WARNING in btrfs_qgroup_free_meta

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 65afe34ac33d Linux 4.14.301
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16e7621f880000
kernel config: https://syzkaller.appspot.com/x/.config?x=5dfc73e3d697d68d
dashboard link: https://syzkaller.appspot.com/bug?extid=a85d516b482cdcbf2f12
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cba1bf735bc1/disk-65afe34a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/640415e88522/vmlinux-65afe34a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8c2d360d5af4/bzImage-65afe34a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a85d51...@syzkaller.appspotmail.com

NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
------------[ cut here ]------------
WARNING: CPU: 0 PID: 10788 at fs/btrfs/qgroup.c:3095 btrfs_qgroup_free_meta+0x3db/0x4d0 fs/btrfs/qgroup.c:3095
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 10788 Comm: syz-executor.1 Not tainted 4.14.301-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x44 kernel/panic.c:547
report_bug+0x208/0x250 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:967
RIP: 0010:btrfs_qgroup_free_meta+0x3db/0x4d0 fs/btrfs/qgroup.c:3095
RSP: 0018:ffff888066c7f8a0 EFLAGS: 00010216
RAX: 0000000000040000 RBX: ffff8880924de400 RCX: ffffc90006a01000
RDX: 0000000000000a45 RSI: ffffffff82b3adbb RDI: ffff8880924ded20
RBP: 0000000000005000 R08: ffffffff8b9b3fd0 R09: 0000000000000002
R10: 0000000000000000 R11: ffff8880a8aac2c0 R12: ffff888097dcc680
R13: 0000000000000005 R14: ffff8880924de958 R15: 0000000000000002
start_transaction+0x637/0xf30 fs/btrfs/transaction.c:609
btrfs_create+0xf6/0x5d0 fs/btrfs/inode.c:6761
lookup_open+0x77a/0x1750 fs/namei.c:3241
do_last fs/namei.c:3334 [inline]
path_openat+0xe08/0x2970 fs/namei.c:3571
do_filp_open+0x179/0x3c0 fs/namei.c:3605
do_sys_open+0x296/0x410 fs/open.c:1081
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3
RIP: 0033:0x7fbe7c1420d9
RSP: 002b:00007fbe7a6b4168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fbe7c261f80 RCX: 00007fbe7c1420d9
RDX: 0000000000000241 RSI: 0000000020000000 RDI: ffffffffffffff9c
RBP: 00007fbe7c19dae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc0e77a5ef R14: 00007fbe7a6b4300 R15: 0000000000022000
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: c4215ee4771b Linux 4.14.302
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16f1788b880000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a9988fe055c9527

dashboard link: https://syzkaller.appspot.com/bug?extid=a85d516b482cdcbf2f12
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12d53177880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15fec23f880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c93ba055d204/disk-c4215ee4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bfbc929a33c1/vmlinux-c4215ee4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/444658051770/bzImage-c4215ee4.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/64f4608c55bf/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a85d51...@syzkaller.appspotmail.com

BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop0
BTRFS info (device loop0): using free space tree
BTRFS info (device loop0): has skinny extents
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7987 at fs/btrfs/qgroup.c:3095 btrfs_qgroup_free_meta+0x3db/0x4d0 fs/btrfs/qgroup.c:3095
BTRFS error (device loop0): fail to start transaction for status update: -28

Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 7987 Comm: syz-executor373 Not tainted 4.14.302-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x44 kernel/panic.c:547
report_bug+0x208/0x250 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:967
RIP: 0010:btrfs_qgroup_free_meta+0x3db/0x4d0 fs/btrfs/qgroup.c:3095

RSP: 0018:ffff888099b87348 EFLAGS: 00010297
RAX: ffff88809731e680 RBX: ffff88809670a900 RCX: 0000000000001000
RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff88809670b220
RBP: 0000000000001000 R08: ffffffff8b9e08e0 R09: 0000000000000002
R10: 0000000000000000 R11: ffff88809731e680 R12: ffff8880b3061d80
R13: 0000000000000005 R14: ffff88809670ae58 R15: 0000000000000002
start_transaction+0x637/0xf30 fs/btrfs/transaction.c:609
btrfs_dirty_inode+0x166/0x1d0 fs/btrfs/inode.c:6243
btrfs_update_time+0x1ab/0x280 fs/btrfs/inode.c:6276
update_time fs/inode.c:1673 [inline]
touch_atime+0x1ed/0x250 fs/inode.c:1745
file_accessed include/linux/fs.h:2077 [inline]
generic_file_buffered_read mm/filemap.c:2210 [inline]
generic_file_read_iter+0x12a3/0x21c0 mm/filemap.c:2273
call_read_iter include/linux/fs.h:1774 [inline]
new_sync_read fs/read_write.c:401 [inline]
__vfs_read+0x449/0x620 fs/read_write.c:413
integrity_kernel_read+0x11b/0x1b0 security/integrity/iint.c:199
ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:381 [inline]
ima_calc_file_shash security/integrity/ima/ima_crypto.c:410 [inline]
ima_calc_file_hash+0x3ee/0x780 security/integrity/ima/ima_crypto.c:467
ima_collect_measurement+0x39d/0x430 security/integrity/ima/ima_api.c:227
process_measurement+0x78b/0xb20 security/integrity/ima/ima_main.c:264
do_last fs/namei.c:3435 [inline]
path_openat+0x10ad/0x2970 fs/namei.c:3571

do_filp_open+0x179/0x3c0 fs/namei.c:3605
do_sys_open+0x296/0x410 fs/open.c:1081
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x5e/0xd3

RIP: 0033:0x7fe9d0864679
RSP: 002b:00007ffe160f54d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0030656c69662f2e RCX: 00007fe9d0864679
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000280
RBP: 00007ffe160f5500 R08: 0000000037383937 R09: 0000000037383937
R10: 0000000037383937 R11: 0000000000000246 R12: 00007ffe160f55e0
R13: 00007fe9d08a10e8 R14: 00007ffe160f5500 R15: 0000000000000000