[v6.1] WARNING in btrfs_release_global_block_rsv

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3a8358583626 Linux 6.1.129
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1297bc64580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ff93ecc085d8436e
dashboard link: https://syzkaller.appspot.com/bug?extid=c49ae47da67281beb05a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3cc3985223b7/disk-3a835858.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e40398fb298b/vmlinux-3a835858.xz
kernel image: https://storage.googleapis.com/syzbot-assets/40469708dc9a/Image-3a835858.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c49ae4...@syzkaller.appspotmail.com

------------[ cut here ]------------
WARNING: CPU: 0 PID: 5153 at fs/btrfs/block-rsv.c:479 btrfs_release_global_block_rsv+0x218/0x22c fs/btrfs/block-rsv.c:479
Modules linked in:
CPU: 0 PID: 5153 Comm: syz.2.124 Not tainted 6.1.129-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : btrfs_release_global_block_rsv+0x218/0x22c fs/btrfs/block-rsv.c:479
lr : btrfs_release_global_block_rsv+0x218/0x22c fs/btrfs/block-rsv.c:479
sp : ffff8000219d7390
x29: ffff8000219d7390 x28: dead000000000100 x27: 0000000000000000
x26: 0000000000000001 x25: ffff0000f2e6c000 x24: 0000000000000000
x23: 1fffe0001e5cd832 x22: ffff0000d9b24178 x21: dfff800000000000
x20: 000000000005f000 x19: ffff0000d9b24410 x18: 1fffe00036798976
x17: ffff800015aed000 x16: ffff80000825bfc4 x15: ffff0001b3cc4bbc
x14: 1ffff00002b5e0b2 x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff80000a39d31c
x8 : ffff0000c6389bc0 x7 : ffff80000a39b9f4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000831b2fc
x2 : 0000000000000001 x1 : 000000000005f000 x0 : 0000000000000000
Call trace:
btrfs_release_global_block_rsv+0x218/0x22c fs/btrfs/block-rsv.c:479
btrfs_free_block_groups+0x938/0xc9c fs/btrfs/block-group.c:4204
close_ctree+0x5f0/0xb10 fs/btrfs/disk-io.c:4773
btrfs_put_super+0x70/0x80 fs/btrfs/super.c:397
generic_shutdown_super+0x130/0x328 fs/super.c:501
kill_anon_super+0x4c/0x74 fs/super.c:1128
btrfs_kill_super+0x40/0x58 fs/btrfs/super.c:2449
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x240/0x2f0 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x550/0x1a84 kernel/exit.c:871
do_group_exit+0x194/0x22c kernel/exit.c:1021
get_signal+0x143c/0x1528 kernel/signal.c:2871
do_signal arch/arm64/kernel/signal.c:1076 [inline]
do_notify_resume+0x2f8/0x2cb8 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_da+0xb8/0x184 arch/arm64/kernel/entry-common.c:516
el0t_64_sync_handler+0xcc/0xf0 arch/arm64/kernel/entry-common.c:658
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 72626
hardirqs last enabled at (72625): [<ffff80001231f730>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last enabled at (72625): [<ffff80001231f730>] exit_to_kernel_mode+0xe8/0x118 arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (72626): [<ffff80001231d31c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (69952): [<ffff8000081c40ac>] softirq_handle_end kernel/softirq.c:421 [inline]
softirqs last enabled at (69952): [<ffff8000081c40ac>] handle_softirqs+0xb84/0xd58 kernel/softirq.c:606
softirqs last disabled at (69793): [<ffff800008020174>] __do_softirq+0x14/0x20 kernel/softirq.c:612
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5153 at fs/btrfs/block-rsv.c:480 btrfs_release_global_block_rsv+0x224/0x22c fs/btrfs/block-rsv.c:480
Modules linked in:
CPU: 1 PID: 5153 Comm: syz.2.124 Tainted: G W 6.1.129-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : btrfs_release_global_block_rsv+0x224/0x22c fs/btrfs/block-rsv.c:480
lr : btrfs_release_global_block_rsv+0x224/0x22c fs/btrfs/block-rsv.c:480
sp : ffff8000219d7390
x29: ffff8000219d7390 x28: dead000000000100 x27: 0000000000000000
x26: 0000000000000001 x25: ffff0000f2e6c000 x24: 0000000000000000
x23: 1fffe0001e5cd832 x22: ffff0000d9b24178 x21: dfff800000000000
x20: 000000000005f000 x19: 0000000000060000 x18: 1fffe00036798976
x17: ffff800015aed000 x16: ffff80000825bfc4 x15: ffff0001b3cc4bbc
x14: 1ffff00002b5e0b2 x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff80000a39d328
x8 : ffff0000c6389bc0 x7 : ffff80000a39b9f4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000831b2fc
x2 : 0000000000000001 x1 : 0000000000060000 x0 : 0000000000000000
Call trace:
btrfs_release_global_block_rsv+0x224/0x22c fs/btrfs/block-rsv.c:480
btrfs_free_block_groups+0x938/0xc9c fs/btrfs/block-group.c:4204
close_ctree+0x5f0/0xb10 fs/btrfs/disk-io.c:4773
