./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2617475762

<...>
Warning: Permanently added '10.128.0.213' (ED25519) to the list of known hosts.
execve("./syz-executor2617475762", ["./syz-executor2617475762"], 0x7ffc767e2fd0 /* 10 vars */) = 0
brk(NULL)                               = 0x55555852a000
brk(0x55555852ad00)                     = 0x55555852ad00
arch_prctl(ARCH_SET_FS, 0x55555852a380) = 0
set_tid_address(0x55555852a650)         = 5215
set_robust_list(0x55555852a660, 24)     = 0
rseq(0x55555852aca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2617475762", 4096) = 28
getrandom("\x87\x17\xd4\xb0\x1c\x89\x3d\x25", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55555852ad00
brk(0x55555854bd00)                     = 0x55555854bd00
brk(0x55555854c000)                     = 0x55555854c000
mprotect(0x7f910d8a9000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
mkdir("./syzkaller.176j7P", 0700)       = 0
chmod("./syzkaller.176j7P", 0777)       = 0
chdir("./syzkaller.176j7P")             = 0
mkdir("./0", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5216 attached
 <unfinished ...>
[pid  5216] set_robust_list(0x55555852a660, 24 <unfinished ...>
[pid  5215] <... clone resumed>, child_tidptr=0x55555852a650) = 5216
[pid  5216] <... set_robust_list resumed>) = 0
[pid  5216] chdir("./0")                = 0
[pid  5216] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5216] setpgid(0, 0)               = 0
[pid  5216] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5216] write(3, "1000", 4)         = 4
[pid  5216] close(3)                    = 0
[pid  5216] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid  5216] write(1, "executing program\n", 18) = 18
[pid  5216] memfd_create("syzkaller", 0) = 3
[pid  5216] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9105200000
[pid  5216] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid  5216] munmap(0x7f9105200000, 138412032) = 0
[pid  5216] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5216] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5216] close(3)                    = 0
[pid  5216] close(4)                    = 0
[pid  5216] mkdir("./file0", 0777)      = 0
[   61.536022][ T5216] loop0: detected capacity change from 0 to 32768
[   61.568419][ T5216] BTRFS: device fsid 92aec1fe-fee8-4e05-92dc-790b47b871d9 devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor261 (5216)
[   61.593233][ T5216] BTRFS info (device loop0): first mount of filesystem 92aec1fe-fee8-4e05-92dc-790b47b871d9
[   61.604014][ T5216] BTRFS info (device loop0): using xxhash64 (xxhash64-generic) checksum algorithm
[   61.613447][ T5216] BTRFS info (device loop0): using free-space-tree
[pid  5216] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid  5216] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid  5216] chdir("./file0")            = 0
[pid  5216] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5216] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5216] close(4)                    = 0
[pid  5216] openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid  5216] openat(AT_FDCWD, "memory.events", O_WRONLY|O_TRUNC|O_NONBLOCK|O_DSYNC|O_DIRECT|FASYNC|0x4) = 5
[pid  5216] write(5, "\x74\x68\x72\x65\x61\x64\x65\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6d\x65\x6d\x6f\x72\x79\x2e\x65\x76\x65\x6e\x74\x73\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1581056) = 1581056
[pid  5216] exit_group(0)               = ?
