From: syzbot <syzbot+4d81015bc10889fd12ea@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [btrfs?] WARNING in create_pending_snapshot
Date: Sat, 11 Nov 2023 19:25:02 -0800 [thread overview]
Message-ID: <0000000000006103db0609ec1940@google.com> (raw)
In-Reply-To: <tencent_00362097F637DA4B987401777D66AC3DDD09@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: sleeping function called from invalid context in btrfs_get_free_objectid
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:580
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 5526, name: syz-executor.0
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
10 locks held by syz-executor.0/5526:
#0: ffff8880751f4418 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write_file+0x61/0x200 fs/namespace.c:448
#1: ffff888073da1818 (&type->i_mutex_dir_key#8/1){+.+.}-{3:3}, at: btrfs_mksubvol+0x1c9/0x750 fs/btrfs/ioctl.c:967
#2: ffff888020974be8 (&fs_info->subvol_sem){++++}-{3:3}, at: btrfs_mksubvol+0x52a/0x750 fs/btrfs/ioctl.c:989
#3: ffff8880751f4608 (sb_internal#2){.+.+}-{0:0}, at: create_snapshot+0x437/0x7e0 fs/btrfs/ioctl.c:837
#4: ffff888020976458 (btrfs_trans_completed){.+.+}-{0:0}, at: btrfs_commit_transaction+0x17b/0x3730 fs/btrfs/transaction.c:2214
#5: ffff888020976430 (btrfs_trans_super_committed){.+.+}-{0:0}, at: btrfs_commit_transaction+0x17b/0x3730 fs/btrfs/transaction.c:2214
#6: ffff888020976408 (btrfs_trans_unblocked){++++}-{0:0}, at: btrfs_commit_transaction+0x17b/0x3730 fs/btrfs/transaction.c:2214
#7: ffff888020974cb8 (&fs_info->reloc_mutex){+.+.}-{3:3}, at: btrfs_commit_transaction+0xf14/0x3730 fs/btrfs/transaction.c:2433
#8: ffff888020975818 (&fs_info->qgroup_ioctl_lock){+.+.}-{3:3}, at: btrfs_create_qgroup+0xa2/0x280 fs/btrfs/qgroup.c:1707
#9: ffff888020975780 (&fs_info->qgroup_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#9: ffff888020975780 (&fs_info->qgroup_lock){+.+.}-{2:2}, at: btrfs_create_qgroup+0x226/0x280 fs/btrfs/qgroup.c:1729
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 1 PID: 5526 Comm: syz-executor.0 Not tainted 6.6.0-syzkaller-15365-g305230142ae0-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
__might_resched+0x5cf/0x780 kernel/sched/core.c:10151
__mutex_lock_common kernel/locking/mutex.c:580 [inline]
__mutex_lock+0xc1/0xd60 kernel/locking/mutex.c:747
btrfs_get_free_objectid+0x34/0x180 fs/btrfs/disk-io.c:4924
add_qgroup_rb+0x3a0/0x440 fs/btrfs/qgroup.c:236
btrfs_create_qgroup+0x234/0x280 fs/btrfs/qgroup.c:1730
create_pending_snapshot+0x8cc/0x2b70 fs/btrfs/transaction.c:1776
create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1967
btrfs_commit_transaction+0xf1c/0x3730 fs/btrfs/transaction.c:2440
create_snapshot+0x4a5/0x7e0 fs/btrfs/ioctl.c:845
btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:995
btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1041
__btrfs_ioctl_snap_create+0x344/0x460 fs/btrfs/ioctl.c:1294
btrfs_ioctl_snap_create+0x13c/0x190 fs/btrfs/ioctl.c:1321
btrfs_ioctl+0xbbf/0xd40
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f6d5147cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6d5220d0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f6d5159c050 RCX: 00007f6d5147cae9
RDX: 0000000020000a80 RSI: 0000000050009401 RDI: 0000000000000004
RBP: 00007f6d514c847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f6d5159c050 R15: 00007ffcea145098
</TASK>
=============================
[ BUG: Invalid wait context ]
6.6.0-syzkaller-15365-g305230142ae0-dirty #0 Tainted: G W
-----------------------------
syz-executor.0/5526 is trying to lock:
ffff8880277522d8 (&root->objectid_mutex){+.+.}-{3:3}, at: btrfs_get_free_objectid+0x34/0x180 fs/btrfs/disk-io.c:4924
other info that might help us debug this:
context-{4:4}
10 locks held by syz-executor.0/5526:
#0: ffff8880751f4418 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write_file+0x61/0x200 fs/namespace.c:448
#1: ffff888073da1818 (&type->i_mutex_dir_key#8/1){+.+.}-{3:3}, at: btrfs_mksubvol+0x1c9/0x750 fs/btrfs/ioctl.c:967
#2: ffff888020974be8 (&fs_info->subvol_sem){++++}-{3:3}, at: btrfs_mksubvol+0x52a/0x750 fs/btrfs/ioctl.c:989
#3: ffff8880751f4608 (sb_internal#2){.+.+}-{0:0}, at: create_snapshot+0x437/0x7e0 fs/btrfs/ioctl.c:837
