[v6.1] WARNING in ext4_write_inode

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e3a87a10f259 Linux 6.1.21
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1087f21cc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=b49b0405a60858ed
dashboard link: https://syzkaller.appspot.com/bug?extid=f6be91040d4f5b425cfd
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ed3d1f3e75e6/disk-e3a87a10.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6d8e44c8c75c/vmlinux-e3a87a10.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cebe803ea4fa/bzImage-e3a87a10.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f6be91...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 3677 at fs/ext4/inode.c:5255 ext4_write_inode+0x66b/0x740
Modules linked in:
CPU: 0 PID: 3677 Comm: syz-executor.1 Not tainted 6.1.21-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
RIP: 0010:ext4_write_inode+0x66b/0x740 fs/ext4/inode.c:5255
Code: fb ff ff ff 4d 85 ff 74 12 e8 31 68 52 ff 4c 89 ff e8 d9 5e c7 ff e9 d3 fd ff ff e8 1f 68 52 ff e9 c9 fd ff ff e8 15 68 52 ff <0f> 0b e9 bd fd ff ff e8 09 68 52 ff e9 7e fd ff ff 44 89 f1 80 e1
RSP: 0018:ffffc9000453eec0 EFLAGS: 00010293
RAX: ffffffff82371fcb RBX: 0000000000000800 RCX: ffff88807cd18000
RDX: 0000000000000000 RSI: 0000000000000800 RDI: 0000000000000000
RBP: ffffc9000453efb0 R08: ffffffff82371a20 R09: fffffbfff1ca4cde
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88803976aad0
R13: 1ffff920008a7ddc R14: 0000000000000000 R15: 0000000000400940
FS: 00005555561b8400(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9872afe000 CR3: 00000000313d2000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
write_inode fs/fs-writeback.c:1440 [inline]
__writeback_single_inode+0x67d/0x11e0 fs/fs-writeback.c:1652
writeback_single_inode+0x22c/0x960 fs/fs-writeback.c:1708
write_inode_now+0x1cf/0x260 fs/fs-writeback.c:2744
iput_final fs/inode.c:1734 [inline]
iput+0x616/0x980 fs/inode.c:1773
__dentry_kill+0x436/0x650 fs/dcache.c:607
dentry_kill+0xbb/0x290
dput+0x1ef/0x420 fs/dcache.c:913
ovl_destroy_inode+0x3c/0xe0 fs/overlayfs/super.c:214
destroy_inode fs/inode.c:309 [inline]
evict+0x542/0x620 fs/inode.c:679
__dentry_kill+0x436/0x650 fs/dcache.c:607
shrink_dentry_list+0x398/0x6a0 fs/dcache.c:1201
prune_dcache_sb+0x10b/0x170 fs/dcache.c:1282
super_cache_scan+0x33c/0x480 fs/super.c:104
do_shrink_slab+0x597/0xed0 mm/vmscan.c:846
shrink_slab_memcg mm/vmscan.c:915 [inline]
shrink_slab+0x574/0x8b0 mm/vmscan.c:994
shrink_node_memcgs mm/vmscan.c:6119 [inline]
shrink_node+0x767/0x2940 mm/vmscan.c:6148
shrink_zones mm/vmscan.c:6386 [inline]
do_try_to_free_pages+0x751/0x1a50 mm/vmscan.c:6448
try_to_free_mem_cgroup_pages+0x46f/0xb70 mm/vmscan.c:6763
reclaim_high+0x1dd/0x260 mm/memcontrol.c:2389
mem_cgroup_handle_over_high+0x146/0x2b0 mm/memcontrol.c:2574
resume_user_mode_work include/linux/resume_user_mode.h:58 [inline]
exit_to_user_mode_loop+0x96/0x100 kernel/entry/common.c:171
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:203
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:296
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f4e6bc8d567
Code: ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc8eaa4408 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffea RBX: 0000000000000000 RCX: 00007f4e6bc8d567
RDX: 00007ffc8eaa44dc RSI: 000000000000000a RDI: 00007ffc8eaa44d0
RBP: 00007ffc8eaa44d0 R08: 00000000ffffffff R09: 00007ffc8eaa42a0
R10: 00005555561b9893 R11: 0000000000000246 R12: 00007f4e6bce6b74
R13: 00007ffc8eaa5590 R14: 00005555561b9810 R15: 00007ffc8eaa55d0
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 115472395b0a Linux 5.15.104
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13e48d15c80000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5592cc4916e1c2f
dashboard link: https://syzkaller.appspot.com/bug?extid=1e7e2aa256f7e4454a95

compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/6c2c0744c7e0/disk-11547239.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7ea4c5ecca4f/vmlinux-11547239.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9a231dbcf423/bzImage-11547239.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+1e7e2a...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 3633 at fs/ext4/inode.c:5217 ext4_write_inode+0x66b/0x730
Modules linked in:
CPU: 0 PID: 3633 Comm: syz-executor.1 Not tainted 5.15.104-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023

