[v5.15] WARNING in btrfs_relocate_block_group

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 471e639e59d1 Linux 5.15.117
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=142176ef280000
kernel config: https://syzkaller.appspot.com/x/.config?x=6390289bcc1381aa
dashboard link: https://syzkaller.appspot.com/bug?extid=38cedb9bc9f2e0cd20e9
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=148f8a6b280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=104cafab280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/145b7f137d72/disk-471e639e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b5bd2fcb945c/vmlinux-471e639e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/794584032e0f/bzImage-471e639e.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/34ff3301c9b5/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+38cedb...@syzkaller.appspotmail.com

BTRFS info (device loop1): balance: start -d -m
BTRFS info (device loop1): relocating block group 6881280 flags data|metadata
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3955 at fs/btrfs/relocation.c:4093 btrfs_relocate_block_group+0xc23/0xcb0
Modules linked in:
CPU: 1 PID: 3955 Comm: syz-executor228 Not tainted 5.15.117-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
RIP: 0010:btrfs_relocate_block_group+0xc23/0xcb0 fs/btrfs/relocation.c:4093
Code: bc 83 ff ff ff e9 5d fe ff ff e8 c8 13 0e fe 4c 8b 6c 24 28 e9 f1 fd ff ff e8 b9 13 0e fe 0f 0b e9 16 fd ff ff e8 ad 13 0e fe <0f> 0b e9 65 fd ff ff e8 a1 13 0e fe 0f 0b e9 b4 fd ff ff 44 89 f9
RSP: 0018:ffffc9000451fa48 EFLAGS: 00010293
RAX: ffffffff8371e5a3 RBX: 1ffff1100338b200 RCX: ffff88807e4a8000
RDX: 0000000000000000 RSI: 0000000000190000 RDI: 0000000000000000
RBP: 0000000000190000 R08: ffffffff8371e301 R09: fffff520008a3f39
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffff888019c59000 R14: ffff888019fa4010 R15: 1ffff1100338b2cd
FS: 00007efd7d1b3700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efd7c3fc000 CR3: 000000001d782000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
btrfs_relocate_chunk+0xac/0x270 fs/btrfs/volumes.c:3280
__btrfs_balance+0x185e/0x27c0 fs/btrfs/volumes.c:4010
btrfs_balance+0xd40/0x14a0 fs/btrfs/volumes.c:4400
btrfs_ioctl_balance+0x643/0x7d0 fs/btrfs/ioctl.c:4130
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7efd84629089
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efd7d1b32f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007efd846b37f0 RCX: 00007efd84629089
RDX: 00000000200003c0 RSI: 00000000c4009420 RDI: 0000000000000005
RBP: 00007efd846804ac R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0030656c69662f2e
R13: 61635f7261656c63 R14: 0100000000008001 R15: 00007efd846b37f8
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ca87e77a2ef8 Linux 6.1.34
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=10740d87280000
kernel config: https://syzkaller.appspot.com/x/.config?x=c188e92022a334b
dashboard link: https://syzkaller.appspot.com/bug?extid=b82f2cfdd0c9121adf2b

compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150270b7280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12bd880f280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/f48d514c343c/disk-ca87e77a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/563336f1f216/vmlinux-ca87e77a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2254afa3642b/bzImage-ca87e77a.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/dd7da8c26ae2/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+b82f2c...@syzkaller.appspotmail.com

BTRFS info (device loop4): balance: start -d -m
BTRFS info (device loop4): relocating block group 6881280 flags data|metadata
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5090 at fs/btrfs/relocation.c:4095 btrfs_relocate_block_group+0xcd8/0xd70
Modules linked in:
CPU: 1 PID: 5090 Comm: syz-executor169 Not tainted 6.1.34-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023

RIP: 0010:btrfs_relocate_block_group+0xcd8/0xd70 fs/btrfs/relocation.c:4095
Code: fe 48 c7 c7 a0 a4 2e 8b 48 c7 c6 40 a4 2e 8b ba 95 0f 00 00 e8 44 99 e7 06 e8 14 a5 ef fd 0f 0b e9 62 fd ff ff e8 08 a5 ef fd <0f> 0b e9 b5 fd ff ff e8 fc a4 ef fd 0f 0b e9 08 fe ff ff 44 89 e1
RSP: 0018:ffffc9000bb4fa28 EFLAGS: 00010293
RAX: ffffffff839a3048 RBX: 0000000000190000 RCX: ffff888020545940

RDX: 0000000000000000 RSI: 0000000000190000 RDI: 0000000000000000

RBP: ffff888017732068 R08: ffffffff839a2df6 R09: fffff52001769f35
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888028379000
R13: 0000000000000000 R14: ffff888079140000 R15: ffff888079140010
FS: 00007fde7761a700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00000000200025c0 CR3: 00000000214bb000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

btrfs_relocate_chunk+0x128/0x3b0 fs/btrfs/volumes.c:3296
__btrfs_balance+0x1c16/0x27d0 fs/btrfs/volumes.c:4033
btrfs_balance+0xbd7/0x1110 fs/btrfs/volumes.c:4416
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:4488
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:856

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80

entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fde7ea90089

Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fde7761a2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fde7eb1a7f0 RCX: 00007fde7ea90089

RDX: 00000000200003c0 RSI: 00000000c4009420 RDI: 0000000000000005

RBP: 00007fde7eae74ac R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0030656c69662f2e

R13: 61635f7261656c63 R14: 0100000000008001 R15: 00007fde7eb1a7f8