[syzbot] [bcachefs?] kernel BUG in wb_flush_one

[syzbot <syzbot+bbf8e41759ee46cc56cc@syzkaller.appspotmail.com>]

Hello,

syzbot found the following issue on:

HEAD commit:    d2b1b3bccef6 KVM: arm64: Shave a few bytes from the EL2 id..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1299d240580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c154e2d4db830898
dashboard link: https://syzkaller.appspot.com/bug?extid=bbf8e41759ee46cc56cc
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12244430580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16244430580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ab5b5f1bb836/disk-d2b1b3bc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e47b288f7c97/vmlinux-d2b1b3bc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/1e3e5f0bea26/Image-d2b1b3bc.gz.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/42f1c4ccbf47/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bbf8e41759ee46cc56cc@syzkaller.appspotmail.com

bucket 0:127 gen 0 data type sb has wrong dirty_sectors: got 0, should be 256, fixing
 done
bcachefs (loop0): going read-write
bcachefs (loop0): journal_replay...
------------[ cut here ]------------
kernel BUG at fs/bcachefs/btree_write_buffer.c:147!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 UID: 0 PID: 6422 Comm: syz-executor340 Not tainted 6.12.0-rc3-syzkaller-gd2b1b3bccef6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : wb_flush_one+0x15bc/0x1638 fs/bcachefs/btree_write_buffer.c:147
lr : wb_flush_one+0x15bc/0x1638 fs/bcachefs/btree_write_buffer.c:147
sp : ffff8000a44162a0
x29: ffff8000a44163c0 x28: ffff8000a49fa230 x27: ffff8000a4416640
x26: ffff0000d9858000 x25: ffff8000a44166d0 x24: ffff8000a4416720
x23: 0000000000000009 x22: ffff700014882c64 x21: 4200000000000009
x20: dfff800000000000 x19: ffff8000a4416320 x18: ffff8000a4415ac0
x17: 000000000000e6f9 x16: ffff80008b3c8ac8 x15: ffff700014882be1
x14: 1ffff00014882be0 x13: 0000000000000004 x12: ffffffffffffffff
x11: ffff800082899880 x10: 0000000000ff0100 x9 : 0000000000000000
x8 : ffff0000d9803c80 x7 : 0000000000000000 x6 : 0000000000000003
x5 : ffff8000a44166d0 x4 : ffff8000a4416720 x3 : ffff8000a44166f0
x2 : ffff8000a49fa230 x1 : 0000000000000009 x0 : 4200000000000009
Call trace:
 wb_flush_one+0x15bc/0x1638 fs/bcachefs/btree_write_buffer.c:147
 bch2_btree_write_buffer_flush_locked+0x1370/0x2c98 fs/bcachefs/btree_write_buffer.c:375
 btree_write_buffer_flush_seq+0xff8/0x1130 fs/bcachefs/btree_write_buffer.c:510
 bch2_btree_write_buffer_journal_flush+0x58/0x94 fs/bcachefs/btree_write_buffer.c:525
 journal_flush_pins+0x524/0xa10 fs/bcachefs/journal_reclaim.c:565
 journal_flush_done+0x98/0x248 fs/bcachefs/journal_reclaim.c:819
 bch2_journal_flush_pins+0x1f4/0x338 fs/bcachefs/journal_reclaim.c:852
 bch2_journal_flush_all_pins fs/bcachefs/journal_reclaim.h:76 [inline]
 bch2_journal_replay+0x1bc8/0x1f0c fs/bcachefs/recovery.c:383
 bch2_run_recovery_pass+0xe4/0x1d4 fs/bcachefs/recovery_passes.c:185
 bch2_run_recovery_passes+0x430/0x71c fs/bcachefs/recovery_passes.c:232
 bch2_fs_recovery+0x32d8/0x55a0 fs/bcachefs/recovery.c:861
 bch2_fs_start+0x30c/0x53c fs/bcachefs/super.c:1037
 bch2_fs_get_tree+0x938/0x1030 fs/bcachefs/fs.c:2078
 vfs_get_tree+0x90/0x28c fs/super.c:1800
 do_new_mount+0x278/0x900 fs/namespace.c:3507
 path_mount+0x590/0xe04 fs/namespace.c:3834
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4055 [inline]
 __se_sys_mount fs/namespace.c:4032 [inline]
 __arm64_sys_mount+0x45c/0x5a8 fs/namespace.c:4032
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744
 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598
Code: d4210000 9773b504 d4210000 9773b502 (d4210000) 
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup