2d783a459 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
 print_report+0xe8/0x550 mm/kasan/report.c:491
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 test_and_set_bit_lock include/asm-generic/bitops/instrumented-lock.h:57 [inline]
 trylock_buffer include/linux/buffer_head.h:420 [inline]
 lock_buffer include/linux/buffer_head.h:426 [inline]
 jbd2_journal_update_sb_log_tail+0x19b/0x360 fs/jbd2/journal.c:1889
 __jbd2_update_log_tail+0x48/0x3f0 fs/jbd2/journal.c:1079
 jbd2_cleanup_journal_tail+0x230/0x2d0 fs/jbd2/checkpoint.c:334
 jbd2_journal_flush+0x290/0xc10 fs/jbd2/journal.c:2479
 ocfs2_journal_shutdown+0x443/0xbe0 fs/ocfs2/journal.c:1081
 ocfs2_mount_volume+0x169f/0x1940 fs/ocfs2/super.c:1842
 ocfs2_fill_super+0x483b/0x5880 fs/ocfs2/super.c:1084
 mount_bdev+0x20a/0x2d0 fs/super.c:1679
 legacy_get_tree+0xee/0x190 fs/fs_context.c:662
 vfs_get_tree+0x90/0x2a0 fs/super.c:1800
 do_new_mount+0x2be/0xb40 fs/namespace.c:3472
 do_mount fs/namespace.c:3812 [inline]
 __do_sys_mount fs/namespace.c:4020 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3997
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f69037ad16a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffed646ff58 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffed646ff70 RCX: 00007f69037ad16a
RDX: 0000000020004480 RSI: 00000000200044c0 RDI: 00007ffed646ff70
RBP: 0000000000000004 R08: 00007ffed646ffb0 R09: 0000000000004470
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 00007ffed646ffb0 R14: 0000000000000003 R15: 0000000001000000
 </TASK>
==================================================================
Kernel bug: KMSAN: uninit-value in udf_get_fileshortad
Subsystem: udf
Status: fixed

Crash report:
loop0: detected capacity change from 2048 to 2047
=====================================================
BUG: KMSAN: uninit-value in udf_get_fileshortad+0x174/0x1c0 fs/udf/directory.c:504
 udf_get_fileshortad+0x174/0x1c0 fs/udf/directory.c:504
 udf_current_aext+0x6cb/0x950 fs/udf/inode.c:2225
 udf_next_aext+0x94/0x500 fs/udf/inode.c:2171
 udf_discard_prealloc+0x47c/0x830 fs/udf/truncate.c:135
 udf_release_file+0xfd/0x160 fs/udf/file.c:184
 __fput+0x344/0x1160 fs/file_table.c:422
 __fput_sync+0x74/0x90 fs/file_table.c:507
 __do_sys_close fs/open.c:1566 [inline]
 __se_sys_close+0x290/0x4d0 fs/open.c:1551
 __x64_sys_close+0x48/0x60 fs/open.c:1551
 x64_sys_call+0x2c26/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:4
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:
 __alloc_pages_noprof+0x9d6/0xe70 mm/page_alloc.c:4725
 alloc_pages_mpol_noprof+0x299/0x990 mm/mempolicy.c:2263
 alloc_pages_noprof mm/mempolicy.c:2343 [inline]
 folio_alloc_noprof+0x1db/0x310 mm/mempolicy.c:2350
 filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1008
 __filemap_get_folio+0xa05/0x14b0 mm/filemap.c:1950
 grow_dev_folio fs/buffer.c:1047 [inline]
 grow_buffers fs/buffer.c:1113 [inline]
 __getblk_slow fs/buffer.c:1139 [inline]
 bdev_getblk+0x2c9/0xab0 fs/buffer.c:1441
 __bread_gfp+0x93/0x730 fs/buffer.c:1495
 sb_bread include/linux/buffer_head.h:347 [inline]
 udf_next_aext+0x302/0x500 fs/udf/inode.c:2186
 udf_discard_prealloc+0x47c/0x830 fs/udf/truncate.c:135
 udf_release_file+0xfd/0x160 fs/udf/file.c:184
 __fput+0x344/0x1160 fs/file_table.c:422
 __fput_sync+0x74/0x90 fs/file_table.c:507
 __do_sys_close fs/open.c:1566 [inline]
 __se_sys_close+0x290/0x4d0 fs/open.c:1551
 __x64_sys_close+0x48/0x60 fs/open.c:1551
 x64_sys_call+0x2c26/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:4
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 1 UID: 0 PID: 5181 Comm: syz-executor248 Not tainted 6.11.0-rc7-syzkaller-00149-g0babf683783d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
=====================================================
Kernel bug: UBSAN: shift-out-of-bounds in bch2_stripe_to_text
Subsystem: bcachefs
Status: fixed

Crash report:
bcachefs (loop0): Doing compatible version upgrade from 1.7: mi_btree_bitmap to 1.12: rebalance_work_acct_fix
  running recovery passes: check_allocations
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/bcachefs/ec.c:147:2
shift exponent 108 is too large for 32-bit type 'unsigned int'
CPU: 0 UID: 0 PID: 5088 Comm: syz-executor278 Not tainted 6.11.0-syzkaller-08068-g1ec6d097897a #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
 bch2_stripe_to_text+0x899/0x8c0 fs/bcachefs/ec.c:147
 __bch2_bkey_fsck_err+0x11f/0x230 fs/bcachefs/error.c:429
 bch2_stripe_validate+0x3ca/0x630 fs/bcachefs/ec.c:116
 bch2_btree_node_read_done+0x3dc6/0x5d60 fs/bcachefs/btree_io.c:1219
 btree_node_read_work+0x68b/0x1260 fs/bcachefs/btree_io.c:1323
 bch2_btree_node_read+0x2433/0x2a10
 __bch2_btree_root_read fs/bcachefs/btree_io.c:1749 [inline]
 bch2_btree_root_read+0x626/0x980 fs/bcachefs/btree_io.c:1773
 read_btree_roots+0x296/0x840 fs/bcachefs/recovery.c:523
 bch2_fs_recovery+0x24ac/0x38b0 fs/bcachefs/recovery.c:851
 bch2_fs_start+0x356/0x5b0 fs/bcachefs/super.c:1036
 bch2_fs_get_tree+0xd61/0x1700 fs/bcachefs/fs.c:1956
 vfs_get_tree+0x90/0x2b0 fs/super.c:1800
 do_new_mount+0x2be/0xb40 fs/namespace.c:3507
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4055 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4032
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbcc7b8a8fa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc0febe3f8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc0febe410 RCX: 00007fbcc7b8a8fa
RDX: 0000000020005d80 RSI: 0000000020005dc0 RDI: 00007ffc0febe410
RBP: 0000000000000004 R08: 00007ffc0febe450 R09: 0000000000005d9a
R10: 0000000000200400 R11: 0000000000000282 R12: 0000000000200400
R13: 00007ffc0febe450 R14: 0000000000000003 R15: 0000000001000000
 </TASK>
---[ end trace ]---
Kernel bug: UBSAN: shift-out-of-bounds in member_to_text
Subsystem: bcachefs
Status: fixed

Crash report:
loop0: detected capacity change from 0 to 32768
------------[ cut here ]------------
UBSAN: shift-out-of-bounds in fs/bcachefs/sb-members.c:249:2
shift exponent 69 is too large for 64-bit type 'unsigned long long'
CPU: 0 UID: 0 PID: 5099 Comm: syz-executor454 Not tainted 6.11.0-rc6-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
 ubsan_epilogue lib/ubsan.c:231 [inline]
 __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468
 member_to_text+0x9a2/0x9b0 fs/bcachefs/sb-members.c:249
 bch2_sb_members_v2_to_text+0x267/0x3b0 fs/bcachefs/sb-members.c:310
 bch2_sb_field_validate+0x201/0x2e0 fs/bcachefs/super-io.c:1233
 bch2_sb_validate+0xb4b/0xef0 fs/bcachefs/super-io.c:472
 __bch2_read_super+0xc1b/0x1370 fs/bcachefs/super-io.c:827
 bch2_fs_open+0x246/0xdf0 fs/bcachefs/super.c:2083
 bch2_fs_get_tree+0x731/0x1700 fs/bcachefs/fs.c:1933
 vfs_get_tree+0x90/0x2b0 fs/super.c:1800
 do_new_mount+0x2be/0xb40 fs/namespace.c:3472
 do_mount fs/namespace.c:3812 [inline]
 __do_sys_mount fs/namespace.c:4020 [inline]
 __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:3997
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe3ee4d7faa
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe262fa7b8 EFLAGS: 00000282 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffe262fa7d0 RCX: 00007fe3ee4d7faa
RDX: 00000000200058c0 RSI: 0000000020000100 RDI: 00007ffe262fa7d0
RBP: 0000000000000004 R08: 00007ffe262fa810 R09: 0000000000005903
R10: 0000000000000000 R11: 0000000000000282 R12: 0000000000000000
R13: 00007ffe262fa810 R14: 0000000000000003 R15: 0000000001000000
 </TASK>
---[ end trace ]---
Kernel bug: WARNING in check_helper_call
Subsystem: bpf
Status: fixed

Crash report:
------------[ cut here ]------------
verifier bug: more than one arg with ref_obj_id R2 2 2(1)
WARNING: CPU: 1 PID: 5835 at kernel/bpf/verifier.c:9678 check_func_arg kernel/bpf/verifier.c:9676 [inline]
WARNING: CPU: 1 PID: 5835 at kernel/bpf/verifier.c:9678 check_helper_call+0x6052/0x6b60 kernel/bpf/verifier.c:11386
Modules linked in:
CPU: 1 UID: 0 PID: 5835 Comm: syz-executor386 Not tainted 6.16.0-rc3-syzkaller-gcce3fee729ee #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:check_func_arg kernel/bpf/verifier.c:9676 [inline]
RIP: 0010:check_helper_call+0x6052/0x6b60 kernel/bpf/verifier.c:11386
Code: 48 8b 44 24 18 48 8b 4c 24 38 8b 94 01 d4 00 00 00 8b 8c 24 20 01 00 00 48 c7 c7 e0 a3 91 8b 48 8b 74 24 60 e8 ef 56 ab ff 90 <0f> 0b 90 90 e9 15 d0 ff ff e8 d0 b3 e7 ff c6 05 73 64 b2 0d 01 90
RSP: 0018:ffffc90003f5ecc0 EFLAGS: 00010246
RAX: 9de7429615562e00 RBX: 1ffff1100488e229 RCX: ffff888011441e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90003f5eeb0 R08: ffffc90003f5e9e7 R09: 1ffff920007ebd3c
R10: dffffc0000000000 R11: fffff520007ebd3d R12: 0000000000000002
R13: 0000000000000004 R14: 0000000000000078 R15: 0000000000000002
FS:  0000555591931380(0000) GS:ffff888125d4d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000010cac398 CR3: 0000000075382000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 do_check_insn kernel/bpf/verifier.c:19850 [inline]
 do_check+0x95ec/0xe080 kernel/bpf/verifier.c:20017
 do_check_common+0x188f/0x23f0 kernel/bpf/verifier.c:23180
 do_check_main kernel/bpf/verifier.c:23263 [inline]
 bpf_check+0x10252/0x1a5d0 kernel/bpf/verifier.c:24619
 bpf_prog_load+0x1318/0x1930 kernel/bpf/syscall.c:2972
 __sys_bpf+0x5f1/0x860 kernel/bpf/syscall.c:5978
 __do_sys_bpf kernel/bpf/syscall.c:6085 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6083 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:6083
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5b8c4cc4a9
Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe9d7aae88 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007ffe9d7ab058 RCX: 00007f5b8c4cc4a9
RDX: 0000000000000090 RSI: 0000200000000840 RDI: 0000000000000005
RBP: 00007f5b8c53f610 R08: 0000000000000000 R09: 00007ffe9d7ab058
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe9d7ab048 R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Kernel bug: WARNING in rcu_sync_dtor
Subsystem: f2fs
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 58 at kernel/rcu/sync.c:177 rcu_sync_dtor+0xcd/0x180 kernel/rcu/sync.c:177
Modules linked in:
CPU: 1 UID: 0 PID: 58 Comm: kworker/1:2 Not tainted 6.10.0-syzkaller-12562-g1722389b0d86 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: events destroy_super_work
RIP: 0010:rcu_sync_dtor+0xcd/0x180 kernel/rcu/sync.c:177
Code: 74 19 e8 86 d5 00 00 43 0f b6 44 25 00 84 c0 0f 85 82 00 00 00 41 83 3f 00 75 1d 5b 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 90 <0f> 0b 90 e9 66 ff ff ff 90 0f 0b 90 eb 89 90 0f 0b 90 eb dd 44 89
