Re: [syzbot] Re: [syzbot] [btrfs?] kernel BUG in __extent_writepage_io (2)

[syzbot <syzbot+ba3c0273042a898c230e@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: Re: [syzbot] [btrfs?] kernel BUG in __extent_writepage_io (2)
Author: lizhi.xu@windriver.com

#syz test

diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 10ac5f657e38..fc6e83c6e69b 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -384,6 +384,8 @@ static void try_merge_map(struct btrfs_inode *inode, struct extent_map *em)
 		free_extent_map(merge);
 		dec_evictable_extent_maps(inode);
 	}
+	printk("em: %p, blockstart: %llu, mblockstart: %llu, merged: %d, %s\n", em,
+		extent_map_block_start(em), extent_map_block_start(merge), em->flags & EXTENT_FLAG_MERGED, __func__);
 }
 
 /*
@@ -493,7 +495,11 @@ static int add_extent_mapping(struct btrfs_inode *inode,
 	if (ret)
 		return ret;
 
+	printk("em: %p, blockstart: %llu, em refs: %d, %s\n",
+		em, extent_map_block_start(em), refcount_read(&em->refs), __func__);
 	setup_extent_mapping(inode, em, modified);
+	printk("setuped, em: %p, blockstart: %llu, em refs: %d, %s\n",
+		em, extent_map_block_start(em), refcount_read(&em->refs), __func__);
 
 	if (!btrfs_is_testing(fs_info) && is_fstree(btrfs_root_id(root)))
 		percpu_counter_inc(&fs_info->evictable_extent_maps);
@@ -743,6 +749,11 @@ int btrfs_add_extent_mapping(struct btrfs_inode *inode,
 			}
 			free_extent_map(existing);
 		}
+	} else if (!ret) {
+		if (em->flags & EXTENT_FLAG_MERGED)
+			ASSERT(extent_map_block_start(em) != EXTENT_MAP_HOLE);
+		else
+			return -EINVAL;
 	}
 
 	ASSERT(ret == 0 || ret == -EEXIST);
diff --git a/fs/btrfs/extent_map.h b/fs/btrfs/extent_map.h
index 5154a8f1d26c..a84ef0c7d601 100644
--- a/fs/btrfs/extent_map.h
+++ b/fs/btrfs/extent_map.h
@@ -154,6 +154,7 @@ static inline u64 extent_map_block_start(const struct extent_map *em)
 	if (em->disk_bytenr < EXTENT_MAP_LAST_BYTE) {
 		if (extent_map_is_compressed(em))
 			return em->disk_bytenr;
+		printk("em: %p, disk byte nr: %llu, offset: %llu, %s\n", em, em->disk_bytenr, em->offset, __func__);
 		return em->disk_bytenr + em->offset;
 	}
 	return em->disk_bytenr;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index b1b6564ab68f..45f3b31aacc3 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6958,7 +6958,9 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,
 	}
 
 	write_lock(&em_tree->lock);
+	printk("em: %p, blockstart: %llu, start: %llu, len: %llu, %s\n", em, extent_map_block_start(em), start, len, __func__);
 	ret = btrfs_add_extent_mapping(inode, &em, start, len);
+	printk("ret: %d, em: %p, blockstart: %llu, start: %llu, len: %llu, %s\n", ret, em, extent_map_block_start(em), start, len, __func__);
 	write_unlock(&em_tree->lock);
 out:
 	btrfs_free_path(path);