[v5.15] kernel BUG in reiserfs_rename

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ddcaf4999061 Linux 5.15.147
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=176eeae3e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=ab92786ed9f7c373
dashboard link: https://syzkaller.appspot.com/bug?extid=11df545e92267a446a5e
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16afb143e80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10639d43e80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/9f538e3b5b6b/disk-ddcaf499.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/aff958e6c838/vmlinux-ddcaf499.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b812c40b66fa/Image-ddcaf499.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/c56cf5871760/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+11df54...@syzkaller.appspotmail.com

REISERFS (device loop3): Remounting filesystem read-only
REISERFS panic (device loop3): vs-7050 reiserfs_rename: new entry is found, new inode == 0
------------[ cut here ]------------
kernel BUG at fs/reiserfs/prints.c:390!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4883 Comm: syz-executor113 Not tainted 5.15.147-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __reiserfs_panic+0x150/0x154 fs/reiserfs/prints.c:384
lr : __reiserfs_panic+0x150/0x154 fs/reiserfs/prints.c:384
sp : ffff80001ccc7120
x29: ffff80001ccc71e0 x28: ffff80001ccc74a0 x27: ffff80001ccc77b0
x26: ffff0000df483d58 x25: ffff0000df483d30 x24: ffff80001ccc71a0
x23: ffff80001ccc7160 x22: ffff800011bc4260 x21: ffff0000da2cc000
x20: ffff800011bc4240 x19: ffff800014063e05 x18: 0000000000000001
x17: 0000000000000000 x16: ffff80001198299c x15: 00000000ffffffff
x14: ffff0000d2f63680 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : a198e1722c00ff00
x8 : a198e1722c00ff00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff80001ccc6898 x4 : ffff8000149ff8e0 x3 : ffff80000854e290
x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000005a
Call trace:
__reiserfs_panic+0x150/0x154 fs/reiserfs/prints.c:384
reiserfs_rename+0x19d8/0x1c88 fs/reiserfs/namei.c:1427
vfs_rename+0x8b8/0xd04 fs/namei.c:4819
do_renameat2+0x9f4/0x10b0 fs/namei.c:4971
__do_sys_renameat fs/namei.c:5011 [inline]
__se_sys_renameat fs/namei.c:5008 [inline]
__arm64_sys_renameat+0xc8/0xe4 fs/namei.c:5008
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: b007c405 912700a5 aa1303e4 95c9af9a (d4210000)
---[ end trace 8820fa21b35deae3 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup