WARNING in mark_buffer_dirty (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 21ad423fe521 Linux 4.14.265
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10c40d84700000
kernel config: https://syzkaller.appspot.com/x/.config?x=f79494e54ef9cb67
dashboard link: https://syzkaller.appspot.com/bug?extid=d459c405b646d7baa326
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13c1d2c2700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1145b6c2700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d459c4...@syzkaller.appspotmail.com

BFS-fs: bfs_fill_super(): loop4 is unclean, continuing
BFS-fs: bfs_fill_super(): loop5 is unclean, continuing
BFS-fs: bfs_fill_super(): loop2 is unclean, continuing
audit: type=1804 audit(1644480899.183:2): pid=7996 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor381" name="/root/file0/bus" dev="loop1" ino=3 res=1
------------[ cut here ]------------
WARNING: CPU: 1 PID: 8001 at fs/buffer.c:1149 mark_buffer_dirty+0x347/0x480 fs/buffer.c:1149
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 8001 Comm: syz-executor381 Not tainted 4.14.265-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
audit: type=1804 audit(1644480899.213:3): pid=8009 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor381" name="/root/file0/bus" dev="loop2" ino=3 res=1
__warn.cold+0x20/0x44 kernel/panic.c:547
report_bug+0x208/0x250 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:mark_buffer_dirty+0x347/0x480 fs/buffer.c:1149
RSP: 0018:ffff8880b36df450 EFLAGS: 00010297
audit: type=1804 audit(1644480899.223:4): pid=8008 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor381" name="/root/file0/bus" dev="loop5" ino=3 res=1
audit: type=1804 audit(1644480899.223:5): pid=8001 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor381" name="/root/file0/bus" dev="loop5" ino=3 res=1
RAX: ffff8880963ce000 RBX: ffff88808d3c09d8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88808c700400 RDI: ffff88808d3c09d8
RBP: ffffed1012b719c5 R08: 0000000000000001 R09: ffffed10118d853f
R10: ffff88808c6c29ff R11: 0000000000000000 R12: 0000000000000009
R13: ffff888095b8cd00 R14: ffff88808d3c09d8 R15: ffff88808d3bed20
bfs_move_block fs/bfs/file.c:43 [inline]
bfs_move_blocks fs/bfs/file.c:56 [inline]
bfs_get_block+0x35c/0xaf0 fs/bfs/file.c:125
__block_write_begin_int+0x35c/0x1090 fs/buffer.c:2038
audit: type=1804 audit(1644480899.223:6): pid=8001 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor381" name="/root/file0/bus" dev="loop5" ino=3 res=1
__block_write_begin fs/buffer.c:2088 [inline]
block_write_begin+0x58/0x270 fs/buffer.c:2147
bfs_write_begin+0x35/0xc0 fs/bfs/file.c:177
generic_perform_write+0x1c9/0x420 mm/filemap.c:3055
audit: type=1804 audit(1644480899.223:7): pid=7995 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="ToMToU" comm="syz-executor381" name="/root/file0/bus" dev="loop1" ino=3 res=1
audit: type=1804 audit(1644480899.223:8): pid=8005 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor381" name="/root/file0/bus" dev="loop0" ino=3 res=1
__generic_file_write_iter+0x227/0x590 mm/filemap.c:3180
generic_file_write_iter+0x36f/0x650 mm/filemap.c:3208
audit: type=1804 audit(1644480899.223:9): pid=8027 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor381" name="/root/file0/bus" dev="loop1" ino=3 res=1
call_write_iter include/linux/fs.h:1780 [inline]
new_sync_write fs/read_write.c:469 [inline]
__vfs_write+0x44c/0x630 fs/read_write.c:482
audit: type=1804 audit(1644480899.223:10): pid=8031 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor381" name="/root/file0/bus" dev="loop0" ino=3 res=1
__kernel_write+0xf5/0x330 fs/read_write.c:501
audit: type=1804 audit(1644480899.223:11): pid=8033 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor381" name="/root/file0/bus" dev="loop0" ino=3 res=1
write_pipe_buf+0x143/0x1c0 fs/splice.c:797
splice_from_pipe_feed fs/splice.c:502 [inline]
__splice_from_pipe+0x326/0x7a0 fs/splice.c:626
splice_from_pipe fs/splice.c:661 [inline]
default_file_splice_write+0xc5/0x150 fs/splice.c:809
do_splice_from fs/splice.c:851 [inline]
direct_splice_actor+0x115/0x160 fs/splice.c:1018
splice_direct_to_actor+0x27c/0x730 fs/splice.c:973
do_splice_direct+0x164/0x210 fs/splice.c:1061
do_sendfile+0x47f/0xb30 fs/read_write.c:1441
SYSC_sendfile64 fs/read_write.c:1502 [inline]
SyS_sendfile64+0xff/0x110 fs/read_write.c:1488
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f4ce4db9639
RSP: 002b:00007f4ce4d662f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f4ce4e3e420 RCX: 00007f4ce4db9639
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003
RBP: 00007f4ce4e0b0bc R08: 0000000000000000 R09: 0000000000000000
R10: 00008400fffffffa R11: 0000000000000246 R12: 0030656c69662f2e
R13: 000010011badface R14: 75ca34411a118209 R15: 00007f4ce4e3e428
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches