kernel BUG in rmap_walk_file

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 4010a528219e Merge tag 'fixes_for_v5.14-rc4' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=168ab062300000
kernel config: https://syzkaller.appspot.com/x/.config?x=40eef000d7648480
dashboard link: https://syzkaller.appspot.com/bug?extid=f38817d1b5a023cba3ae
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
CC: [ak...@linux-foundation.org linux-...@vger.kernel.org linu...@kvack.org]

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f38817...@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at mm/rmap.c:2343!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 130 Comm: kworker/u4:3 Not tainted 5.14.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: writeback wb_workfn (flush-8:0)
RIP: 0010:rmap_walk_file+0x44d/0x700 mm/rmap.c:2343
Code: ff 48 c7 c7 f2 ff ff ff 49 89 c5 48 89 c6 e8 ca 95 c6 ff 49 83 fd f2 0f 85 b0 fe ff ff e8 5b 90 c6 ff 48 89 ef e8 da 50 3a 07 <0f> 0b e8 4c 90 c6 ff 8b 5c 24 24 31 ff 89 de e8 7f 96 c6 ff 84 db
RSP: 0018:ffffc900013bf000 EFLAGS: 00010283
RAX: 0000000000000102 RBX: ffffc900013bf0c0 RCX: 0000000000000000
RDX: ffff8880145b1c40 RSI: ffffffff815d68c5 RDI: fffff52000277ddb
RBP: ffff888000101c60 R08: 0000000000000102 R09: 0000000000000000
R10: ffffffff815d06fe R11: 0000000000000000 R12: ffffea0001b68080
R13: fffffffffffffff2 R14: dffffc0000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000542978 CR3: 0000000014dc2000 CR4: 00000000001506f0
Call Trace:
rmap_walk+0x10d/0x190 mm/rmap.c:2367
page_mkclean+0x222/0x2c0 mm/rmap.c:1002
clear_page_dirty_for_io+0x325/0xa40 mm/page-writeback.c:2710
mpage_submit_page+0x80/0x2a0 fs/ext4/inode.c:2080
mpage_process_page_bufs+0x681/0x7a0 fs/ext4/inode.c:2214
mpage_prepare_extent_to_map+0x945/0xe50 fs/ext4/inode.c:2626
ext4_writepages+0x928/0x3ba0 fs/ext4/inode.c:2754
do_writepages+0xec/0x290 mm/page-writeback.c:2355
__writeback_single_inode+0x126/0xff0 fs/fs-writeback.c:1613
writeback_sb_inodes+0x53d/0xf00 fs/fs-writeback.c:1878
__writeback_inodes_wb+0xc6/0x280 fs/fs-writeback.c:1947
wb_writeback+0x814/0xc50 fs/fs-writeback.c:2053
wb_check_start_all fs/fs-writeback.c:2177 [inline]
wb_do_writeback fs/fs-writeback.c:2203 [inline]
wb_workfn+0xb77/0x12d0 fs/fs-writeback.c:2237
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Modules linked in:
---[ end trace b23fe14744ad764d ]---
RIP: 0010:rmap_walk_file+0x44d/0x700 mm/rmap.c:2343
Code: ff 48 c7 c7 f2 ff ff ff 49 89 c5 48 89 c6 e8 ca 95 c6 ff 49 83 fd f2 0f 85 b0 fe ff ff e8 5b 90 c6 ff 48 89 ef e8 da 50 3a 07 <0f> 0b e8 4c 90 c6 ff 8b 5c 24 24 31 ff 89 de e8 7f 96 c6 ff 84 db
RSP: 0018:ffffc900013bf000 EFLAGS: 00010283
RAX: 0000000000000102 RBX: ffffc900013bf0c0 RCX: 0000000000000000
RDX: ffff8880145b1c40 RSI: ffffffff815d68c5 RDI: fffff52000277ddb
RBP: ffff888000101c60 R08: 0000000000000102 R09: 0000000000000000
R10: ffffffff815d06fe R11: 0000000000000000 R12: ffffea0001b68080
R13: fffffffffffffff2 R14: dffffc0000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3064d0c000 CR3: 0000000034153000 CR4: 00000000001506e0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.