[syzbot] [btrfs?] kernel BUG in __extent_writepage_io

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 8bc9e6515183 Merge tag 'devicetree-for-6.7' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10e087a0e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=c3aadb4391bbacce
dashboard link: https://syzkaller.appspot.com/bug?extid=06006fc4a90bff8e8f17
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6c9b9f6781b1/disk-8bc9e651.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/44acae63a945/vmlinux-8bc9e651.xz
kernel image: https://storage.googleapis.com/syzbot-assets/f0058df8ab69/bzImage-8bc9e651.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+06006f...@syzkaller.appspotmail.com

assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1351
------------[ cut here ]------------
kernel BUG at fs/btrfs/extent_io.c:1351!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6580 Comm: syz-executor.3 Not tainted 6.6.0-syzkaller-06824-g8bc9e6515183 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
RIP: 0010:__extent_writepage_io+0xcce/0xcf0 fs/btrfs/extent_io.c:1351
Code: 18 83 70 07 0f 0b e8 a1 0c f2 fd 48 c7 c7 c0 b6 8b 8b 48 c7 c6 c0 c3 8b 8b 48 c7 c2 60 b6 8b 8b b9 47 05 00 00 e8 f2 82 70 07 <0f> 0b e8 7b 0c f2 fd 48 8b 3c 24 e8 82 2a 01 00 48 89 c7 48 c7 c6
RSP: 0018:ffffc90003eef3a0 EFLAGS: 00010246
RAX: 000000000000004e RBX: 0000000000000000 RCX: f5edcbbfef5d6800
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: fffffffffffffffd R08: ffffffff81717a4c R09: 1ffff920007dde14
R10: dffffc0000000000 R11: fffff520007dde15 R12: 0000000000002000
R13: 0000000000002000 R14: ffffea0000db97e8 R15: ffff88801ce9b4e0
FS: 00007f2d500396c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9b8a757f28 CR3: 0000000062c62000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__extent_writepage fs/btrfs/extent_io.c:1441 [inline]
extent_write_cache_pages fs/btrfs/extent_io.c:2103 [inline]
extent_writepages+0x149b/0x2e50 fs/btrfs/extent_io.c:2225
do_writepages+0x3a6/0x670 mm/page-writeback.c:2553
filemap_fdatawrite_wbc+0x125/0x180 mm/filemap.c:390
__filemap_fdatawrite_range mm/filemap.c:423 [inline]
__filemap_fdatawrite mm/filemap.c:429 [inline]
filemap_flush+0x11e/0x170 mm/filemap.c:456
btrfs_release_file+0x117/0x130 fs/btrfs/file.c:1726
__fput+0x3cc/0xa10 fs/file_table.c:394
task_work_run+0x24a/0x300 kernel/task_work.c:180
get_signal+0x166e/0x1840 kernel/signal.c:2691
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:309
exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:168
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x64/0x280 kernel/entry/common.c:296
do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f2d4f27cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2d500390c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: fffffffffffffffc RBX: 00007f2d4f39c120 RCX: 00007f2d4f27cae9
RDX: 0000000000000000 RSI: 000000000014927e RDI: 0000000020000180
RBP: 00007f2d4f2c847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f2d4f39c120 R15: 00007ffcbb50d888
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__extent_writepage_io+0xcce/0xcf0 fs/btrfs/extent_io.c:1351
Code: 18 83 70 07 0f 0b e8 a1 0c f2 fd 48 c7 c7 c0 b6 8b 8b 48 c7 c6 c0 c3 8b 8b 48 c7 c2 60 b6 8b 8b b9 47 05 00 00 e8 f2 82 70 07 <0f> 0b e8 7b 0c f2 fd 48 8b 3c 24 e8 82 2a 01 00 48 89 c7 48 c7 c6
RSP: 0018:ffffc90003eef3a0 EFLAGS: 00010246
RAX: 000000000000004e RBX: 0000000000000000 RCX: f5edcbbfef5d6800
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: fffffffffffffffd R08: ffffffff81717a4c R09: 1ffff920007dde14
R10: dffffc0000000000 R11: fffff520007dde15 R12: 0000000000002000
R13: 0000000000002000 R14: ffffea0000db97e8 R15: ffff88801ce9b4e0
FS: 00007f2d500396c0(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30c22000 CR3: 0000000062c62000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: eaadbbaaff74 Merge tag 'fuse-fixes-6.7-rc6' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15f9a15ce80000
kernel config: https://syzkaller.appspot.com/x/.config?x=53ec3da1d259132f

dashboard link: https://syzkaller.appspot.com/bug?extid=06006fc4a90bff8e8f17
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12cc9deae80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2a3a26b045d0/disk-eaadbbaa.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7ca3ec5e1332/vmlinux-eaadbbaa.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c8cfd867e4c2/bzImage-eaadbbaa.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/fafd72a5cce8/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+06006f...@syzkaller.appspotmail.com

assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1356
------------[ cut here ]------------
kernel BUG at fs/btrfs/extent_io.c:1356!

invalid opcode: 0000 [#1] PREEMPT SMP KASAN

CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.7.0-rc5-syzkaller-00030-geaadbbaaff74 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Workqueue: writeback wb_workfn (flush-btrfs-137)
RIP: 0010:__extent_writepage_io+0xcd5/0xd00 fs/btrfs/extent_io.c:1356
Code: 77 07 90 0f 0b e8 fb 23 f1 fd 48 c7 c7 80 c5 ab 8b 48 c7 c6 80 d2 ab 8b 48 c7 c2 20 c5 ab 8b b9 4c 05 00 00 e8 7c 49 77 07 90 <0f> 0b e8 d4 23 f1 fd 48 8b 3c 24 e8 db 22 01 00 48 89 c7 48 c7 c6
RSP: 0018:ffffc90000116f40 EFLAGS: 00010246
RAX: 000000000000004e RBX: 0000000000000000 RCX: 759e2408fa89b300

RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000

RBP: fffffffffffffffd R08: ffffffff81713a3c R09: 1ffff92000022d3c
R10: dffffc0000000000 R11: fffff52000022d3d R12: 0000000000007000
R13: 0000000000007000 R14: ffffea00019cd168 R15: ffff888027a0b680
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f54a22c2723 CR3: 000000001d013000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

__extent_writepage fs/btrfs/extent_io.c:1446 [inline]
extent_write_cache_pages fs/btrfs/extent_io.c:2108 [inline]
extent_writepages+0x1260/0x26a0 fs/btrfs/extent_io.c:2230
do_writepages+0x3a6/0x670 mm/page-writeback.c:2553
__writeback_single_inode+0x155/0xfc0 fs/fs-writeback.c:1625
writeback_sb_inodes+0x8e3/0x1220 fs/fs-writeback.c:1916
wb_writeback+0x44d/0xc70 fs/fs-writeback.c:2092
wb_do_writeback fs/fs-writeback.c:2239 [inline]
wb_workfn+0x400/0xfb0 fs/fs-writeback.c:2279
process_one_work kernel/workqueue.c:2627 [inline]
process_scheduled_works+0x90f/0x1420 kernel/workqueue.c:2700
worker_thread+0xa5f/0x1000 kernel/workqueue.c:2781
kthread+0x2d3/0x370 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242

</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---

RIP: 0010:__extent_writepage_io+0xcd5/0xd00 fs/btrfs/extent_io.c:1356
Code: 77 07 90 0f 0b e8 fb 23 f1 fd 48 c7 c7 80 c5 ab 8b 48 c7 c6 80 d2 ab 8b 48 c7 c2 20 c5 ab 8b b9 4c 05 00 00 e8 7c 49 77 07 90 <0f> 0b e8 d4 23 f1 fd 48 8b 3c 24 e8 db 22 01 00 48 89 c7 48 c7 c6
RSP: 0018:ffffc90000116f40 EFLAGS: 00010246
RAX: 000000000000004e RBX: 0000000000000000 RCX: 759e2408fa89b300

RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000

RBP: fffffffffffffffd R08: ffffffff81713a3c R09: 1ffff92000022d3c
R10: dffffc0000000000 R11: fffff52000022d3d R12: 0000000000007000
R13: 0000000000007000 R14: ffffea00019cd168 R15: ffff888027a0b680
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fac72b5f000 CR3: 000000001d013000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has bisected this issue to:

commit 95848dcb9d676738411a8ff70a9704039f1b3982
Author: Christoph Hellwig <h...@lst.de>
Date: Sat Aug 5 05:55:37 2023 +0000

zram: take device and not only bvec offset into account

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1325355ce80000
start commit: eaadbbaaff74 Merge tag 'fuse-fixes-6.7-rc6' of git://git.k..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=10a5355ce80000
console output: https://syzkaller.appspot.com/x/log.txt?x=1725355ce80000

kernel config: https://syzkaller.appspot.com/x/.config?x=53ec3da1d259132f
dashboard link: https://syzkaller.appspot.com/bug?extid=06006fc4a90bff8e8f17

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12cc9deae80000

Reported-by: syzbot+06006f...@syzkaller.appspotmail.com
Fixes: 95848dcb9d67 ("zram: take device and not only bvec offset into account")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[David Sterba]

On Sun, Nov 05, 2023 at 05:31:27PM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 8bc9e6515183 Merge tag 'devicetree-for-6.7' of git://git.k..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=10e087a0e80000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c3aadb4391bbacce
> dashboard link: https://syzkaller.appspot.com/bug?extid=06006fc4a90bff8e8f17
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/6c9b9f6781b1/disk-8bc9e651.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/44acae63a945/vmlinux-8bc9e651.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/f0058df8ab69/bzImage-8bc9e651.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+06006f...@syzkaller.appspotmail.com

#syz fix: btrfs: don't drop extent_map for free space inode on write error

We were not aware that syzbot also hit the problem, we got report from
our CI so the auto close tags was missing.