WARNING in mark_buffer_dirty

[syzbot]

Hello,

syzkaller hit the following crash on
5515cf16e270538121e4fa9283fed86c6cfd8c9c
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
compiler: gcc (GCC) 7.1.1 20170620
.config is attached
Raw console output is attached.
C reproducer is attached
syzkaller reproducer is attached. See https://goo.gl/kgGztJ
for information about syzkaller reproducers


------------[ cut here ]------------
WARNING: CPU: 3 PID: 13366 at fs/buffer.c:1108
mark_buffer_dirty+0x48b/0x5d0 fs/buffer.c:1108
Kernel panic - not syncing: panic_on_warn set ...

hub 1-0:1.0: activate --> -22
CPU: 3 PID: 13366 Comm: syzkaller183798 Not tainted
4.14.0-rc8-next-20171109+ #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:53
panic+0x1e4/0x41c kernel/panic.c:183
__warn+0x1c4/0x1e0 kernel/panic.c:546
report_bug+0x211/0x2d0 lib/bug.c:184
fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:176
do_trap_no_signal arch/x86/kernel/traps.c:210 [inline]
do_trap+0x260/0x390 arch/x86/kernel/traps.c:259
do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:296
hub 1-0:1.0: activate --> -22
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:309
invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:926
RIP: 0010:mark_buffer_dirty+0x48b/0x5d0 fs/buffer.c:1108
RSP: 0018:ffff88007ab27188 EFLAGS: 00010293
RAX: ffff880079fa6500 RBX: ffff88007a727d20 RCX: ffffffff81bbfe5b
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88007a727d20
RBP: ffff88007ab27298 R08: 0000000000000200 R09: ffffea0001e53580
R10: 0000000000000040 R11: ffffed000f29ac3f R12: 1ffff1000f564e32
R13: dffffc0000000000 R14: ffff88007ab27270 R15: 0000000000000000
hub 1-0:1.0: activate --> -22
__block_commit_write.isra.32+0x13b/0x2f0 fs/buffer.c:2060
block_write_end+0x99/0x1c0 fs/buffer.c:2138
blkdev_write_end+0xc3/0x280 fs/block_dev.c:593
generic_perform_write+0x3a4/0x600 mm/filemap.c:3149
hub 1-0:1.0: activate --> -22
__generic_file_write_iter+0x366/0x5b0 mm/filemap.c:3263
blkdev_write_iter+0x207/0x3e0 fs/block_dev.c:1893
call_write_iter include/linux/fs.h:1772 [inline]
do_iter_readv_writev+0x531/0x7f0 fs/read_write.c:653
do_iter_write+0x15a/0x540 fs/read_write.c:932
vfs_iter_write+0x77/0xb0 fs/read_write.c:945
iter_file_splice_write+0x7db/0xf30 fs/splice.c:749
do_splice_from fs/splice.c:851 [inline]
direct_splice_actor+0x125/0x180 fs/splice.c:1018
splice_direct_to_actor+0x2c1/0x820 fs/splice.c:973
hub 1-0:1.0: activate --> -22
do_splice_direct+0x2a7/0x3d0 fs/splice.c:1061
do_sendfile+0x5d5/0xe90 fs/read_write.c:1413
SYSC_sendfile64 fs/read_write.c:1468 [inline]
SyS_sendfile64+0xbd/0x160 fs/read_write.c:1460
entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x43b579
RSP: 002b:00007ffe8b3b2088 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 000000000043b579
RDX: 00000000200ddff8 RSI: 0000000000000004 RDI: 0000000000000003
RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000100000001 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000045f R14: 00000000004036a0 R15: 0000000000000000
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a dumb bot. It may contain errors.
See https://goo.gl/tpsmEJ for details.
Direct all questions to syzk...@googlegroups.com.
Please credit me with: Reported-by: syzbot <syzk...@googlegroups.com>

syzbot will keep track of this bug report.
Once a fix for this bug is committed, please reply to this email with:
#syz fix: exact-commit-title
To mark this as a duplicate of another syzbot report, please reply with:
#syz dup: exact-subject-of-another-report
If it's a one-off invalid bug report, please reply with:
#syz invalid
Note: if the crash happens again, it will cause creation of a new bug
report.
Note: all commands must start from beginning of the line in the email body.

[Eric Biggers]

Still happens on latest Linus tree as of today, though it takes a little while
(~30 seconds) for the C reproducer to trigger the WARN.