btrfs_put_super+0x70/0x80 fs/btrfs/super.c:397
generic_shutdown_super+0x130/0x328 fs/super.c:501
kill_anon_super+0x4c/0x74 fs/super.c:1128
btrfs_kill_super+0x40/0x58 fs/btrfs/super.c:2449
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x240/0x2f0 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x550/0x1a84 kernel/exit.c:871
do_group_exit+0x194/0x22c kernel/exit.c:1021
get_signal+0x143c/0x1528 kernel/signal.c:2871
do_signal arch/arm64/kernel/signal.c:1076 [inline]
do_notify_resume+0x2f8/0x2cb8 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_da+0xb8/0x184 arch/arm64/kernel/entry-common.c:516
el0t_64_sync_handler+0xcc/0xf0 arch/arm64/kernel/entry-common.c:658
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 72844
hardirqs last enabled at (72843): [<ffff80001231f730>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last enabled at (72843): [<ffff80001231f730>] exit_to_kernel_mode+0xe8/0x118 arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (72844): [<ffff80001231d31c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (72838): [<ffff8000081c40ac>] softirq_handle_end kernel/softirq.c:421 [inline]
softirqs last enabled at (72838): [<ffff8000081c40ac>] handle_softirqs+0xb84/0xd58 kernel/softirq.c:606
softirqs last disabled at (72631): [<ffff800008020174>] __do_softirq+0x14/0x20 kernel/softirq.c:612
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5153 at fs/btrfs/block-group.c:4216 btrfs_free_block_groups+0x9a8/0xc9c fs/btrfs/block-group.c:4215
Modules linked in:
CPU: 1 PID: 5153 Comm: syz.2.124 Tainted: G W 6.1.129-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : btrfs_free_block_groups+0x9a8/0xc9c fs/btrfs/block-group.c:4215
lr : btrfs_free_block_groups+0xbd4/0xc9c fs/btrfs/block-group.c:4215
sp : ffff8000219d73c0
x29: ffff8000219d73e0 x28: dead000000000100 x27: 0000000000000000
x26: 1fffe0001b364a27 x25: ffff0000f2e6c000 x24: 000000000005f000
x23: ffff0000f58e6000 x22: ffff0000f58e60b8 x21: ffff0000d9b25a10
x20: ffff0000d9b25138 x19: dfff800000000000 x18: 1fffe00036798976
x17: ffff800015aed000 x16: ffff80000825bfc4 x15: ffff0001b3cc4bbc
x14: 1ffff00002b5e0b2 x13: dfff800000000000 x12: 0000000000000001
x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff80000a3b6aa8
x8 : ffff0000c6389bc0 x7 : ffff80000a39b9f4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80000831b2fc
x2 : 0000000000000001 x1 : 000000000005f000 x0 : 0000000000000000
Call trace:
btrfs_free_block_groups+0x9a8/0xc9c fs/btrfs/block-group.c:4215
close_ctree+0x5f0/0xb10 fs/btrfs/disk-io.c:4773
btrfs_put_super+0x70/0x80 fs/btrfs/super.c:397
generic_shutdown_super+0x130/0x328 fs/super.c:501
kill_anon_super+0x4c/0x74 fs/super.c:1128
btrfs_kill_super+0x40/0x58 fs/btrfs/super.c:2449
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x240/0x2f0 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x550/0x1a84 kernel/exit.c:871
do_group_exit+0x194/0x22c kernel/exit.c:1021
get_signal+0x143c/0x1528 kernel/signal.c:2871
do_signal arch/arm64/kernel/signal.c:1076 [inline]
do_notify_resume+0x2f8/0x2cb8 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_da+0xb8/0x184 arch/arm64/kernel/entry-common.c:516
el0t_64_sync_handler+0xcc/0xf0 arch/arm64/kernel/entry-common.c:658
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 73140
hardirqs last enabled at (73139): [<ffff80001231f730>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last enabled at (73139): [<ffff80001231f730>] exit_to_kernel_mode+0xe8/0x118 arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (73140): [<ffff80001231d31c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (73134): [<ffff8000081c40ac>] softirq_handle_end kernel/softirq.c:421 [inline]
softirqs last enabled at (73134): [<ffff8000081c40ac>] handle_softirqs+0xb84/0xd58 kernel/softirq.c:606
softirqs last disabled at (72849): [<ffff800008020174>] __do_softirq+0x14/0x20 kernel/softirq.c:612
---[ end trace 0000000000000000 ]---
BTRFS info (device loop2): space_info DATA+METADATA has 2859008 free, is not full
BTRFS info (device loop2): space_info total=3276800, used=28672, pinned=0, reserved=0, may_use=389120, readonly=0 zone_unusable=0
BTRFS info (device loop2): global_block_rsv: size 0 reserved 0
BTRFS info (device loop2): trans_block_rsv: size 0 reserved 0
BTRFS info (device loop2): chunk_block_rsv: size 0 reserved 0
BTRFS info (device loop2): delayed_block_rsv: size 0 reserved 0
BTRFS info (device loop2): delayed_refs_rsv: size 393216 reserved 389120


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 3a8358583626 Linux 6.1.129
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=12e89c64580000

kernel config: https://syzkaller.appspot.com/x/.config?x=ff93ecc085d8436e
dashboard link: https://syzkaller.appspot.com/bug?extid=c49ae47da67281beb05a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1378d7a0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13087c64580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3cc3985223b7/disk-3a835858.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e40398fb298b/vmlinux-3a835858.xz
kernel image: https://storage.googleapis.com/syzbot-assets/40469708dc9a/Image-3a835858.gz.xz

mounted in repro #1: https://storage.googleapis.com/syzbot-assets/5578bcd21e40/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=113bd8b7980000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/97ac9047a376/mount_2.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1578d7a0580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c49ae4...@syzkaller.appspotmail.com

BTRFS info (device loop0): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4314 at fs/btrfs/block-rsv.c:479 btrfs_release_global_block_rsv+0x218/0x22c fs/btrfs/block-rsv.c:479
Modules linked in:
CPU: 1 PID: 4314 Comm: syz-executor515 Not tainted 6.1.129-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : btrfs_release_global_block_rsv+0x218/0x22c fs/btrfs/block-rsv.c:479
lr : btrfs_release_global_block_rsv+0x218/0x22c fs/btrfs/block-rsv.c:479

sp : ffff800021357390
x29: ffff800021357390 x28: dead000000000100 x27: 0000000000000000
x26: 0000000000000001 x25: ffff0000d994f000 x24: 0000000000000000
x23: 1fffe0001b329e32 x22: ffff0000dfba0178 x21: dfff800000000000
x20: 0000000000003000 x19: ffff0000dfba0410 x18: ffff800021357000
x17: ffff800018c47000 x16: ffff80000825bfc4 x15: ffff800018727f80
x14: 0000000085fe1e72 x13: dfff800000000000 x12: 0000000000000001

x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff80000a39d31c

x8 : ffff0000d9b63780 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800018dcd338 x4 : 0000000000000008 x3 : ffff80000831b2fc
x2 : 0000000000000001 x1 : 0000000000003000 x0 : 0000000000000000

