Bcachefs + Memory pressure = NULL dereference

[ 765.271656] BUG: kernel NULL pointer dereference, address: 00000000000000a1

[ 765.271741] #PF: supervisor read access in kernel mode

[ 765.271777] #PF: error_code(0x0000) - not-present page

[ 765.271807] PGD 0 P4D 0

[ 765.271832] Oops: 0000 [#1] SMP

[ 765.271867] CPU: 7 PID: 2214 Comm: kworker/7:1 Not tainted 5.9.0-00381-gb1107114caf6 #25

[ 765.271944] Workqueue: bcachefs bch2_write_index

[ 765.271987] RIP: 0010:bch2_extent_can_insert+0x69/0x1c0

[ 765.272029] Code: 66 39 d0 0f 84 89 00 00 00 49 89 fd 48 89 f3 eb 19 4c 89 fe 48 8d 7c 24 04 e8 63 5c fc ff 0f b7 44 24 04 66 3b 44 24 06 74 68 <49> 8b 97 a0 00 00 00 0f b7 c0 4c 8d 74 c2 08 41 80 7e 02 01 76 d1

[ 765.272157] RSP: 0000:ffffbbb08049f908 EFLAGS: 00010283

[ 765.272190] RAX: 000000004261425e RBX: ffff95ccc0508000 RCX: 0000000000000000

[ 765.272242] RDX: 0000000000004261 RSI: ffff95ccc0508000 RDI: ffffbbb08049fcc0

[ 765.272295] RBP: ffffbbb08049f970 R08: 0000000000000000 R09: 0000000000000150

[ 765.272348] R10: 0000000000000000 R11: 0000000038000567 R12: ffffbbb08049fd80

[ 765.272406] R13: ffffbbb08049fcc0 R14: ffffbbb08049fcc0 R15: 0000000000000001

[ 765.272466] FS: 0000000000000000(0000) GS:ffff95cd3bb80000(0000) knlGS:0000000000000000

[ 765.272529] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

[ 765.272575] CR2: 00000000000000a1 CR3: 0000000165009004 CR4: 00000000003706a0

[ 765.272632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

[ 765.272692] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

[ 765.272746] Call Trace:

[ 765.272771] ? bch2_btree_iter_next_with_updates+0x82/0xd0

[ 765.272817] __bch2_trans_commit+0x4c3/0x1cb0

[ 765.272854] ? bch2_inode_unpack+0x670/0x910

[ 765.272891] bch2_extent_update+0x2fc/0x4b0

[ 765.272920] ? __btree_iter_traverse_all+0x115/0x3a0

[ 765.272965] ? __kmalloc+0x393/0x3f0

[ 765.272998] ? __btree_trans_get_iter+0x66/0x4d0

[ 765.273038] bch2_write_index_default+0x1e1/0x320

[ 765.273076] ? bch2_write_index_default+0x70/0x320

[ 765.273115] ? bch2_bkey_is_incompressible+0x6f/0x130

[ 765.273155] __bch2_write_index+0x304/0x390

[ 765.273191] bch2_write_index+0x17/0x100

[ 765.273226] process_one_work+0x1be/0x310

[ 765.273260] worker_thread+0x52/0x400

[ 765.273288] kthread+0x126/0x140

[ 765.273317] ? process_one_work+0x310/0x310

[ 765.273345] ? __kthread_bind_mask+0x70/0x70

[ 765.273389] ret_from_fork+0x1f/0x30

[ 765.273421] CR2: 00000000000000a1

[ 765.273453] ---[ end trace c0e243811ad20562 ]---

[ 765.273494] RIP: 0010:bch2_extent_can_insert+0x69/0x1c0

[ 765.273533] Code: 66 39 d0 0f 84 89 00 00 00 49 89 fd 48 89 f3 eb 19 4c 89 fe 48 8d 7c 24 04 e8 63 5c fc ff 0f b7 44 24 04 66 3b 44 24 06 74 68 <49> 8b 97 a0 00 00 00 0f b7 c0 4c 8d 74 c2 08 41 80 7e 02 01 76 d1

[ 765.273678] RSP: 0000:ffffbbb08049f908 EFLAGS: 00010283

[ 765.273717] RAX: 000000004261425e RBX: ffff95ccc0508000 RCX: 0000000000000000

[ 765.273784] RDX: 0000000000004261 RSI: ffff95ccc0508000 RDI: ffffbbb08049fcc0

[ 765.273847] RBP: ffffbbb08049f970 R08: 0000000000000000 R09: 0000000000000150

[ 765.273901] R10: 0000000000000000 R11: 0000000038000567 R12: ffffbbb08049fd80

[ 765.273961] R13: ffffbbb08049fcc0 R14: ffffbbb08049fcc0 R15: 0000000000000001

[ 765.274025] FS: 0000000000000000(0000) GS:ffff95cd3bb80000(0000) knlGS:0000000000000000

[ 765.274098] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

[ 765.274146] CR2: 00000000000000a1 CR3: 0000000165009004 CR4: 00000000003706a0

[ 765.274206] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

[ 765.274274] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

[ 776.481520] zcashd invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0

[ 776.481695] CPU: 0 PID: 327 Comm: zcashd Tainted: G D 5.9.0-00381-gb1107114caf6 #25

[ 776.481758] Call Trace:

[ 776.481800] dump_stack+0x62/0x86

[ 776.481832] dump_header+0x4a/0x17a

[ 776.481860] oom_kill_process.cold+0xb/0x10

[ 776.481889] out_of_memory+0x209/0x2b0

[ 776.481920] __alloc_pages_slowpath.constprop.0+0xab2/0xbf0

[ 776.481956] __alloc_pages_nodemask+0x222/0x260

[ 776.481995] pagecache_get_page+0xec/0x2e0

[ 776.482023] filemap_fault+0x4b4/0x7b0

[ 776.482056] bch2_page_fault+0x67/0xe0

[ 776.482084] __do_fault+0x33/0x90

[ 776.482113] handle_mm_fault+0xb03/0x1180

[ 776.482147] exc_page_fault+0x22c/0x450

[ 776.482181] ? asm_exc_page_fault+0x8/0x30

[ 776.482211] asm_exc_page_fault+0x1e/0x30

[ 776.482241] RIP: 0033:0x556d6d61b031

[ 776.482273] Code: Bad RIP value.

[ 776.482299] RSP: 002b:00007ffd798051a0 EFLAGS: 00010246

[ 776.482336] RAX: 0000000000000000 RBX: 00007ffd798052a0 RCX: 0000000000000000

[ 776.482383] RDX: 00007fbdc640f9c0 RSI: 0000000000000081 RDI: 0000000000000001

[ 776.482430] RBP: 000000000000006e R08: 0000000000000000 R09: 0000000000000004

[ 776.482477] R10: 0000000000000000 R11: 0000000000000286 R12: 00007ffd79805278

[ 776.482530] R13: 00007ffd79805308 R14: 00007ffd798052f8 R15: 00007ffd79805308

[ 776.482595] Mem-Info:

[ 776.482628] active_anon:45 inactive_anon:953374 isolated_anon:0

active_file:1098 inactive_file:1277 isolated_file:32

unevictable:16 dirty:2257 writeback:4

slab_reclaimable:2736 slab_unreclaimable:12452

mapped:2204 shmem:2570 pagetables:2225 bounce:0

free:9953 free_pcp:1501 free_cma:0

[ 776.482846] Node 0 active_anon:180kB inactive_anon:3813496kB active_file:4392kB inactive_file:5108kB unevictable:64kB isolated(anon):0kB isolated(file):128kB mapped:8816kB dirty:9028kB writeback:16kB shmem:10280kB writeback_tmp:0kB kernel_stack:3664kB all_unreclaimable? no

[ 776.483029] DMA32 free:23836kB min:16152kB low:18176kB high:20200kB reserved_highatomic:0KB active_anon:24kB inactive_anon:1971964kB active_file:3952kB inactive_file:4728kB unevictable:0kB writepending:8188kB present:2096760kB managed:2031140kB mlocked:0kB pagetables:140kB bounce:0kB free_pcp:4744kB local_pcp:544kB free_cma:0kB

