[moderation] [fs?] WARNING in minix_put_super

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 6f3ed7fec72f Merge tag 'for-7.1/dm-fixes-3' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1726c52e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b4166e8ea5fbf7e3
dashboard link: https://syzkaller.appspot.com/bug?extid=3c725dacd2ab78449ffc
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
CC: [linux-...@vger.kernel.org linux-...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-6f3ed7fe.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3810c8d15f8e/vmlinux-6f3ed7fe.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e1a03916d507/bzImage-6f3ed7fe.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3c725d...@syzkaller.appspotmail.com

loop0: detected capacity change from 0 to 64
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
minix_free_block (loop0:6): bit already cleared
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
minix_free_block (loop0:7): bit already cleared
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
Trying to free block not in datazone
minix_free_block (loop0:6): bit already cleared
Buffer I/O error on dev loop0, logical block 1, lost sync page write
Buffer I/O error on dev loop0, logical block 30, lost sync page write
------------[ cut here ]------------
!buffer_uptodate(bh)
WARNING: fs/buffer.c:1087 at mark_buffer_dirty+0x299/0x410 fs/buffer.c:1087, CPU#0: syz.0.0/5330
Modules linked in:
CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:mark_buffer_dirty+0x299/0x410 fs/buffer.c:1087
Code: 4c 89 f7 e8 99 6b da ff 49 8b 3e be 40 00 00 00 5b 41 5c 41 5e 41 5f 5d e9 64 63 fb ff e8 7f 87 6d ff eb 8c e8 78 87 6d ff 90 <0f> 0b 90 e9 a5 fd ff ff e8 6a 87 6d ff 90 0f 0b 90 e9 cf fd ff ff
RSP: 0018:ffffc9000df47c80 EFLAGS: 00010287
RAX: ffffffff82583e98 RBX: ffff888046f45910 RCX: 0000000000100000
RDX: ffffc9000eef2000 RSI: 0000000000007f38 RDI: 0000000000007f39
RBP: 0000000000000001 R08: ffff888046f45917 R09: 1ffff11008de8b22
R10: dffffc0000000000 R11: ffffed1008de8b23 R12: 1ffff110024218c5
R13: ffff888039007c00 R14: ffff88801210c628 R15: ffff888039007c48
FS: 00007fb7faa916c0(0000) GS:ffff88808c891000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000002000 CR3: 0000000012a60000 CR4: 0000000000352ef0
Call Trace:
<TASK>
minix_put_super+0x16d/0x460 fs/minix/inode.c:68
generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
kill_block_super+0x44/0x90 fs/super.c:1725
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0x193/0x680 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x353/0x580 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb7f9b9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb7faa90fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000004c
RAX: 0000000000000000 RBX: 00007fb7f9e15fa0 RCX: 00007fb7f9b9ce59
RDX: 0000000000000000 RSI: 00000000003a6801 RDI: 0000200000000080
RBP: 00007fb7f9c32d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb7f9e16038 R14: 00007fb7f9e15fa0 R15: 00007ffcab75f008
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup