[v6.1] kernel BUG in create_pending_snapshot

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f17b0ab65d17 Linux 6.1.25
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14e9f6bfc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=73f7ee8e484b74b7
dashboard link: https://syzkaller.appspot.com/bug?extid=c56033c8c15c08286062
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/553994c02131/disk-f17b0ab6.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c88e4d2795a5/vmlinux-f17b0ab6.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d788d429a3a9/Image-f17b0ab6.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c56033...@syzkaller.appspotmail.com

el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
------------[ cut here ]------------
kernel BUG at fs/btrfs/transaction.c:1672!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 14988 Comm: syz-executor.1 Not tainted 6.1.25-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : create_pending_snapshot+0x2024/0x2634 fs/btrfs/transaction.c:1672
lr : create_pending_snapshot+0x2024/0x2634 fs/btrfs/transaction.c:1672
sp : ffff80002d837480
x29: ffff80002d837720 x28: dfff800000000000 x27: 1fffe00029f45bd5
x26: ffff0000d7a5abb0 x25: ffff000129a40000 x24: ffff000127cc1000
x23: ffff700005b06ec0 x22: ffff00014fa2de00 x21: ffff000140af5a70
x20: ffff000129a40490 x19: 00000000fffffff4 x18: 1fffe000368b6b76
x17: 0000000000000000 x16: ffff8000120dc5fc x15: 0000000000000000
x14: 0000000000000002 x13: ffffffffffff8848 x12: 0000000000040000
x11: 0000000000014ee4 x10: ffff80001db19000 x9 : ffff80000a0f66d4
x8 : 0000000000014ee5 x7 : ffffffffffff8848 x6 : ffffffffffff8820
x5 : ffff80002d836958 x4 : 00000000ffffffff x3 : 0000000000000d40
x2 : ffff0000c73b9e00 x1 : 00000000fffffff4 x0 : 0000000000000000
Call trace:
create_pending_snapshot+0x2024/0x2634 fs/btrfs/transaction.c:1672
create_pending_snapshots+0x150/0x198 fs/btrfs/transaction.c:1868
btrfs_commit_transaction+0x10e0/0x2cd4 fs/btrfs/transaction.c:2336
create_snapshot+0x418/0x6f0 fs/btrfs/ioctl.c:833
btrfs_mksubvol+0x510/0x650 fs/btrfs/ioctl.c:983
btrfs_mksnapshot+0xc8/0x158 fs/btrfs/ioctl.c:1029
__btrfs_ioctl_snap_create+0x2e4/0x3c0 fs/btrfs/ioctl.c:2184
btrfs_ioctl_snap_create_v2+0x1a4/0x38c fs/btrfs/ioctl.c:2271
btrfs_ioctl+0x9b4/0xb08
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: 52800101 97a1c818 17fffd2e 979000dd (d4210000)
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: a1c449d00ff8 Linux 6.1.36
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=162b6eb8a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=88fba5343539f90e

dashboard link: https://syzkaller.appspot.com/bug?extid=c56033c8c15c08286062
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=116ddeb8a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f6484f280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/46c419b02b39/disk-a1c449d0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cc8fc6c3c06c/vmlinux-a1c449d0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7ed5c1022bfe/Image-a1c449d0.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/26aaede1fd29/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c56033...@syzkaller.appspotmail.com

el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
------------[ cut here ]------------
kernel BUG at fs/btrfs/transaction.c:1672!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:

CPU: 0 PID: 4329 Comm: syz-executor916 Not tainted 6.1.36-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023

pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : create_pending_snapshot+0x2024/0x2634 fs/btrfs/transaction.c:1672
lr : create_pending_snapshot+0x2024/0x2634 fs/btrfs/transaction.c:1672

sp : ffff80001dd17480
x29: ffff80001dd17720 x28: dfff800000000000 x27: 1fffe000186367d5
x26: ffff0000c9134c60 x25: ffff0000dfa339c0 x24: ffff0000d9558800
x23: ffff700003ba2ec0 x22: ffff0000c31b3e00 x21: ffff0000df844758
x20: ffff0000dfa33e50 x19: 00000000fffffff4 x18: ffff80001dd16780
x17: 0000000000000000 x16: ffff80001210ac24 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001
x11: ff8080000a0fc6d4 x10: 0000000000000000 x9 : ffff80000a0fc6d4
x8 : ffff0000daaa0000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80001dd16958 x4 : 00000000ffffffff x3 : 0000000000000d40
x2 : ffff0000d5b40c00 x1 : 00000000fffffff4 x0 : 0000000000000000

Call trace:
create_pending_snapshot+0x2024/0x2634 fs/btrfs/transaction.c:1672
create_pending_snapshots+0x150/0x198 fs/btrfs/transaction.c:1868
btrfs_commit_transaction+0x10e0/0x2cd4 fs/btrfs/transaction.c:2336

create_snapshot+0x418/0x6f0 fs/btrfs/ioctl.c:835
btrfs_mksubvol+0x510/0x650 fs/btrfs/ioctl.c:985
btrfs_mksnapshot+0xc8/0x158 fs/btrfs/ioctl.c:1031
__btrfs_ioctl_snap_create+0x2e4/0x3c0 fs/btrfs/ioctl.c:2186
btrfs_ioctl_snap_create_v2+0x1a4/0x38c fs/btrfs/ioctl.c:2273

btrfs_ioctl+0x9b4/0xb08
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

Code: 52800101 97a1c360 17fffd2e 978ff45a (d4210000)

---[ end trace 0000000000000000 ]---


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot suspects this issue could be fixed by backporting the following commit:

commit df9f278239046719c91aeb59ec0afb1a99ee8b2b
git tree: upstream
Author: Filipe Manana <fdma...@suse.com>
Date: Tue Jun 13 15:42:16 2023 +0000

btrfs: do not BUG_ON on failure to get dir index for new snapshot

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=14993458e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=634e7d7365cfc22
dashboard link: https://syzkaller.appspot.com/bug?extid=c56033c8c15c08286062
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1741f105680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=164d55f5680000


Please keep in mind that other backports might be required as well.

For information about bisection process see: https://goo.gl/tpsmEJ#bisection