[v5.15] WARNING in btrfs_remove_chunk

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 8020ae3c051d Linux 5.15.103
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15625d76c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=f95b212e0ccdd4d1
dashboard link: https://syzkaller.appspot.com/bug?extid=d41a75a33304b313bf46
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6153dfa8dcc0/disk-8020ae3c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2093d52db59f/vmlinux-8020ae3c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/85041d0bd356/Image-8020ae3c.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d41a75...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 6435 at fs/btrfs/volumes.c:3192 btrfs_remove_chunk+0x12f4/0x1924 fs/btrfs/volumes.c:3192
Modules linked in:
CPU: 0 PID: 6435 Comm: syz-executor.4 Not tainted 5.15.103-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : btrfs_remove_chunk+0x12f4/0x1924 fs/btrfs/volumes.c:3192
lr : btrfs_remove_chunk+0x12f4/0x1924 fs/btrfs/volumes.c:3192
sp : ffff8000258676a0
x29: ffff800025867820 x28: ffff0000dcfa3898 x27: ffffffffffffffe4
x26: ffff0000dcfa3840 x25: ffff0000d92ba000 x24: ffff700004b0ceec
x23: dfff800000000000 x22: 1fffe000222e0a80 x21: ffff000111705400
x20: ffff0000dcfa388c x19: 00000000ffffffe4 x18: 0000000000000001
x17: ff808000083386a0 x16: ffff800011a05534 x15: ffff8000083386a0
x14: 00000000ffffffff x13: ffffffffffffffff x12: 0000000000040000
x11: 000000000003ffff x10: ffff80002294a000 x9 : f7c2435cc8063d00
x8 : f7c2435cc8063d00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800025866e18 x4 : ffff800014aa0780 x3 : ffff8000085517f0
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000026
Call trace:
btrfs_remove_chunk+0x12f4/0x1924 fs/btrfs/volumes.c:3192
btrfs_relocate_chunk+0x1d0/0x280 fs/btrfs/volumes.c:3309
__btrfs_balance+0x1214/0x1e20 fs/btrfs/volumes.c:4001
btrfs_balance+0xaa8/0x111c fs/btrfs/volumes.c:4391
btrfs_ioctl_balance+0x50c/0x7b4 fs/btrfs/ioctl.c:4125
btrfs_ioctl+0x8d4/0xa5c fs/btrfs/ioctl.c:4978
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
irq event stamp: 92118
hardirqs last enabled at (92117): [<ffff80000832e2e0>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257
hardirqs last disabled at (92118): [<ffff800011a00bc8>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (92066): [<ffff800008020e34>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (92066): [<ffff800008020e34>] __do_softirq+0xcc4/0xf60 kernel/softirq.c:587
softirqs last disabled at (91959): [<ffff8000081b7b48>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (91959): [<ffff8000081b7b48>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (91959): [<ffff8000081b7b48>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
---[ end trace 2514b3359906aa51 ]---
BTRFS: error (device loop4) in btrfs_remove_chunk:3192: errno=-28 No space left
BTRFS info (device loop4): forced readonly
BTRFS info (device loop4): 1 enospc errors during balance
BTRFS info (device loop4): balance: ended with status: -28


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 115472395b0a Linux 5.15.104
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17076715c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=e597b110d58e7b4

dashboard link: https://syzkaller.appspot.com/bug?extid=d41a75a33304b313bf46
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1105a03ec80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17d570b9c80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/76798ca1c9b6/disk-11547239.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b608633c8f5/vmlinux-11547239.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8836fafb618b/Image-11547239.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/86698df10782/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d41a75...@syzkaller.appspotmail.com

BTRFS info (device loop0): found 1 extents, stage: move data extents
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6902 at fs/btrfs/volumes.c:3192 btrfs_remove_chunk+0x11d8/0x1754 fs/btrfs/volumes.c:3192
Modules linked in:
CPU: 0 PID: 6902 Comm: syz-executor980 Not tainted 5.15.104-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : btrfs_remove_chunk+0x11d8/0x1754 fs/btrfs/volumes.c:3192
lr : btrfs_remove_chunk+0x11d8/0x1754 fs/btrfs/volumes.c:3192
sp : ffff80001e2676a0
x29: ffff80001e267820 x28: ffff0000dc3b4268 x27: ffff0000dc3b4210
x26: ffffffffffffffe4 x25: dfff800000000000 x24: ffff0000d17c1b60
x23: ffff700003c4ceec x22: 1fffe00019d6dda0 x21: ffff0000ceb6ed00
x20: ffff0000dc3b425c x19: 00000000ffffffe4 x18: 0000000000000001
x17: ff808000083335b8 x16: ffff80001193d804 x15: ffff8000083335b8
x14: 00000000ffffffff x13: ffffffffffffffff x12: 0000000000000000
x11: ff8080000832b060 x10: 0000000000000000 x9 : 8928cb737ec51c00
x8 : 8928cb737ec51c00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80001e266e18 x4 : ffff80001499f940 x3 : ffff800008549a30

x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000026
Call trace:

btrfs_remove_chunk+0x11d8/0x1754 fs/btrfs/volumes.c:3192

btrfs_relocate_chunk+0x1d0/0x280 fs/btrfs/volumes.c:3309
__btrfs_balance+0x1214/0x1e20 fs/btrfs/volumes.c:4001
btrfs_balance+0xaa8/0x111c fs/btrfs/volumes.c:4391
btrfs_ioctl_balance+0x50c/0x7b4 fs/btrfs/ioctl.c:4125
btrfs_ioctl+0x8d4/0xa5c fs/btrfs/ioctl.c:4978
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

irq event stamp: 77956
hardirqs last enabled at (77955): [<ffff8000083291f8>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257
hardirqs last disabled at (77956): [<ffff800011938e98>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (74768): [<ffff800008020ccc>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (74768): [<ffff800008020ccc>] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587
softirqs last disabled at (74755): [<ffff8000081b4ee0>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (74755): [<ffff8000081b4ee0>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (74755): [<ffff8000081b4ee0>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
---[ end trace b59bc136a87e7ebf ]---
BTRFS: error (device loop0) in btrfs_remove_chunk:3192: errno=-28 No space left
BTRFS info (device loop0): forced readonly
BTRFS info (device loop0): 1 enospc errors during balance
BTRFS info (device loop0): balance: ended with status: -30

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3b29299e5f60 Linux 6.1.22
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14ac1d99c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=bbb9a1f6f7f5a1d9
dashboard link: https://syzkaller.appspot.com/bug?extid=46c2a02bf4bd49b2de51

compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=116e7385c80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15fa09cdc80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2affbd06cbfd/disk-3b29299e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8b22d1baf827/vmlinux-3b29299e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d5e3891c88bf/Image-3b29299e.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/1cd4cc40c0b3/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+46c2a0...@syzkaller.appspotmail.com

BTRFS: device fsid e417788f-7a09-42b2-9266-8ddc5d5d35d2 devid 1 transid 8 /dev/loop5 scanned by syz-executor120 (4822)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4822 at fs/btrfs/volumes.c:3202 btrfs_remove_chunk+0x1378/0x1904 fs/btrfs/volumes.c:3202
Modules linked in:
CPU: 1 PID: 4822 Comm: syz-executor120 Not tainted 6.1.22-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