#4: ffff888020976458 (btrfs_trans_completed){.+.+}-{0:0}, at: btrfs_commit_transaction+0x17b/0x3730 fs/btrfs/transaction.c:2214
#5: ffff888020976430 (btrfs_trans_super_committed){.+.+}-{0:0}, at: btrfs_commit_transaction+0x17b/0x3730 fs/btrfs/transaction.c:2214
#6: ffff888020976408 (btrfs_trans_unblocked){++++}-{0:0}, at: btrfs_commit_transaction+0x17b/0x3730 fs/btrfs/transaction.c:2214
#7: ffff888020974cb8 (&fs_info->reloc_mutex){+.+.}-{3:3}, at: btrfs_commit_transaction+0xf14/0x3730 fs/btrfs/transaction.c:2433
#8: ffff888020975818 (&fs_info->qgroup_ioctl_lock){+.+.}-{3:3}, at: btrfs_create_qgroup+0xa2/0x280 fs/btrfs/qgroup.c:1707
#9: ffff888020975780 (&fs_info->qgroup_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#9: ffff888020975780 (&fs_info->qgroup_lock){+.+.}-{2:2}, at: btrfs_create_qgroup+0x226/0x280 fs/btrfs/qgroup.c:1729
stack backtrace:
CPU: 1 PID: 5526 Comm: syz-executor.0 Tainted: G W 6.6.0-syzkaller-15365-g305230142ae0-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
print_lock_invalid_wait_context kernel/locking/lockdep.c:4750 [inline]
check_wait_context kernel/locking/lockdep.c:4820 [inline]
__lock_acquire+0x1825/0x7f70 kernel/locking/lockdep.c:5086
lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5753
__mutex_lock_common kernel/locking/mutex.c:603 [inline]
__mutex_lock+0x136/0xd60 kernel/locking/mutex.c:747
btrfs_get_free_objectid+0x34/0x180 fs/btrfs/disk-io.c:4924
add_qgroup_rb+0x3a0/0x440 fs/btrfs/qgroup.c:236
btrfs_create_qgroup+0x234/0x280 fs/btrfs/qgroup.c:1730
create_pending_snapshot+0x8cc/0x2b70 fs/btrfs/transaction.c:1776
create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1967
btrfs_commit_transaction+0xf1c/0x3730 fs/btrfs/transaction.c:2440
create_snapshot+0x4a5/0x7e0 fs/btrfs/ioctl.c:845
btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:995
btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1041
__btrfs_ioctl_snap_create+0x344/0x460 fs/btrfs/ioctl.c:1294
btrfs_ioctl_snap_create+0x13c/0x190 fs/btrfs/ioctl.c:1321
btrfs_ioctl+0xbbf/0xd40
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f6d5147cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6d5220d0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f6d5159c050 RCX: 00007f6d5147cae9
RDX: 0000000020000a80 RSI: 0000000050009401 RDI: 0000000000000004
RBP: 00007f6d514c847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f6d5159c050 R15: 00007ffcea145098
</TASK>
Tested on:
commit: 30523014 Merge tag 'pm-6.7-rc1-2' of git://git.kernel...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=12c3dc70e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=beb32a598fd79db9
dashboard link: https://syzkaller.appspot.com/bug?extid=4d81015bc10889fd12ea
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=122f123f680000
next parent reply other threads:[~2023-11-12 3:32 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <tencent_00362097F637DA4B987401777D66AC3DDD09@qq.com>
2023-11-12 3:25 ` syzbot [this message]
[not found] <tencent_E95DB2DDFA99004F9F0DE425EC0DBA921C07@qq.com>
2023-11-12 4:01 ` [syzbot] [btrfs?] WARNING in create_pending_snapshot syzbot
[not found] <tencent_0B5D9E994CCF920DF0A5CC8DA19200DDDD07@qq.com>
2023-11-12 3:44 ` syzbot
[not found] <tencent_F30036224B00740776CD66FA3C47367E9609@qq.com>
2023-11-11 5:27 ` syzbot
[not found] <tencent_BB46336B9E241B574B011B9B25C6BA6BBB08@qq.com>
2023-11-11 4:29 ` syzbot
[not found] <tencent_4FE7DB06CC92DC064989ABAECD6EC7CCB706@qq.com>
2023-11-11 3:14 ` syzbot
[not found] <tencent_A2614970C3AB4447D761576DC6D73362A305@qq.com>
2023-11-11 3:02 ` syzbot
[not found] <tencent_7F898D8FA5B10DA81205DDF3DDBA1929CF07@qq.com>
2023-11-11 2:46 ` syzbot
[not found] <tencent_A840376B576326D193688362096DE3B44405@qq.com>
2023-11-11 1:55 ` syzbot
[not found] <tencent_51DB92C1C65949A12EC3AED2CC8967F44606@qq.com>
2023-11-11 1:44 ` syzbot
[not found] <tencent_1252E00673099CEECDAECC0CAA67E306C706@qq.com>
2023-11-11 1:19 ` syzbot
[not found] <20231110110726.3060048-1-lizhi.xu@windriver.com>
2023-11-10 11:25 ` syzbot
[not found] <20231110062620.819348-1-lizhi.xu@windriver.com>
2023-11-10 9:38 ` syzbot
2023-11-09 17:16 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000006103db0609ec1940@google.com \
--to=syzbot+4d81015bc10889fd12ea@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.