[v5.15] WARNING in btrfs_chunk_alloc (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: b911329317b4 Linux 5.15.133
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1055b9e4680000
kernel config: https://syzkaller.appspot.com/x/.config?x=c21a1ede2e21ef2f
dashboard link: https://syzkaller.appspot.com/bug?extid=35296bd1d0474bc662a2
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0d67112bfdd3/disk-b9113293.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/54ed715e08ee/vmlinux-b9113293.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cec49685c149/Image-b9113293.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+35296b...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 1 PID: 299 at fs/btrfs/block-group.c:3487 do_chunk_alloc fs/btrfs/block-group.c:3487 [inline]
WARNING: CPU: 1 PID: 299 at fs/btrfs/block-group.c:3487 btrfs_chunk_alloc+0x8f8/0xcdc fs/btrfs/block-group.c:3710
Modules linked in:
CPU: 1 PID: 299 Comm: kworker/u4:4 Not tainted 5.15.133-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
Workqueue: events_unbound btrfs_async_reclaim_metadata_space
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : do_chunk_alloc fs/btrfs/block-group.c:3487 [inline]
pc : btrfs_chunk_alloc+0x8f8/0xcdc fs/btrfs/block-group.c:3710
lr : do_chunk_alloc fs/btrfs/block-group.c:3487 [inline]
lr : btrfs_chunk_alloc+0x8f8/0xcdc fs/btrfs/block-group.c:3710
sp : ffff80001c896660
x29: ffff80001c8966c0 x28: ffff0000ccb2d6e0 x27: 0000000000000005
x26: ffffffffffffffe4 x25: ffff0000ccb2d72b x24: ffff000124a60868
x23: 00000000ffffffe4 x22: 1fffe00019965ae7 x21: ffff0000c1d46000
x20: dfff800000000000 x19: ffff0000d821a800 x18: 0000000000000001
x17: ff80800008334ddc x16: ffff800011963fa4 x15: ffff800008334ddc
x14: 00000000ffffffff x13: ffffffffffffffff x12: 0000000000000000
x11: ff8080000832c8d0 x10: 0000000000000000 x9 : b68e37adee3a8a00
x8 : b68e37adee3a8a00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80001c895dd8 x4 : ffff8000149dfb80 x3 : ffff80000854d548
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000026
Call trace:
do_chunk_alloc fs/btrfs/block-group.c:3487 [inline]
btrfs_chunk_alloc+0x8f8/0xcdc fs/btrfs/block-group.c:3710
find_free_extent_update_loop fs/btrfs/extent-tree.c:4038 [inline]
find_free_extent+0x324c/0x44e8 fs/btrfs/extent-tree.c:4401
btrfs_reserve_extent+0x1b4/0x43c fs/btrfs/extent-tree.c:4482
cow_file_range+0x4f0/0xb74 fs/btrfs/inode.c:1181
btrfs_run_delalloc_range+0x314/0x12cc fs/btrfs/inode.c:2018
writepage_delalloc+0x1d4/0x434 fs/btrfs/extent_io.c:3802
__extent_writepage+0x624/0xcbc fs/btrfs/extent_io.c:4108
extent_write_cache_pages fs/btrfs/extent_io.c:5030 [inline]
extent_writepages+0x9b0/0x1268 fs/btrfs/extent_io.c:5157
btrfs_writepages+0x28/0x38 fs/btrfs/inode.c:8575
do_writepages+0x39c/0x5ec mm/page-writeback.c:2364
filemap_fdatawrite_wbc+0x1c8/0x228 mm/filemap.c:400
start_delalloc_inodes+0x630/0xa30 fs/btrfs/inode.c:10071
btrfs_start_delalloc_roots+0x5e4/0x898 fs/btrfs/inode.c:10150
shrink_delalloc fs/btrfs/space-info.c:538 [inline]
flush_space+0x5b0/0xc94 fs/btrfs/space-info.c:646
btrfs_async_reclaim_metadata_space+0x6c8/0x80c fs/btrfs/space-info.c:953
process_one_work+0x790/0x11b8 kernel/workqueue.c:2310
worker_thread+0x910/0x1034 kernel/workqueue.c:2457
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
irq event stamp: 5422232
hardirqs last enabled at (5422231): [<ffff80000832aa68>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257
hardirqs last disabled at (5422232): [<ffff80001195f638>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (5422132): [<ffff800008020ccc>] softirq_handle_end kernel/softirq.c:401 [inline]
softirqs last enabled at (5422132): [<ffff800008020ccc>] __do_softirq+0xb5c/0xe20 kernel/softirq.c:587
softirqs last disabled at (5422123): [<ffff8000081b56d4>] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
softirqs last disabled at (5422123): [<ffff8000081b56d4>] invoke_softirq kernel/softirq.c:439 [inline]
softirqs last disabled at (5422123): [<ffff8000081b56d4>] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:637
---[ end trace 35a3dbb5f41c86ae ]---
BTRFS: error (device loop3) in do_chunk_alloc:3487: errno=-28 No space left
BTRFS info (device loop3): forced readonly
BTRFS: error (device loop3) in btrfs_create_pending_block_groups:2427: errno=-28 No space left


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: b911329317b4 Linux 5.15.133
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=11faf832680000

kernel config: https://syzkaller.appspot.com/x/.config?x=c21a1ede2e21ef2f
dashboard link: https://syzkaller.appspot.com/bug?extid=35296bd1d0474bc662a2
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=142f1f96680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0d67112bfdd3/disk-b9113293.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/54ed715e08ee/vmlinux-b9113293.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cec49685c149/Image-b9113293.gz.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/249cf9d91763/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+35296b...@syzkaller.appspotmail.com

------------[ cut here ]------------

WARNING: CPU: 1 PID: 4082 at fs/btrfs/block-group.c:3487 do_chunk_alloc fs/btrfs/block-group.c:3487 [inline]
WARNING: CPU: 1 PID: 4082 at fs/btrfs/block-group.c:3487 btrfs_chunk_alloc+0x8f8/0xcdc fs/btrfs/block-group.c:3710
Modules linked in:
CPU: 1 PID: 4082 Comm: kworker/u4:6 Not tainted 5.15.133-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
Workqueue: events_unbound btrfs_async_reclaim_metadata_space
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : do_chunk_alloc fs/btrfs/block-group.c:3487 [inline]
pc : btrfs_chunk_alloc+0x8f8/0xcdc fs/btrfs/block-group.c:3710
lr : do_chunk_alloc fs/btrfs/block-group.c:3487 [inline]
lr : btrfs_chunk_alloc+0x8f8/0xcdc fs/btrfs/block-group.c:3710

sp : ffff80001d4e6660
x29: ffff80001d4e66c0 x28: ffff0000dc7720b0 x27: 0000000000000005
x26: ffffffffffffffe4 x25: ffff0000dc7720fb x24: ffff0000eb9ec868
x23: 00000000ffffffe4 x22: 1fffe0001b8ee421 x21: ffff0000d7f8f000
x20: dfff800000000000 x19: ffff0000d24c1000 x18: 0000000000000001

x17: ff80800008334ddc x16: ffff800011963fa4 x15: ffff800008334ddc
x14: 00000000ffffffff x13: ffffffffffffffff x12: 0000000000000000

x11: ff8080000832c8d0 x10: 0000000000000000 x9 : b97dff3443db0c00
x8 : b97dff3443db0c00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80001d4e5dd8 x4 : ffff8000149dfb80 x3 : ffff80000854d548

irq event stamp: 2553680
hardirqs last enabled at (2553679): [<ffff80000832aa68>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:257
hardirqs last disabled at (2553680): [<ffff80001195f638>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (2553448): [<ffff800011306480>] spin_unlock_bh include/linux/spinlock.h:408 [inline]
softirqs last enabled at (2553448): [<ffff800011306480>] ieee80211_ibss_work+0x2d8/0x1230 net/mac80211/ibss.c:1706
softirqs last disabled at (2553446): [<ffff800011306280>] spin_lock_bh include/linux/spinlock.h:368 [inline]
softirqs last disabled at (2553446): [<ffff800011306280>] ieee80211_ibss_work+0xd8/0x1230 net/mac80211/ibss.c:1695
---[ end trace 4ed810988d23591d ]---
BTRFS: error (device loop0) in do_chunk_alloc:3487: errno=-28 No space left
BTRFS info (device loop0): forced readonly


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.