pc : btrfs_remove_chunk+0x1378/0x1904 fs/btrfs/volumes.c:3202
lr : btrfs_remove_chunk+0x1378/0x1904 fs/btrfs/volumes.c:3202
sp : ffff80001eee76a0
x29: ffff80001eee7820 x28: 0000000000100000 x27: ffff0000de0c2590
x26: dfff800000000000 x25: ffffffffffffffe4 x24: ffff0000d63d99c0
x23: ffff700003ddceec x22: 1fffe00019d429e0 x21: ffff0000cea14f00
x20: 0000000000000000 x19: 0000000000000000 x18: 1fffe000368bab76
x17: ffff80001557d000 x16: ffff8000083029c0 x15: ffff0001b45d5bbc
x14: 1ffff00002ab00b0 x13: dfff800000000000 x12: 0000000000000003
x11: ff8080000aab7e28 x10: 0000000000000003 x9 : da6e372118c71e00
x8 : da6e372118c71e00 x7 : ffff80000827b520 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : ffff80001222c140 x0 : ffff80019f104000
Call trace:
btrfs_remove_chunk+0x1378/0x1904 fs/btrfs/volumes.c:3202
btrfs_relocate_chunk+0x230/0x328 fs/btrfs/volumes.c:3325
__btrfs_balance+0x1468/0x1dc8 fs/btrfs/volumes.c:4017
btrfs_balance+0x9f0/0xe58 fs/btrfs/volumes.c:4400
btrfs_ioctl_balance+0x3e4/0x778 fs/btrfs/ioctl.c:4481
btrfs_ioctl+0x72c/0xb08 fs/btrfs/ioctl.c:5512
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl fs/ioctl.c:856 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
irq event stamp: 77582
hardirqs last enabled at (77581): [<ffff80000827b5c0>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1366 [inline]
hardirqs last enabled at (77581): [<ffff80000827b5c0>] finish_lock_switch+0xbc/0x1e8 kernel/sched/core.c:5000
hardirqs last disabled at (77582): [<ffff8000120d55ec>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (77400): [<ffff800008020d74>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last enabled at (77400): [<ffff800008020d74>] __do_softirq+0xc14/0xea0 kernel/softirq.c:600
softirqs last disabled at (77391): [<ffff80000802a948>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
---[ end trace 0000000000000000 ]---
BTRFS info (device loop5: state A): dumping space info:
BTRFS info (device loop5: state A): space_info DATA+METADATA has 1867776 free, is not full
BTRFS info (device loop5: state A): space_info total=3276800, used=61440, pinned=0, reserved=8192, may_use=1339392, readonly=0 zone_unusable=0
BTRFS info (device loop5: state A): space_info SYSTEM has 8253440 free, is not full
BTRFS info (device loop5: state A): space_info total=12451840, used=4096, pinned=0, reserved=0, may_use=0, readonly=4194304 zone_unusable=0
BTRFS info (device loop5: state A): global_block_rsv: size 917504 reserved 913408
BTRFS info (device loop5: state A): trans_block_rsv: size 262144 reserved 262144
BTRFS info (device loop5: state A): chunk_block_rsv: size 0 reserved 0
BTRFS info (device loop5: state A): delayed_block_rsv: size 0 reserved 0
BTRFS info (device loop5: state A): delayed_refs_rsv: size 524288 reserved 163840
BTRFS: error (device loop5: state A) in btrfs_remove_chunk:3202: errno=-28 No space left
BTRFS info (device loop5: state EA): forced readonly
BTRFS info (device loop5: state EA): 1 enospc errors during balance
BTRFS info (device loop5: state EA): balance: ended with status: -28

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 9628d45a06676d03482ed9cc63ba10bd343d2571
Author: Qu Wenruo <w...@suse.com>
Date: Thu Apr 6 05:00:34 2023 +0000

btrfs: scrub: reject unsupported scrub flags

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13e3f194680000
start commit: 3b29299e5f60 Linux 6.1.22
git tree: linux-6.1.y

kernel config: https://syzkaller.appspot.com/x/.config?x=bbb9a1f6f7f5a1d9
dashboard link: https://syzkaller.appspot.com/bug?extid=46c2a02bf4bd49b2de51

userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11da6835c80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17be1ca5c80000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: btrfs: scrub: reject unsupported scrub flags

For information about bisection process see: https://goo.gl/tpsmEJ#bisection