[v5.15] WARNING in btrfs_put_block_group

Hello,

syzbot found the following issue on:

HEAD commit: 115472395b0a Linux 5.15.104
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1659a03ec80000
kernel config: https://syzkaller.appspot.com/x/.config?x=e597b110d58e7b4
dashboard link: https://syzkaller.appspot.com/bug?extid=f2508933db18c09bc224
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/76798ca1c9b6/disk-11547239.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b608633c8f5/vmlinux-11547239.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8836fafb618b/Image-11547239.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

------------[ cut here ]------------
WARNING: CPU: 0 PID: 4098 at fs/btrfs/block-group.c:135 btrfs_put_block_group+0x248/0x288 fs/btrfs/block-group.c:135
Modules linked in:
CPU: 0 PID: 4098 Comm: syz-executor.4 Not tainted 5.15.104-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : btrfs_put_block_group+0x248/0x288 fs/btrfs/block-group.c:135
lr : btrfs_put_block_group+0x248/0x288 fs/btrfs/block-group.c:135
sp : ffff80001cc57750
x29: ffff80001cc57750 x28: dfff800000000000 x27: ffff800014f6c4a0
x26: 0000000000000002 x25: 0000000000000001 x24: ffff0000cb462000
x23: 0000000000000000 x22: 1fffe0001968c42c x21: dfff800000000000
x20: 0000000000003000 x19: ffff0000cb462000 x18: 0000000000000000
x17: ff8080000a20215c x16: ffff80000824bf58 x15: ffff80000a20215c
x14: 00000000ffff8000 x13: ffffffffffffffff x12: 0000000000000000
x11: ff8080000a1ee054 x10: 0000000000000000 x9 : ffff80000a1ee054
x8 : ffff0000c0b83580 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff80000a1ede38
x2 : 0000000000000001 x1 : 0000000000003000 x0 : 0000000000000000
Call trace:
btrfs_put_block_group+0x248/0x288 fs/btrfs/block-group.c:135
btrfs_free_block_groups+0x730/0xb54 fs/btrfs/block-group.c:3916
close_ctree+0x61c/0x860 fs/btrfs/disk-io.c:4481
btrfs_put_super+0x40/0x50 fs/btrfs/super.c:340
generic_shutdown_super+0x130/0x29c fs/super.c:466
kill_anon_super+0x4c/0x74 fs/super.c:1058
btrfs_kill_super+0x40/0x58 fs/btrfs/super.c:2393
deactivate_locked_super+0xb8/0x13c fs/super.c:335
deactivate_super+0x108/0x128 fs/super.c:366
cleanup_mnt+0x3c0/0x474 fs/namespace.c:1143
__cleanup_mnt+0x20/0x30 fs/namespace.c:1150
task_work_run+0x130/0x1e4 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
do_notify_resume+0x262c/0x32b8 arch/arm64/kernel/signal.c:946
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:597
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 4419444
hardirqs last enabled at (4419443): [<ffff8000088c3fd0>] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (4419444): [<ffff800011938e98>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (4418500): [<ffff800008020ccc>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (4418500): [<ffff800008020ccc>] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587
softirqs last disabled at (4418469): [<ffff8000081b4ee0>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (4418469): [<ffff8000081b4ee0>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (4418469): [<ffff8000081b4ee0>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
---[ end trace 611ef3ec25bfb518 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4098 at fs/btrfs/block-group.c:3934 btrfs_free_block_groups+0x850/0xb54 fs/btrfs/block-group.c:3933
Modules linked in:
CPU: 0 PID: 4098 Comm: syz-executor.4 Tainted: G W 5.15.104-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : btrfs_free_block_groups+0x850/0xb54 fs/btrfs/block-group.c:3933
lr : btrfs_free_block_groups+0xa8c/0xb54 fs/btrfs/block-group.c:3933
sp : ffff80001cc57780
x29: ffff80001cc577a0 x28: dfff800000000000 x27: ffff800014f6c4a0
x26: 1fffe0001bcd4a20 x25: 0000000000000001 x24: 0000000000028000
x23: ffff0000d48ea000 x22: ffff0000d48ea0a8 x21: ffff0000de6a59d0
x20: ffff0000de6a5100 x19: ffff0000de6a4000 x18: 1fffe0001a91d40a
x17: ff8080000a20215c x16: ffff80000824bf58 x15: ffff800008a031a8
x14: 1ffff0000291806a x13: ffffffffffffffff x12: 0000000000000000
x11: ff8080000a2025d4 x10: 0000000000000000 x9 : ffff80000a2025d4
x8 : ffff0000c0b83580 x7 : ffff80000a1e88f8 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800008301e60
x2 : 0000000000000001 x1 : 0000000000028000 x0 : 0000000000000000
Call trace:
btrfs_free_block_groups+0x850/0xb54 fs/btrfs/block-group.c:3933
close_ctree+0x61c/0x860 fs/btrfs/disk-io.c:4481
btrfs_put_super+0x40/0x50 fs/btrfs/super.c:340
generic_shutdown_super+0x130/0x29c fs/super.c:466
kill_anon_super+0x4c/0x74 fs/super.c:1058
btrfs_kill_super+0x40/0x58 fs/btrfs/super.c:2393
deactivate_locked_super+0xb8/0x13c fs/super.c:335
deactivate_super+0x108/0x128 fs/super.c:366
cleanup_mnt+0x3c0/0x474 fs/namespace.c:1143
__cleanup_mnt+0x20/0x30 fs/namespace.c:1150
task_work_run+0x130/0x1e4 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
do_notify_resume+0x262c/0x32b8 arch/arm64/kernel/signal.c:946
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:597
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 4420122
hardirqs last enabled at (4420121): [<ffff8000088c3fd0>] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (4420122): [<ffff800011938e98>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (4419548): [<ffff800008020ccc>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (4419548): [<ffff800008020ccc>] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587
softirqs last disabled at (4419447): [<ffff8000081b4ee0>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (4419447): [<ffff8000081b4ee0>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (4419447): [<ffff8000081b4ee0>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
---[ end trace 611ef3ec25bfb519 ]---
BTRFS info (device loop4): space_info 5 has 3043328 free, is not full
BTRFS info (device loop4): space_info total=3276800, used=57344, pinned=0, reserved=12288, may_use=163840, readonly=0 zone_unusable=0
BTRFS info (device loop4): global_block_rsv: size 0 reserved 0
BTRFS info (device loop4): trans_block_rsv: size 0 reserved 0
BTRFS info (device loop4): chunk_block_rsv: size 0 reserved 0
BTRFS info (device loop4): delayed_block_rsv: size 0 reserved 0
BTRFS info (device loop4): delayed_refs_rsv: size 0 reserved 0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4098 at fs/btrfs/block-group.c:3946 btrfs_free_block_groups+0xa5c/0xb54 fs/btrfs/block-group.c:3946
Modules linked in:
CPU: 0 PID: 4098 Comm: syz-executor.4 Tainted: G W 5.15.104-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : btrfs_free_block_groups+0xa5c/0xb54 fs/btrfs/block-group.c:3946
lr : btrfs_free_block_groups+0xa5c/0xb54 fs/btrfs/block-group.c:3946
sp : ffff80001cc57780
x29: ffff80001cc577a0 x28: dfff800000000000 x27: ffff800014f6c4a0
x26: 1fffe0001bcd4a20 x25: 0000000000000001 x24: 0000000000003000
x23: ffff0000d48ea000 x22: ffff0000d48ea0a8 x21: ffff0000de6a59d0
x20: ffff0000de6a5100 x19: dead000000000100 x18: 1fffe000368fff8e
x17: 1fffe000368fff8e x16: ffff8000082e8e80 x15: ffff80001495eda0
x14: 1ffff0000291806a x13: ffffffffffffffff x12: 0000000000000000
x11: ff8080000a2025a4 x10: 0000000000000000 x9 : ffff80000a2025a4
x8 : ffff0000c0b83580 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000000 x3 : ffff800008045814
x2 : 0000000000000006 x1 : 0000000000003000 x0 : 0000000000000000
Call trace:
btrfs_free_block_groups+0xa5c/0xb54 fs/btrfs/block-group.c:3946
close_ctree+0x61c/0x860 fs/btrfs/disk-io.c:4481
btrfs_put_super+0x40/0x50 fs/btrfs/super.c:340
generic_shutdown_super+0x130/0x29c fs/super.c:466
kill_anon_super+0x4c/0x74 fs/super.c:1058
btrfs_kill_super+0x40/0x58 fs/btrfs/super.c:2393
deactivate_locked_super+0xb8/0x13c fs/super.c:335
deactivate_super+0x108/0x128 fs/super.c:366
cleanup_mnt+0x3c0/0x474 fs/namespace.c:1143
__cleanup_mnt+0x20/0x30 fs/namespace.c:1150
task_work_run+0x130/0x1e4 kernel/task_work.c:164
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
do_notify_resume+0x262c/0x32b8 arch/arm64/kernel/signal.c:946
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
el0_svc+0xfc/0x1f0 arch/arm64/kernel/entry-common.c:597
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 4420564
hardirqs last enabled at (4420563): [<ffff8000082681e8>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1337 [inline]
hardirqs last enabled at (4420563): [<ffff8000082681e8>] finish_lock_switch+0xbc/0x1e8 kernel/sched/core.c:4777
hardirqs last disabled at (4420564): [<ffff800011938e98>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (4420558): [<ffff800008020ccc>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (4420558): [<ffff800008020ccc>] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587
softirqs last disabled at (4420531): [<ffff8000081b4ee0>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (4420531): [<ffff8000081b4ee0>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (4420531): [<ffff8000081b4ee0>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
---[ end trace 611ef3ec25bfb51a ]---
BTRFS info (device loop4): space_info 5 has 3043328 free, is not full
BTRFS info (device loop4): space_info total=3276800, used=57344, pinned=0, reserved=12288, may_use=163840, readonly=0 zone_unusable=0
BTRFS info (device loop4): global_block_rsv: size 0 reserved 0
BTRFS info (device loop4): trans_block_rsv: size 0 reserved 0
BTRFS info (device loop4): chunk_block_rsv: size 0 reserved 0
BTRFS info (device loop4): delayed_block_rsv: size 0 reserved 0
BTRFS info (device loop4): delayed_refs_rsv: size 0 reserved 0
VFS: Busy inodes after unmount of loop4. Self-destruct in 5 seconds. Have a nice day...


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot has found a reproducer for the following issue on:
console output: https://syzkaller.appspot.com/x/log.txt?x=15d8dfa9c80000
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1628bb6dc80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16c680c9c80000
mounted in repro: https://storage.googleapis.com/syzbot-assets/6af9194da62b/mount_0.gz
BTRFS info (device loop0): at unmount dio bytes count 12288
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4124 at fs/btrfs/block-group.c:135 btrfs_put_block_group+0x248/0x288 fs/btrfs/block-group.c:135
Modules linked in:
CPU: 1 PID: 4124 Comm: syz-executor365 Not tainted 5.15.104-syzkaller #0
sp : ffff80001cf97750
x29: ffff80001cf97750 x28: dfff800000000000 x27: ffff800014f6c4a0
x26: 0000000000000002 x25: 0000000000000001 x24: ffff0000d4599800
x23: 0000000000000000 x22: 1fffe0001a8b332c x21: dfff800000000000
x20: 0000000000003000 x19: ffff0000d4599800 x18: 0000000000000000
x8 : ffff0000cefc5040 x7 : 0000000000000000 x6 : 000000000000003f
irq event stamp: 11610780
hardirqs last enabled at (11610779): [<ffff8000088c3fd0>] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (11610780): [<ffff800011938e98>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (11606936): [<ffff800008030068>] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31
softirqs last disabled at (11606934): [<ffff800008030034>] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18
---[ end trace 2154789ecff9e57e ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4124 at fs/btrfs/block-group.c:3934 btrfs_free_block_groups+0x850/0xb54 fs/btrfs/block-group.c:3933
Modules linked in:
CPU: 1 PID: 4124 Comm: syz-executor365 Tainted: G W 5.15.104-syzkaller #0
sp : ffff80001cf97780
x29: ffff80001cf977a0 x28: dfff800000000000 x27: ffff800014f6c4a0
x26: 1fffe00019309220 x25: 0000000000000001 x24: 0000000000028000
x23: ffff0000d459a800 x22: ffff0000d459a8a8 x21: ffff0000c98499d0
x20: ffff0000c9849100 x19: ffff0000c9848000 x18: 1fffe0001a8b350a
x8 : ffff0000cefc5040 x7 : ffff80000a1e88f8 x6 : 0000000000000000
irq event stamp: 11610844
hardirqs last enabled at (11610843): [<ffff8000088c3fd0>] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:231
hardirqs last disabled at (11610844): [<ffff800011938e98>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (11610794): [<ffff800008020ccc>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (11610794): [<ffff800008020ccc>] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587
softirqs last disabled at (11610785): [<ffff8000081b4ee0>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (11610785): [<ffff8000081b4ee0>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (11610785): [<ffff8000081b4ee0>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
---[ end trace 2154789ecff9e57f ]---
BTRFS info (device loop0): space_info 5 has 3043328 free, is not full
BTRFS info (device loop0): space_info total=3276800, used=57344, pinned=0, reserved=12288, may_use=163840, readonly=0 zone_unusable=0
BTRFS info (device loop0): global_block_rsv: size 0 reserved 0
BTRFS info (device loop0): trans_block_rsv: size 0 reserved 0
BTRFS info (device loop0): chunk_block_rsv: size 0 reserved 0
BTRFS info (device loop0): delayed_block_rsv: size 0 reserved 0
BTRFS info (device loop0): delayed_refs_rsv: size 0 reserved 0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 4124 at fs/btrfs/block-group.c:3946 btrfs_free_block_groups+0xa5c/0xb54 fs/btrfs/block-group.c:3946
Modules linked in:
CPU: 0 PID: 4124 Comm: syz-executor365 Tainted: G W 5.15.104-syzkaller #0
sp : ffff80001cf97780
x29: ffff80001cf977a0 x28: dfff800000000000 x27: ffff800014f6c4a0
x26: 1fffe00019309220 x25: 0000000000000001 x24: 0000000000003000
x23: ffff0000d459a800 x22: ffff0000d459a8a8 x21: ffff0000c98499d0
x20: ffff0000c9849100 x19: dead000000000100 x18: 1fffe000368fff8e
x8 : ffff0000cefc5040 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000000 x3 : ffff800008256700
irq event stamp: 11611220
hardirqs last enabled at (11611219): [<ffff8000082681e8>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1337 [inline]
hardirqs last enabled at (11611219): [<ffff8000082681e8>] finish_lock_switch+0xbc/0x1e8 kernel/sched/core.c:4777
hardirqs last disabled at (11611220): [<ffff800011938e98>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (11611194): [<ffff800008020ccc>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (11611194): [<ffff800008020ccc>] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587
softirqs last disabled at (11610921): [<ffff8000081b4ee0>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (11610921): [<ffff8000081b4ee0>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (11610921): [<ffff8000081b4ee0>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
---[ end trace 2154789ecff9e580 ]---
BTRFS info (device loop0): space_info 5 has 3043328 free, is not full
BTRFS info (device loop0): space_info total=3276800, used=57344, pinned=0, reserved=12288, may_use=163840, readonly=0 zone_unusable=0
BTRFS info (device loop0): global_block_rsv: size 0 reserved 0
BTRFS info (device loop0): trans_block_rsv: size 0 reserved 0
BTRFS info (device loop0): chunk_block_rsv: size 0 reserved 0
BTRFS info (device loop0): delayed_block_rsv: size 0 reserved 0
BTRFS info (device loop0): delayed_refs_rsv: size 0 reserved 0
VFS: Busy inodes after unmount of loop0. Self-destruct in 5 seconds. Have a nice day...