Call trace:
btrfs_release_global_block_rsv+0x218/0x22c fs/btrfs/block-rsv.c:479
btrfs_free_block_groups+0x938/0xc9c fs/btrfs/block-group.c:4204
close_ctree+0x5f0/0xb10 fs/btrfs/disk-io.c:4773
btrfs_put_super+0x70/0x80 fs/btrfs/super.c:397
generic_shutdown_super+0x130/0x328 fs/super.c:501
kill_anon_super+0x4c/0x74 fs/super.c:1128
btrfs_kill_super+0x40/0x58 fs/btrfs/super.c:2449
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x240/0x2f0 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x550/0x1a84 kernel/exit.c:871
do_group_exit+0x194/0x22c kernel/exit.c:1021
get_signal+0x143c/0x1528 kernel/signal.c:2871
do_signal arch/arm64/kernel/signal.c:1076 [inline]
do_notify_resume+0x2f8/0x2cb8 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_da+0xb8/0x184 arch/arm64/kernel/entry-common.c:516
el0t_64_sync_handler+0xcc/0xf0 arch/arm64/kernel/entry-common.c:658
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

irq event stamp: 57268
hardirqs last enabled at (57267): [<ffff800008974bb8>] kasan_quarantine_put+0xdc/0x204 mm/kasan/quarantine.c:242
hardirqs last disabled at (57268): [<ffff80001231d31c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (55244): [<ffff8000081c40ac>] softirq_handle_end kernel/softirq.c:421 [inline]
softirqs last enabled at (55244): [<ffff8000081c40ac>] handle_softirqs+0xb84/0xd58 kernel/softirq.c:606
softirqs last disabled at (55233): [<ffff800008020174>] __do_softirq+0x14/0x20 kernel/softirq.c:612

---[ end trace 0000000000000000 ]---
------------[ cut here ]------------

WARNING: CPU: 1 PID: 4314 at fs/btrfs/block-rsv.c:480 btrfs_release_global_block_rsv+0x224/0x22c fs/btrfs/block-rsv.c:480
Modules linked in:
CPU: 1 PID: 4314 Comm: syz-executor515 Tainted: G W 6.1.129-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : btrfs_release_global_block_rsv+0x224/0x22c fs/btrfs/block-rsv.c:480
lr : btrfs_release_global_block_rsv+0x224/0x22c fs/btrfs/block-rsv.c:480

sp : ffff800021357390
x29: ffff800021357390 x28: dead000000000100 x27: 0000000000000000
x26: 0000000000000001 x25: ffff0000d994f000 x24: 0000000000000000
x23: 1fffe0001b329e32 x22: ffff0000dfba0178 x21: dfff800000000000
x20: 0000000000003000 x19: fffffffffff80000 x18: ffff800021357000
x17: ffff800018c47000 x16: ffff80000825bfc4 x15: ffff800018727f80
x14: 0000000085fe1e72 x13: dfff800000000000 x12: 0000000000000001

x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff80000a39d328

x8 : ffff0000d9b63780 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800018dcd338 x4 : 0000000000000008 x3 : ffff80000831b2fc
x2 : 0000000000000001 x1 : fffffffffff80000 x0 : 0000000000000000

Call trace:
btrfs_release_global_block_rsv+0x224/0x22c fs/btrfs/block-rsv.c:480
btrfs_free_block_groups+0x938/0xc9c fs/btrfs/block-group.c:4204
close_ctree+0x5f0/0xb10 fs/btrfs/disk-io.c:4773
btrfs_put_super+0x70/0x80 fs/btrfs/super.c:397
generic_shutdown_super+0x130/0x328 fs/super.c:501
kill_anon_super+0x4c/0x74 fs/super.c:1128
btrfs_kill_super+0x40/0x58 fs/btrfs/super.c:2449
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x240/0x2f0 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x550/0x1a84 kernel/exit.c:871
do_group_exit+0x194/0x22c kernel/exit.c:1021
get_signal+0x143c/0x1528 kernel/signal.c:2871
do_signal arch/arm64/kernel/signal.c:1076 [inline]
do_notify_resume+0x2f8/0x2cb8 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_da+0xb8/0x184 arch/arm64/kernel/entry-common.c:516
el0t_64_sync_handler+0xcc/0xf0 arch/arm64/kernel/entry-common.c:658
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

irq event stamp: 57304
hardirqs last enabled at (57303): [<ffff80001231f730>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last enabled at (57303): [<ffff80001231f730>] exit_to_kernel_mode+0xe8/0x118 arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (57304): [<ffff80001231d31c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (57298): [<ffff8000081c40ac>] softirq_handle_end kernel/softirq.c:421 [inline]
softirqs last enabled at (57298): [<ffff8000081c40ac>] handle_softirqs+0xb84/0xd58 kernel/softirq.c:606
softirqs last disabled at (57271): [<ffff800008020174>] __do_softirq+0x14/0x20 kernel/softirq.c:612

---[ end trace 0000000000000000 ]---
------------[ cut here ]------------

WARNING: CPU: 1 PID: 4314 at fs/btrfs/block-group.c:4216 btrfs_free_block_groups+0x9a8/0xc9c fs/btrfs/block-group.c:4215
Modules linked in:
CPU: 1 PID: 4314 Comm: syz-executor515 Tainted: G W 6.1.129-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : btrfs_free_block_groups+0x9a8/0xc9c fs/btrfs/block-group.c:4215
lr : btrfs_free_block_groups+0xbd4/0xc9c fs/btrfs/block-group.c:4215

sp : ffff8000213573c0
x29: ffff8000213573e0 x28: dead000000000100 x27: 0000000000000000
x26: 1fffe0001bf74227 x25: ffff0000d994f000 x24: 0000000000003000
x23: ffff0000d9f5a000 x22: ffff0000d9f5a0b8 x21: ffff0000dfba1a10
x20: ffff0000dfba1138 x19: dfff800000000000 x18: ffff800021357000
x17: ffff800018c47000 x16: ffff80000825bfc4 x15: ffff800018727f80
x14: 0000000085fe1e72 x13: dfff800000000000 x12: 0000000000000001

x11: 0000000000ff0100 x10: 0000000000000000 x9 : ffff80000a3b6aa8

x8 : ffff0000d9b63780 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800018dcd338 x4 : 0000000000000008 x3 : ffff80000831b2fc
x2 : 0000000000000001 x1 : 0000000000003000 x0 : 0000000000000000

Call trace:
btrfs_free_block_groups+0x9a8/0xc9c fs/btrfs/block-group.c:4215
close_ctree+0x5f0/0xb10 fs/btrfs/disk-io.c:4773
btrfs_put_super+0x70/0x80 fs/btrfs/super.c:397
generic_shutdown_super+0x130/0x328 fs/super.c:501
kill_anon_super+0x4c/0x74 fs/super.c:1128
btrfs_kill_super+0x40/0x58 fs/btrfs/super.c:2449
deactivate_locked_super+0xac/0x124 fs/super.c:332
deactivate_super+0xf0/0x110 fs/super.c:363
cleanup_mnt+0x394/0x41c fs/namespace.c:1186
__cleanup_mnt+0x20/0x30 fs/namespace.c:1193
task_work_run+0x240/0x2f0 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0x550/0x1a84 kernel/exit.c:871
do_group_exit+0x194/0x22c kernel/exit.c:1021
get_signal+0x143c/0x1528 kernel/signal.c:2871
do_signal arch/arm64/kernel/signal.c:1076 [inline]
do_notify_resume+0x2f8/0x2cb8 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_da+0xb8/0x184 arch/arm64/kernel/entry-common.c:516
el0t_64_sync_handler+0xcc/0xf0 arch/arm64/kernel/entry-common.c:658
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

irq event stamp: 57430
hardirqs last enabled at (57429): [<ffff80001231f730>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last enabled at (57429): [<ffff80001231f730>] exit_to_kernel_mode+0xe8/0x118 arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (57430): [<ffff80001231d31c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (57424): [<ffff8000081c40ac>] softirq_handle_end kernel/softirq.c:421 [inline]
softirqs last enabled at (57424): [<ffff8000081c40ac>] handle_softirqs+0xb84/0xd58 kernel/softirq.c:606
softirqs last disabled at (57309): [<ffff800008020174>] __do_softirq+0x14/0x20 kernel/softirq.c:612

---[ end trace 0000000000000000 ]---

BTRFS info (device loop0): space_info DATA+METADATA has 2981888 free, is not full
BTRFS info (device loop0): space_info total=3276800, used=282624, pinned=0, reserved=0, may_use=12288, readonly=0 zone_unusable=0
BTRFS info (device loop0): global_block_rsv: size 0 reserved 0
BTRFS info (device loop0): trans_block_rsv: size 0 reserved 0
BTRFS info (device loop0): chunk_block_rsv: size 0 reserved 0
BTRFS info (device loop0): delayed_block_rsv: size 0 reserved 0
BTRFS info (device loop0): delayed_refs_rsv: size 18446744073709027328 reserved 12288


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.