[pid  5216] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5216, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=25 /* 0.25 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55555852b6f0 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./0/binderfs")                  = 0
[   61.875333][ T5215] BTRFS info (device loop0): last unmount of filesystem 92aec1fe-fee8-4e05-92dc-790b47b871d9
umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./0/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x555558533730 /* 2 entries */, 32768) = 48
getdents64(4, 0x555558533730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./0/file0")                      = 0
getdents64(3, 0x55555852b6f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./0")                            = 0
mkdir("./1", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5236 attached
 <unfinished ...>
[pid  5236] set_robust_list(0x55555852a660, 24 <unfinished ...>
[pid  5215] <... clone resumed>, child_tidptr=0x55555852a650) = 5236
[pid  5236] <... set_robust_list resumed>) = 0
[pid  5236] chdir("./1")                = 0
[pid  5236] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5236] setpgid(0, 0)               = 0
[pid  5236] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5236] write(3, "1000", 4)         = 4
[pid  5236] close(3)                    = 0
[pid  5236] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid  5236] write(1, "executing program\n", 18) = 18
[pid  5236] memfd_create("syzkaller", 0) = 3
[pid  5236] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9105200000
[pid  5236] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid  5236] munmap(0x7f9105200000, 138412032) = 0
[pid  5236] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5236] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5236] close(3)                    = 0
[pid  5236] close(4)                    = 0
[pid  5236] mkdir("./file0", 0777)      = 0
[   62.219407][ T5236] loop0: detected capacity change from 0 to 32768
[   62.242338][ T5236] BTRFS: device fsid 92aec1fe-fee8-4e05-92dc-790b47b871d9 devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor261 (5236)
[pid  5236] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid  5236] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid  5236] chdir("./file0")            = 0
[pid  5236] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5236] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5236] close(4)                    = 0
[pid  5236] openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[   62.264561][ T5236] BTRFS info (device loop0): first mount of filesystem 92aec1fe-fee8-4e05-92dc-790b47b871d9
[   62.275616][ T5236] BTRFS info (device loop0): using xxhash64 (xxhash64-generic) checksum algorithm
[   62.284919][ T5236] BTRFS info (device loop0): using free-space-tree
[pid  5236] openat(AT_FDCWD, "memory.events", O_WRONLY|O_TRUNC|O_NONBLOCK|O_DSYNC|O_DIRECT|FASYNC|0x4) = 5
[pid  5236] write(5, "\x74\x68\x72\x65\x61\x64\x65\x64\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x6d\x65\x6d\x6f\x72\x79\x2e\x65\x76\x65\x6e\x74\x73\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1581056) = 1581056
[pid  5236] exit_group(0)               = ?
[pid  5236] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5236, si_uid=0, si_status=0, si_utime=3 /* 0.03 s */, si_stime=21 /* 0.21 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./1", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x55555852b6f0 /* 4 entries */, 32768) = 112
umount2("./1/binderfs", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0
unlink("./1/binderfs")                  = 0
[   62.419515][ T5215] BTRFS info (device loop0): last unmount of filesystem 92aec1fe-fee8-4e05-92dc-790b47b871d9
umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = 0
umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
newfstatat(AT_FDCWD, "./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0
umount2("./1/file0", MNT_FORCE|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0
getdents64(4, 0x555558533730 /* 2 entries */, 32768) = 48
getdents64(4, 0x555558533730 /* 0 entries */, 32768) = 0
close(4)                                = 0
rmdir("./1/file0")                      = 0
getdents64(3, 0x55555852b6f0 /* 0 entries */, 32768) = 0
close(3)                                = 0
rmdir("./1")                            = 0
mkdir("./2", 0777)                      = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR)  = 3
ioctl(3, LOOP_CLR_FD)                   = -1 ENXIO (No such device or address)
close(3)                                = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5253 attached
, child_tidptr=0x55555852a650) = 5253
[pid  5253] set_robust_list(0x55555852a660, 24) = 0
[pid  5253] chdir("./2")                = 0
[pid  5253] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5253] setpgid(0, 0)               = 0
[pid  5253] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5253] write(3, "1000", 4)         = 4
[pid  5253] close(3)                    = 0
[pid  5253] symlink("/dev/binderfs", "./binderfs") = 0
executing program
[pid  5253] write(1, "executing program\n", 18) = 18
[pid  5253] memfd_create("syzkaller", 0) = 3
[pid  5253] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9105200000
[pid  5253] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid  5253] munmap(0x7f9105200000, 138412032) = 0
[pid  5253] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5253] ioctl(4, LOOP_SET_FD, 3)    = 0
[pid  5253] close(3)                    = 0
[pid  5253] close(4)                    = 0
[pid  5253] mkdir("./file0", 0777)      = 0
[   62.817093][ T5253] loop0: detected capacity change from 0 to 32768
[   62.859335][ T5253] BTRFS: device fsid 92aec1fe-fee8-4e05-92dc-790b47b871d9 devid 1 transid 8 /dev/loop0 (7:0) scanned by syz-executor261 (5253)
[   62.890071][ T5253] BTRFS info (device loop0): first mount of filesystem 92aec1fe-fee8-4e05-92dc-790b47b871d9
[pid  5253] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid  5253] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[   62.900615][ T5253] BTRFS info (device loop0): using xxhash64 (xxhash64-generic) checksum algorithm
[   62.910490][ T5253] BTRFS info (device loop0): using free-space-tree
[pid  5253] chdir("./file0")            = 0
[pid  5253] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid  5253] ioctl(4, LOOP_CLR_FD)       = 0
[pid  5253] close(4)                    = 0
[pid  5253] openat(AT_FDCWD, "memory.events", O_RDWR|O_CREAT|O_NOCTTY|O_TRUNC|O_APPEND|FASYNC|0x18, 000) = 4
[pid  5253] openat(AT_FDCWD, "memory.events", O_WRONLY|O_TRUNC|O_NONBLOCK|O_DSYNC|O_DIRECT|FASYNC|0x4) = 5
[   63.035892][ T5253] 
[   63.038266][ T5253] =====================================
[   63.043814][ T5253] WARNING: bad unlock balance detected!
[   63.049371][ T5253] 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0 Not tainted
[   63.056488][ T5253] -------------------------------------
[   63.062036][ T5253] syz-executor261/5253 is trying to release lock (&sb->s_type->i_mutex_key) at:
[   63.071077][ T5253] [<ffffffff83d47c3f>] btrfs_direct_write+0x91f/0xb40
[   63.077881][ T5253] but there are no more locks to release!
[   63.083598][ T5253] 
[   63.083598][ T5253] other info that might help us debug this:
[   63.091662][ T5253] 1 lock held by syz-executor261/5253:
[   63.097133][ T5253]  #0: ffff88802c068420 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x227/0xc90
[   63.106037][ T5253] 
[   63.106037][ T5253] stack backtrace:
[   63.111920][ T5253] CPU: 1 UID: 0 PID: 5253 Comm: syz-executor261 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0
[   63.123194][ T5253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
[   63.133241][ T5253] Call Trace:
[   63.136508][ T5253]  <TASK>
[   63.139425][ T5253]  dump_stack_lvl+0x241/0x360
[   63.144102][ T5253]  ? __pfx_dump_stack_lvl+0x10/0x10
[   63.149287][ T5253]  ? __pfx__printk+0x10/0x10
[   63.153867][ T5253]  ? btrfs_direct_write+0x91f/0xb40
[   63.159050][ T5253]  print_unlock_imbalance_bug+0x256/0x2c0
[   63.164754][ T5253]  ? __kernel_text_address+0xd/0x40
[   63.169933][ T5253]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   63.175992][ T5253]  ? __pfx_print_unlock_imbalance_bug+0x10/0x10
[   63.182214][ T5253]  ? arch_stack_walk+0x16d/0x1b0
[   63.187156][ T5253]  lock_release+0x5cb/0xa30
[   63.191646][ T5253]  ? mark_lock+0x9a/0x350
[   63.195963][ T5253]  ? btrfs_direct_write+0x91f/0xb40
[   63.201147][ T5253]  ? __pfx_lock_release+0x10/0x10
[   63.206154][ T5253]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   63.212123][ T5253]  ? kasan_quarantine_put+0xdc/0x230
[   63.217393][ T5253]  up_write+0x79/0x590
[   63.221447][ T5253]  ? iomap_dio_complete+0x6a9/0x960
[   63.226630][ T5253]  ? kfree+0x149/0x360
[   63.230682][ T5253]  ? __pfx_up_write+0x10/0x10
[   63.235356][ T5253]  ? iomap_dio_complete+0x6a9/0x960
[   63.240539][ T5253]  btrfs_direct_write+0x91f/0xb40
[   63.245578][ T5253]  ? __pfx_btrfs_direct_write+0x10/0x10
[   63.251114][ T5253]  ? __pfx_lock_acquire+0x10/0x10
[   63.256148][ T5253]  btrfs_do_write_iter+0x2a1/0x760
[   63.261249][ T5253]  ? rcu_read_lock_any_held+0xb7/0x160
[   63.266701][ T5253]  ? __pfx_btrfs_do_write_iter+0x10/0x10
[   63.272322][ T5253]  vfs_write+0xa72/0xc90
[   63.276552][ T5253]  ? __pfx_btrfs_file_write_iter+0x10/0x10
[   63.282348][ T5253]  ? __pfx_vfs_write+0x10/0x10
[   63.287098][ T5253]  ? lockdep_hardirqs_on+0x99/0x150
[   63.292302][ T5253]  ksys_write+0x1a0/0x2c0
[   63.296632][ T5253]  ? __pfx_ksys_write+0x10/0x10
[   63.301479][ T5253]  ? exc_page_fault+0x590/0x8c0
[   63.306325][ T5253]  do_syscall_64+0xf3/0x230
[   63.310838][ T5253]  ? clear_bhb_loop+0x35/0x90
[   63.315511][ T5253]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   63.321496][ T5253] RIP: 0033:0x7f910d830169
[   63.325901][ T5253] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   63.345502][ T5253] RSP: 002b:00007ffcc3dc0128 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   63.353903][ T5253] RAX: ffffffffffffffda RBX: 0073746e6576652e RCX: 00007f910d830169
[   63.361859][ T5253] RDX: 0000000000182000 RSI: 0000000020000000 RDI: 0000000000000005
[   63.369818][ T5253] RBP: 652e79726f6d656d R08: 0000000000000000 R09: 0000000000000000
[   63.377771][ T5253] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc3dc0170
[   63.385725][ T5253] R13: 00007ffcc3dc01b0 R14: 0000000001000000 R15: 0000000000000003
[   63.393709][ T5253]  </TASK>
[   63.399334][ T5253] ------------[ cut here ]------------
[   63.404868][ T5253] DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff88807979b868, owner = 0x0, curr 0xffff88802b3d1e00, list empty
[   63.424159][ T5253] WARNING: CPU: 0 PID: 5253 at kernel/locking/rwsem.c:1370 up_write+0x502/0x590
[   63.433325][ T5253] Modules linked in:
[   63.437253][ T5253] CPU: 0 UID: 0 PID: 5253 Comm: syz-executor261 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0
[   63.448375][ T5253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
[   63.458461][ T5253] RIP: 0010:up_write+0x502/0x590
[   63.463400][ T5253] Code: c7 c7 a0 c8 ea 8b 48 c7 c6 20 cb ea 8b 48 8b 54 24 28 48 8b 4c 24 18 4d 89 e0 4c 8b 4c 24 30 53 e8 d3 9c e6 ff 48 83 c4 08 90 <0f> 0b 90 90 e9 6a fd ff ff 48 c7 c1 00 a9 f6 8f 80 e1 07 80 c1 03
[   63.483052][ T5253] RSP: 0018:ffffc900033ef920 EFLAGS: 00010292
[   63.489154][ T5253] RAX: f014ffd380154b00 RBX: ffffffff8beac980 RCX: ffff88802b3d1e00
[   63.497142][ T5253] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
[   63.505135][ T5253] RBP: ffffc900033ef9f0 R08: ffffffff81559202 R09: fffffbfff1cb9f80
[   63.513182][ T5253] R10: dffffc0000000000 R11: fffffbfff1cb9f80 R12: 0000000000000000
[   63.521191][ T5253] R13: ffff88807979b868 R14: 1ffff9200067df2c R15: dffffc0000000000
[   63.529319][ T5253] FS:  000055555852a380(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
[   63.538383][ T5253] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   63.545019][ T5253] CR2: 00005586a06290f8 CR3: 0000000024b46000 CR4: 00000000003506f0
[   63.553265][ T5253] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   63.561273][ T5253] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   63.569265][ T5253] Call Trace:
[   63.572533][ T5253]  <TASK>
[   63.575475][ T5253]  ? __warn+0x163/0x4e0
[   63.579635][ T5253]  ? up_write+0x502/0x590
[   63.583951][ T5253]  ? report_bug+0x2b3/0x500
[   63.588467][ T5253]  ? up_write+0x502/0x590
[   63.592808][ T5253]  ? handle_bug+0x3e/0x70
[   63.597159][ T5253]  ? exc_invalid_op+0x1a/0x50
[   63.602018][ T5253]  ? asm_exc_invalid_op+0x1a/0x20
[   63.607083][ T5253]  ? __warn_printk+0x292/0x360
[   63.611844][ T5253]  ? up_write+0x502/0x590
[   63.616201][ T5253]  ? __pfx_up_write+0x10/0x10
[   63.620876][ T5253]  ? iomap_dio_complete+0x6a9/0x960
[   63.626108][ T5253]  btrfs_direct_write+0x91f/0xb40
[   63.631137][ T5253]  ? __pfx_btrfs_direct_write+0x10/0x10
[   63.636724][ T5253]  ? __pfx_lock_acquire+0x10/0x10
[   63.641755][ T5253]  btrfs_do_write_iter+0x2a1/0x760
[   63.646931][ T5253]  ? rcu_read_lock_any_held+0xb7/0x160
[   63.652414][ T5253]  ? __pfx_btrfs_do_write_iter+0x10/0x10
[   63.658082][ T5253]  vfs_write+0xa72/0xc90
[   63.662325][ T5253]  ? __pfx_btrfs_file_write_iter+0x10/0x10
[   63.668213][ T5253]  ? __pfx_vfs_write+0x10/0x10
[   63.672987][ T5253]  ? lockdep_hardirqs_on+0x99/0x150
[   63.678215][ T5253]  ksys_write+0x1a0/0x2c0
[   63.682549][ T5253]  ? __pfx_ksys_write+0x10/0x10
[   63.687415][ T5253]  ? exc_page_fault+0x590/0x8c0
[   63.692273][ T5253]  do_syscall_64+0xf3/0x230
[   63.696801][ T5253]  ? clear_bhb_loop+0x35/0x90
[   63.701483][ T5253]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   63.707393][ T5253] RIP: 0033:0x7f910d830169
[   63.711808][ T5253] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   63.731554][ T5253] RSP: 002b:00007ffcc3dc0128 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   63.740011][ T5253] RAX: ffffffffffffffda RBX: 0073746e6576652e RCX: 00007f910d830169
[   63.748011][ T5253] RDX: 0000000000182000 RSI: 0000000020000000 RDI: 0000000000000005
[   63.756011][ T5253] RBP: 652e79726f6d656d R08: 0000000000000000 R09: 0000000000000000
[   63.763993][ T5253] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc3dc0170
[   63.772030][ T5253] R13: 00007ffcc3dc01b0 R14: 0000000001000000 R15: 0000000000000003
[   63.780035][ T5253]  </TASK>
