[v6.1] kernel BUG in btrfs_global_root_delete

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 543aff194ab6 Linux 6.1.23
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15620e9dc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=9ccbc3d5467efd1
dashboard link: https://syzkaller.appspot.com/bug?extid=b8008f15c77c682b012f
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7fe538fc87bf/disk-543aff19.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8df93997601a/vmlinux-543aff19.xz
kernel image: https://storage.googleapis.com/syzbot-assets/03ad7e3bf859/Image-543aff19.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b8008f...@syzkaller.appspotmail.com

BTRFS warning (device loop4): failed to read root (objectid=9): -5
assertion failed: !tmp, in fs/btrfs/disk-io.c:1105
------------[ cut here ]------------
kernel BUG at fs/btrfs/ctree.h:3716!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 6147 Comm: syz-executor.4 Not tainted 6.1.23-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : assertfail+0x28/0x2c fs/btrfs/ctree.h:3715
lr : assertfail+0x28/0x2c fs/btrfs/ctree.h:3715
sp : ffff8000220d7140
x29: ffff8000220d7140 x28: ffff000121970000 x27: dfff800000000000
x26: ffff0000db83e000 x25: ffff0000db83e000 x24: dfff800000000000
x23: 0000000000000000 x22: ffff0001219701f7 x21: ffff0000c9edc0a0
x20: ffff0000c9edc060 x19: ffff000121970000 x18: 1fffe000368bab76
x17: ffff80001557d000 x16: ffff8000120db8f4 x15: ffff0001b45d5bbc
x14: 1ffff00002ab00b0 x13: dfff800000000000 x12: 0000000000040000
x11: 000000000003ffff x10: ffff8000258ea000 x9 : e9b54b1b1537c900
x8 : e9b54b1b1537c900 x7 : ffff80000827a538 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff80000aa69f4c
x2 : ffff0001b45d5cd0 x1 : 0000000100000000 x0 : 0000000000000032
Call trace:
assertfail+0x28/0x2c fs/btrfs/ctree.h:3715
btrfs_global_root_delete+0x0/0x70 fs/btrfs/disk-io.c:1105
load_global_roots_objectid+0x3e0/0x808 fs/btrfs/disk-io.c:2467
load_global_roots fs/btrfs/disk-io.c:2501 [inline]
btrfs_read_roots fs/btrfs/disk-io.c:2528 [inline]
init_tree_roots+0x7d4/0x1774 fs/btrfs/disk-io.c:2947
open_ctree+0x145c/0x23d0 fs/btrfs/disk-io.c:3643
btrfs_fill_super+0x1b4/0x2c8 fs/btrfs/super.c:1461
btrfs_mount_root+0x754/0x868 fs/btrfs/super.c:1829
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1553
fc_mount fs/namespace.c:1043 [inline]
vfs_kern_mount+0xdc/0x178 fs/namespace.c:1073
btrfs_mount+0x328/0x9b8 fs/btrfs/super.c:1889
legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1553
do_new_mount+0x25c/0x8c8 fs/namespace.c:3040
path_mount+0x590/0xe58 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__arm64_sys_mount+0x45c/0x594 fs/namespace.c:3568
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581
Code: 91370000 b0002aa2 91078042 97fff921 (d4210000)
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: fa74641fb6b9 Linux 6.1.29
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1472d5d9280000
kernel config: https://syzkaller.appspot.com/x/.config?x=7454aa89ac475d7b

dashboard link: https://syzkaller.appspot.com/bug?extid=b8008f15c77c682b012f
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1743e141280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12874141280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/53e4da6b145c/disk-fa74641f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/adeb1a2cfa86/vmlinux-fa74641f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c976f1155d08/Image-fa74641f.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/9b52dea12d24/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b8008f...@syzkaller.appspotmail.com

BTRFS error (device loop0): parent transid verify failed on logical 5255168 mirror 1 wanted 5 found 7
BTRFS warning (device loop0): couldn't read tree root

assertion failed: !tmp, in fs/btrfs/disk-io.c:1105
------------[ cut here ]------------
kernel BUG at fs/btrfs/ctree.h:3716!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:

CPU: 1 PID: 4217 Comm: syz-executor417 Not tainted 6.1.29-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023

pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : assertfail+0x28/0x2c fs/btrfs/ctree.h:3715
lr : assertfail+0x28/0x2c fs/btrfs/ctree.h:3715

sp : ffff80001da57140
x29: ffff80001da57140 x28: ffff0000d7d54000 x27: dfff800000000000
x26: ffff0000d810c000 x25: ffff0000d810c000 x24: dfff800000000000
x23: 0000000000000000 x22: ffff0000d7d541f7 x21: ffff0000c935c0a0
x20: ffff0000c935c060 x19: ffff0000d7d54000 x18: 1fffe000368ba376
x17: 0000000000000000 x16: ffff800008306074 x15: 0000000000000000
x14: 1ffff00002ab40b0 x13: dfff800000000000 x12: 0000000000000003
x11: ff80800008346658 x10: 0000000000000000 x9 : 27fae91faeb76900
x8 : 27fae91faeb76900 x7 : ffff8000121b8bb4 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000100000000 x0 : 0000000000000032

Call trace:
assertfail+0x28/0x2c fs/btrfs/ctree.h:3715
btrfs_global_root_delete+0x0/0x70 fs/btrfs/disk-io.c:1105

load_global_roots_objectid+0x3e0/0x808 fs/btrfs/disk-io.c:2481
load_global_roots fs/btrfs/disk-io.c:2515 [inline]
btrfs_read_roots fs/btrfs/disk-io.c:2542 [inline]
init_tree_roots+0x7d4/0x1774 fs/btrfs/disk-io.c:2961
open_ctree+0x14d4/0x246c fs/btrfs/disk-io.c:3668
btrfs_fill_super+0x1b4/0x2c8 fs/btrfs/super.c:1465
btrfs_mount_root+0x704/0x808 fs/btrfs/super.c:1831

legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1553
fc_mount fs/namespace.c:1043 [inline]
vfs_kern_mount+0xdc/0x178 fs/namespace.c:1073

btrfs_mount+0x328/0x9b8 fs/btrfs/super.c:1891

legacy_get_tree+0xd4/0x16c fs/fs_context.c:610
vfs_get_tree+0x90/0x274 fs/super.c:1553
do_new_mount+0x25c/0x8c8 fs/namespace.c:3040
path_mount+0x590/0xe58 fs/namespace.c:3370
do_mount fs/namespace.c:3383 [inline]
__do_sys_mount fs/namespace.c:3591 [inline]
__se_sys_mount fs/namespace.c:3568 [inline]
__arm64_sys_mount+0x45c/0x594 fs/namespace.c:3568
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

Code: 91188000 b0002b22 91268042 97fff921 (d4210000)

---[ end trace 0000000000000000 ]---


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 4389fb6b6a9d31704cc576b7671b6dfe9ac9f966
Author: Qu Wenruo <w...@suse.com>
Date: Sun Jun 11 00:09:13 2023 +0000

btrfs: do not ASSERT() on duplicated global roots

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=13fd45d9a80000
start commit: d2869ace6eeb Linux 6.1.31
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=11263f470b7a4c92
dashboard link: https://syzkaller.appspot.com/bug?extid=b8008f15c77c682b012f
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16669735280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13b76aa5280000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: btrfs: do not ASSERT() on duplicated global roots

For information about bisection process see: https://goo.gl/tpsmEJ#bisection