RSP: 0018:ffffc9000133fb30 EFLAGS: 00010246
RAX: 0000000000000002 RBX: 1ffff11005324477 RCX: ffff8880163f5a00
RDX: 0000000000000000 RSI: ffffffff8c3f9540 RDI: ffff888029922350
RBP: 0000000000000167 R08: ffffffff82092061 R09: 1ffffffff1cbbbd4
R10: dffffc0000000000 R11: fffffbfff1cbbbd5 R12: dffffc0000000000
R13: 1ffff1100532446a R14: ffff888029922350 R15: ffff888029922350
FS:  0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055557c167738 CR3: 000000007ada8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 percpu_free_rwsem+0x41/0x80 kernel/locking/percpu-rwsem.c:42
 destroy_super_work+0xec/0x130 fs/super.c:282
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Kernel bug: kernel BUG in bch2_evacuate_bucket
Subsystem: bcachefs
Status: fixed

Crash report:
------------[ cut here ]------------
kernel BUG at fs/bcachefs/bkey_types.h:210!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 1 UID: 0 PID: 5847 Comm: bch-copygc/loop Not tainted 6.12.0-syzkaller-09073-g9f16d5e6f220 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:bkey_s_c_to_backpointer fs/bcachefs/bkey_types.h:210 [inline]
RIP: 0010:bch2_get_next_backpointer+0x1316/0x1320 fs/bcachefs/backpointers.c:257
Code: f9 fd e9 56 f9 ff ff e8 78 58 91 fd 90 0f 0b e8 d0 5a ba 07 e8 6b 58 91 fd 90 0f 0b e8 63 58 91 fd 90 0f 0b e8 5b 58 91 fd 90 <0f> 0b 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90003dd6c80 EFLAGS: 00010293
RAX: ffffffff84048765 RBX: 00000000000000b3 RCX: ffff888033fc5a00
RDX: 0000000000000000 RSI: 00000000000000b3 RDI: 000000000000001c
RBP: ffffc90003dd6ff8 R08: ffffffff840480a8 R09: 0000000000000000
R10: 0000000000880000 R11: 0000000000000000 R12: ffff88807dae4000
R13: 1ffff920007bad9c R14: ffffc90003dd6ed0 R15: ffff88806f8c0160
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055f337ebb000 CR3: 000000007db9a000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 bch2_evacuate_bucket+0x113c/0x3620 fs/bcachefs/move.c:708
 bch2_copygc+0x42c9/0x4ca0 fs/bcachefs/movinggc.c:240
 bch2_copygc_thread+0x737/0xc20 fs/bcachefs/movinggc.c:381
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bkey_s_c_to_backpointer fs/bcachefs/bkey_types.h:210 [inline]
RIP: 0010:bch2_get_next_backpointer+0x1316/0x1320 fs/bcachefs/backpointers.c:257
Code: f9 fd e9 56 f9 ff ff e8 78 58 91 fd 90 0f 0b e8 d0 5a ba 07 e8 6b 58 91 fd 90 0f 0b e8 63 58 91 fd 90 0f 0b e8 5b 58 91 fd 90 <0f> 0b 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90003dd6c80 EFLAGS: 00010293
RAX: ffffffff84048765 RBX: 00000000000000b3 RCX: ffff888033fc5a00
RDX: 0000000000000000 RSI: 00000000000000b3 RDI: 000000000000001c
RBP: ffffc90003dd6ff8 R08: ffffffff840480a8 R09: 0000000000000000
R10: 0000000000880000 R11: 0000000000000000 R12: ffff88807dae4000
R13: 1ffff920007bad9c R14: ffffc90003dd6ed0 R15: ffff88806f8c0160
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055f337c9a518 CR3: 000000007ce96000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Kernel bug: WARNING in file_seek_cur_needs_f_lock
Subsystem: overlayfs, ext4
Status: fixed

Crash report:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5830 at fs/file.c:1202 file_seek_cur_needs_f_lock+0x11f/0x150 fs/file.c:1201
Modules linked in:
CPU: 0 UID: 0 PID: 5830 Comm: syz-executor321 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:file_seek_cur_needs_f_lock+0x11f/0x150 fs/file.c:1201
Code: 74 22 e8 84 62 7d ff eb 05 e8 7d 62 7d ff b0 01 5b 41 5e 41 5f 5d c3 cc cc cc cc e8 6b 62 7d ff 31 c0 eb ec e8 62 62 7d ff 90 <0f> 0b 90 eb df 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 00 ff ff ff 48
RSP: 0018:ffffc90003fa7e20 EFLAGS: 00010293
RAX: ffffffff8245e1fe RBX: 0000000000000000 RCX: ffff88802ae13c00
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888075ce0090
RBP: 0000000000008000 R08: ffff888075ce0097 R09: 1ffff1100eb9c012
R10: dffffc0000000000 R11: ffffed100eb9c013 R12: ffff88802f6d1600
R13: 0000000000000005 R14: ffff888075ce0090 R15: bfffffffffffffff
FS:  000055558eb2e380(0000) GS:ffff888124fc9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001000 CR3: 0000000075ec0000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 generic_file_llseek_size+0xa7/0x4b0 fs/read_write.c:178
 ovl_llseek+0x189/0x220 fs/overlayfs/file.c:277
 vfs_llseek fs/read_write.c:387 [inline]
 ksys_lseek fs/read_write.c:400 [inline]
 __do_sys_lseek fs/read_write.c:410 [inline]
 __se_sys_lseek fs/read_write.c:408 [inline]
 __x64_sys_lseek+0x14c/0x1e0 fs/read_write.c:408
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff9337bdbf9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd57e56458 EFLAGS: 00000246 ORIG_RAX: 0000000000000008
RAX: ffffffffffffffda RBX: 0000200000000140 RCX: 00007ff9337bdbf9
RDX: 0000000000000001 RSI: 0000000000000005 RDI: 0000000000000003
RBP: 00007ff9338305f0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001
R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
 </TASK>
Kernel bug: KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
Subsystem: f2fs
Status: fixed

Crash report:
F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5
F2FS-fs (loop4): Stopped filesystem due to reason: 0
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: null-ptr-deref in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
BUG: KASAN: null-ptr-deref in __refcount_add include/linux/refcount.h:184 [inline]
BUG: KASAN: null-ptr-deref in __refcount_inc include/linux/refcount.h:241 [inline]
BUG: KASAN: null-ptr-deref in refcount_inc include/linux/refcount.h:258 [inline]
BUG: KASAN: null-ptr-deref in get_task_struct include/linux/sched/task.h:118 [inline]
BUG: KASAN: null-ptr-deref in kthread_stop+0xca/0x630 kernel/kthread.c:704
Write of size 4 at addr 0000000000000028 by task syz-executor169/7772

CPU: 1 PID: 7772 Comm: syz-executor169 Not tainted 6.10.0-syzkaller-11185-g2c9b3512402e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_report+0xe8/0x550 mm/kasan/report.c:491
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
 __refcount_add include/linux/refcount.h:184 [inline]
 __refcount_inc include/linux/refcount.h:241 [inline]
 refcount_inc include/linux/refcount.h:258 [inline]
 get_task_struct include/linux/sched/task.h:118 [inline]
 kthread_stop+0xca/0x630 kernel/kthread.c:704
 f2fs_stop_gc_thread+0x65/0xb0 fs/f2fs/gc.c:210
 f2fs_do_shutdown+0x192/0x540 fs/f2fs/file.c:2283
 f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline]
 __f2fs_ioctl+0x443a/0xbe60 fs/f2fs/file.c:4325
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fac5a221249
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 1d 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fac5a1ce218 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fac5a2a8708 RCX: 00007fac5a221249
RDX: 0000000020000140 RSI: 000000008004587d RDI: 0000000000000005
RBP: 00007fac5a2a8700 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fac5a274b1c
R13: 00007fac5a274040 R14: 00007fac5a26e057 R15: 8c02ea27aa268e19
 </TASK>
==================================================================