[   63.783046][ T5253] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   63.790397][ T5253] CPU: 0 UID: 0 PID: 5253 Comm: syz-executor261 Not tainted 6.11.0-rc1-syzkaller-00062-ge4fc196f5ba3 #0
[   63.801491][ T5253] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
[   63.811620][ T5253] Call Trace:
[   63.814888][ T5253]  <TASK>
[   63.817813][ T5253]  dump_stack_lvl+0x241/0x360
[   63.822483][ T5253]  ? __pfx_dump_stack_lvl+0x10/0x10
[   63.827668][ T5253]  ? __pfx__printk+0x10/0x10
[   63.832265][ T5253]  ? vscnprintf+0x5d/0x90
[   63.836598][ T5253]  panic+0x349/0x860
[   63.840492][ T5253]  ? __warn+0x172/0x4e0
[   63.844651][ T5253]  ? __pfx_panic+0x10/0x10
[   63.849063][ T5253]  __warn+0x346/0x4e0
[   63.853028][ T5253]  ? up_write+0x502/0x590
[   63.857342][ T5253]  report_bug+0x2b3/0x500
[   63.861659][ T5253]  ? up_write+0x502/0x590
[   63.866063][ T5253]  handle_bug+0x3e/0x70
[   63.870205][ T5253]  exc_invalid_op+0x1a/0x50
[   63.874700][ T5253]  asm_exc_invalid_op+0x1a/0x20
[   63.879539][ T5253] RIP: 0010:up_write+0x502/0x590
[   63.884480][ T5253] Code: c7 c7 a0 c8 ea 8b 48 c7 c6 20 cb ea 8b 48 8b 54 24 28 48 8b 4c 24 18 4d 89 e0 4c 8b 4c 24 30 53 e8 d3 9c e6 ff 48 83 c4 08 90 <0f> 0b 90 90 e9 6a fd ff ff 48 c7 c1 00 a9 f6 8f 80 e1 07 80 c1 03
[   63.904071][ T5253] RSP: 0018:ffffc900033ef920 EFLAGS: 00010292
[   63.910130][ T5253] RAX: f014ffd380154b00 RBX: ffffffff8beac980 RCX: ffff88802b3d1e00
[   63.918086][ T5253] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
[   63.926039][ T5253] RBP: ffffc900033ef9f0 R08: ffffffff81559202 R09: fffffbfff1cb9f80
[   63.933996][ T5253] R10: dffffc0000000000 R11: fffffbfff1cb9f80 R12: 0000000000000000
[   63.941951][ T5253] R13: ffff88807979b868 R14: 1ffff9200067df2c R15: dffffc0000000000
[   63.949911][ T5253]  ? __warn_printk+0x292/0x360
[   63.954669][ T5253]  ? __pfx_up_write+0x10/0x10
[   63.959331][ T5253]  ? iomap_dio_complete+0x6a9/0x960
[   63.964518][ T5253]  btrfs_direct_write+0x91f/0xb40
[   63.969535][ T5253]  ? __pfx_btrfs_direct_write+0x10/0x10
[   63.975072][ T5253]  ? __pfx_lock_acquire+0x10/0x10
[   63.980086][ T5253]  btrfs_do_write_iter+0x2a1/0x760
[   63.985188][ T5253]  ? rcu_read_lock_any_held+0xb7/0x160
[   63.990641][ T5253]  ? __pfx_btrfs_do_write_iter+0x10/0x10
[   63.996265][ T5253]  vfs_write+0xa72/0xc90
[   64.000493][ T5253]  ? __pfx_btrfs_file_write_iter+0x10/0x10
[   64.006299][ T5253]  ? __pfx_vfs_write+0x10/0x10
[   64.011051][ T5253]  ? lockdep_hardirqs_on+0x99/0x150
[   64.016240][ T5253]  ksys_write+0x1a0/0x2c0
[   64.020555][ T5253]  ? __pfx_ksys_write+0x10/0x10
[   64.025416][ T5253]  ? exc_page_fault+0x590/0x8c0
[   64.030319][ T5253]  do_syscall_64+0xf3/0x230
[   64.034839][ T5253]  ? clear_bhb_loop+0x35/0x90
[   64.041079][ T5253]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   64.046965][ T5253] RIP: 0033:0x7f910d830169
[   64.051368][ T5253] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   64.070965][ T5253] RSP: 002b:00007ffcc3dc0128 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[   64.079419][ T5253] RAX: ffffffffffffffda RBX: 0073746e6576652e RCX: 00007f910d830169
[   64.087381][ T5253] RDX: 0000000000182000 RSI: 0000000020000000 RDI: 0000000000000005
[   64.095338][ T5253] RBP: 652e79726f6d656d R08: 0000000000000000 R09: 0000000000000000
[   64.103302][ T5253] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcc3dc0170
[   64.111350][ T5253] R13: 00007ffcc3dc01b0 R14: 0000000001000000 R15: 0000000000000003
[   64.119316][ T5253]  </TASK>
[   64.122674][ T5253] Kernel Offset: disabled
[   64.126984][ T5253] Rebooting in 86400 seconds..