RIP: 0010:ext4_write_inode+0x66b/0x730 fs/ext4/inode.c:5217
Code: 4b 98 64 ff 4d 85 ff 74 12 e8 41 98 64 ff 4c 89 ff e8 09 4d c9 ff e9 d3 fd ff ff e8 2f 98 64 ff e9 c9 fd ff ff e8 25 98 64 ff <0f> 0b e9 bd fd ff ff e8 19 98 64 ff e9 7e fd ff ff 44 89 f1 80 e1
RSP: 0018:ffffc90002efee80 EFLAGS: 00010293
RAX: ffffffff821b1fbb RBX: 0000000000000800 RCX: ffff88807b82d700

RDX: 0000000000000000 RSI: 0000000000000800 RDI: 0000000000000000

RBP: ffffc90002efef70 R08: ffffffff821b1a10 R09: fffffbfff1bc62ee
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88803b7ae650
R13: 1ffff920005dfdd4 R14: 0000000000000000 R15: 0000000000400940
FS: 0000555556f7c400(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000000c017467000 CR3: 00000000333a5000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

write_inode fs/fs-writeback.c:1475 [inline]
__writeback_single_inode+0x644/0xe30 fs/fs-writeback.c:1680
writeback_single_inode+0x22c/0x960 fs/fs-writeback.c:1735
write_inode_now+0x26e/0x2f0 fs/fs-writeback.c:2775
iput_final fs/inode.c:1650 [inline]
iput+0x5ce/0x8b0 fs/inode.c:1689
__dentry_kill+0x436/0x650 fs/dcache.c:582
dentry_kill+0xbb/0x290
dput+0x1f1/0x420 fs/dcache.c:888
ovl_destroy_inode+0x3c/0xe0 fs/overlayfs/super.c:213
destroy_inode fs/inode.c:286 [inline]
evict+0x542/0x620 fs/inode.c:602
__dentry_kill+0x436/0x650 fs/dcache.c:582
shrink_dentry_list+0x398/0x6a0 fs/dcache.c:1176
prune_dcache_sb+0x10b/0x170 fs/dcache.c:1257
super_cache_scan+0x33c/0x480 fs/super.c:105
do_shrink_slab+0x542/0xda0 mm/vmscan.c:758
shrink_slab_memcg mm/vmscan.c:827 [inline]
shrink_slab+0x5a1/0x960 mm/vmscan.c:906
shrink_node_memcgs mm/vmscan.c:2951 [inline]
shrink_node+0x1113/0x25d0 mm/vmscan.c:3072
shrink_zones mm/vmscan.c:3275 [inline]
do_try_to_free_pages+0x650/0x1670 mm/vmscan.c:3330
try_to_free_mem_cgroup_pages+0x44c/0xa60 mm/vmscan.c:3644
reclaim_high+0x1e6/0x270 mm/memcontrol.c:2352
mem_cgroup_handle_over_high+0x146/0x2b0 mm/memcontrol.c:2536
tracehook_notify_resume include/linux/tracehook.h:198 [inline]
exit_to_user_mode_loop+0xc3/0x130 kernel/entry/common.c:175
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x5d/0x250 kernel/entry/common.c:300
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f86db41fc68
Code: 24 18 31 c0 41 83 e2 40 75 40 89 f0 25 00 00 41 00 3d 00 00 41 00 74 32 44 89 c2 4c 89 ce bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 40 48 8b 4c 24 18 64 48 2b 0c 25 28 00 00 00
RSP: 002b:00007ffdebdf3770 EFLAGS: 00000287 ORIG_RAX: 0000000000000101
RAX: 0000000000000003 RBX: 00000000000001a6 RCX: 00007f86db41fc68
RDX: 0000000000090800 RSI: 00007ffdebdf4960 RDI: 00000000ffffff9c
RBP: 00007ffdebdf493c R08: 0000000000090800 R09: 00007ffdebdf4960
R10: 0000000000000000 R11: 0000000000000287 R12: 00007f86db47ab74
R13: 00007ffdebdf4960 R14: 000000000000000a R15: 00007ffdebdf49a0

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.

[syzbot]