[ 776.483240] lowmem_reserve[]: 0 1959 1959

[ 776.483288] Normal free:15976kB min:15992kB low:17996kB high:20000kB reserved_highatomic:0KB active_anon:156kB inactive_anon:1841532kB active_file:396kB inactive_file:452kB unevictable:64kB writepending:856kB present:2097152kB managed:2010072kB mlocked:64kB pagetables:8760kB bounce:0kB free_pcp:1260kB local_pcp:0kB free_cma:0kB

[ 776.483506] lowmem_reserve[]: 0 0 0

[ 776.483553] DMA32: 191*4kB (UME) 96*8kB (UME) 48*16kB (UME) 97*32kB (UME) 74*64kB (UME) 47*128kB (UM) 20*256kB (UM) 5*512kB (UM) 0*1024kB 0*2048kB 0*4096kB = 23836kB

[ 776.483675] Normal: 80*4kB (UM) 271*8kB (UM) 153*16kB (UM) 59*32kB (UM) 61*64kB (UM) 23*128kB (UM) 9*256kB (UM) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 15976kB

[ 776.483797] 5006 total pagecache pages

[ 776.483841] 0 pages in swap cache

[ 776.483884] Swap cache stats: add 0, delete 0, find 0/0

[ 776.483938] Free swap = 0kB

[ 776.483984] Total swap = 0kB

[ 776.484029] 1048478 pages RAM

[ 776.484075] 0 pages HighMem/MovableOnly

[ 776.484119] 38175 pages reserved

[ 776.484170] Tasks state (memory values in pages):

[ 776.484226] [ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name

[ 776.484319] [ 241] 0 241 8500 3356 102400 0 -250 systemd-journal

[ 776.484404] [ 242] 0 242 656 27 40960 0 0 agetty

[ 776.484478] [ 250] 0 250 1335 40 45056 0 0 blkmapd

[ 776.484554] [ 253] 0 253 4699 253 61440 0 -1000 systemd-udevd

[ 776.484642] [ 257] 100 257 1992 108 53248 0 0 rpcbind

[ 776.484717] [ 261] 0 261 790 41 40960 0 0 rpc.idmapd

[ 776.484805] [ 265] 0 265 7974 6282 102400 0 0 rpc.mountd

[ 776.484899] [ 279] 102 279 1965 83 49152 0 -900 dbus-daemon

[ 776.484993] [ 291] 0 291 4429 236 73728 0 0 systemd-logind

[ 776.485091] [ 319] 0 319 3268 235 61440 0 -1000 sshd

[ 776.485171] [ 327] 104 327 1145478 683407 6221824 0 0 zcashd

[ 776.485257] [ 370] 0 370 3644 415 73728 0 0 sshd

[ 776.485341] [ 373] 0 373 4844 337 81920 0 0 systemd

[ 776.485428] [ 375] 0 375 5339 621 90112 0 0 (sd-pam)

[ 776.485524] [ 389] 0 389 1809 462 57344 0 0 bash

[ 776.485610] [ 2169] 0 2169 2600 910 61440 0 0 git

[ 776.485692] [ 2170] 0 2170 26410 2056 110592 0 0 git-remote-http

[ 776.485791] [ 2172] 0 2172 21119 1069 61440 0 0 git

[ 776.485874] [ 2181] 0 2181 301260 253233 2105344 0 0 git

[ 776.485960] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/zcashd.service,task=zcashd,pid=327,uid=104

[ 776.486177] Out of memory: Killed process 327 (zcashd) total-vm:4581912kB, anon-rss:2733628kB, file-rss:0kB, shmem-rss:0kB, UID:104 pgtables:6076kB oom_score_adj:0

[ 776.576950] oom_reaper: reaped process 327 (zcashd), now anon-rss:64kB, file-rss:0kB, shmem-rss:0kB