./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3348650018
<...>
Warning: Permanently added '10.128.0.152' (ECDSA) to the list of known hosts.
execve("./syz-executor3348650018", ["./syz-executor3348650018"], 0x7ffdf0206ba0 /* 10 vars */) = 0
brk(NULL) = 0x555556020000
brk(0x555556020c40) = 0x555556020c40
arch_prctl(ARCH_SET_FS, 0x555556020300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3348650018", 4096) = 28
brk(0x555556041c40) = 0x555556041c40
brk(0x555556042000) = 0x555556042000
mprotect(0x7fda886b2000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
getpid() = 5062
mkdir("./syzkaller.TS33RX", 0700) = 0
chmod("./syzkaller.TS33RX", 0777) = 0
chdir("./syzkaller.TS33RX") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555560205d0) = 5063
./strace-static-x86_64: Process 5063 attached
[pid 5063] chdir("./0") = 0
[pid 5063] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5063] setpgid(0, 0) = 0
[pid 5063] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5063] write(3, "1000", 4) = 4
[pid 5063] close(3) = 0
[pid 5063] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5063] memfd_create("syzkaller", 0) = 3
[pid 5063] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fda801f0000
[pid 5063] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5063] munmap(0x7fda801f0000, 16777216) = 0
[pid 5063] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5063] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5063] close(3) = 0
[pid 5063] mkdir("./file0", 0777) = 0
syzkaller login: [ 52.251464][ T5063] loop0: detected capacity change from 0 to 32768
[ 52.263346][ T5063] BTRFS: device fsid d552757d-9c39-40e3-95f0-16d819589928 devid 1 transid 8 /dev/loop0 scanned by syz-executor334 (5063)
[ 52.282998][ T5063] BTRFS info (device loop0): using sha256 (sha256-ni) checksum algorithm
[ 52.292499][ T5063] BTRFS info (device loop0): using free space tree
[pid 5063] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid 5063] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5063] chdir("./file0") = 0
[pid 5063] ioctl(4, LOOP_CLR_FD) = 0
[pid 5063] close(4) = 0
[pid 5063] open("./file0", O_RDONLY) = 4
[ 52.313110][ T5063] BTRFS info (device loop0): enabling ssd optimizations
[ 52.320279][ T5063] BTRFS info (device loop0): auto enabling async discard
[pid 5063] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid 5063] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5063] write(6, "17", 2) = 2
[ 52.349478][ T27] audit: type=1800 audit(1672189851.180:2): pid=5063 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor334" name="bus" dev="loop0" ino=263 res=0 errno=0
[ 52.375204][ T5063] FAULT_INJECTION: forcing a failure.
[ 52.375204][ T5063] name failslab, interval 1, probability 0, space 0, times 1
[ 52.388272][ T5063] CPU: 1 PID: 5063 Comm: syz-executor334 Not tainted 6.2.0-rc1-syzkaller #0
[ 52.396986][ T5063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 52.407574][ T5063] Call Trace:
[ 52.410898][ T5063]
[ 52.413844][ T5063] dump_stack_lvl+0xd1/0x138
[ 52.418494][ T5063] should_fail_ex.cold+0x5/0xa
[ 52.423293][ T5063] ? __btrfs_free_extent+0x1d0/0x1370
[ 52.428693][ T5063] should_failslab+0x9/0x20
[ 52.433226][ T5063] kmem_cache_alloc+0x5a/0x430
[ 52.438012][ T5063] __btrfs_free_extent+0x1d0/0x1370
[ 52.443253][ T5063] ? lookup_extent_backref+0x110/0x110
[ 52.448774][ T5063] ? __btrfs_run_delayed_refs+0x55c/0x3760
[ 52.454646][ T5063] ? lock_downgrade+0x6e0/0x6e0
[ 52.459538][ T5063] ? _raw_read_unlock+0x28/0x40
[ 52.464441][ T5063] ? btrfs_tree_mod_log_lowest_seq+0x86/0xb0
[ 52.470491][ T5063] __btrfs_run_delayed_refs+0x141c/0x3760
[ 52.476380][ T5063] ? check_ref_cleanup+0x3e0/0x3e0
[ 52.481563][ T5063] ? lock_release+0x810/0x810
[ 52.486288][ T5063] btrfs_run_delayed_refs+0x19a/0x490
[ 52.491686][ T5063] btrfs_commit_transaction+0x1e94/0x36c0
[ 52.497414][ T5063] ? do_raw_spin_lock+0x124/0x2b0
[ 52.502446][ T5063] ? rwlock_bug.part.0+0x90/0x90
[ 52.507457][ T5063] ? join_transaction+0x43e/0x10e0
[ 52.512591][ T5063] ? btrfs_commit_transaction_async+0x3f0/0x3f0
[ 52.518850][ T5063] ? start_transaction+0x2aa/0x1410
[ 52.524076][ T5063] btrfs_mksubvol+0xc09/0x1550
[ 52.528863][ T5063] ? create_subvol+0x13f0/0x13f0
[ 52.533847][ T5063] btrfs_mksnapshot+0xaf/0xf0
[ 52.538586][ T5063] __btrfs_ioctl_snap_create+0x3c1/0x430
[ 52.544266][ T5063] btrfs_ioctl_snap_create+0x148/0x1b0
[ 52.549794][ T5063] btrfs_ioctl+0x35b/0x5830
[ 52.554352][ T5063] ? tomoyo_path_number_perm+0x166/0x570
[ 52.560053][ T5063] ? tomoyo_execute_permission+0x4a0/0x4a0
[ 52.565919][ T5063] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 52.572397][ T5063] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 52.578319][ T5063] ? do_vfs_ioctl+0x132/0x15b0
[ 52.583095][ T5063] ? vfs_fileattr_set+0xbe0/0xbe0
[ 52.588158][ T5063] ? find_held_lock+0x2d/0x110
[ 52.592970][ T5063] ? do_one_initcall+0x470/0x790
[ 52.597912][ T5063] ? lock_downgrade+0x6e0/0x6e0
[ 52.602786][ T5063] ? bpf_lsm_file_ioctl+0x9/0x10
[ 52.607728][ T5063] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 52.614160][ T5063] __x64_sys_ioctl+0x197/0x210
[ 52.618931][ T5063] do_syscall_64+0x39/0xb0
[ 52.623344][ T5063] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 52.629240][ T5063] RIP: 0033:0x7fda8863da09
[ 52.633689][ T5063] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 52.653309][ T5063] RSP: 002b:00007ffefe362a48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 52.661729][ T5063] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fda8863da09
[ 52.669726][ T5063] RDX: 00000000200000c0 RSI: 0000000050009401 RDI: 0000000000000004
[ 52.677738][ T5063] RBP: 00007ffefe362a70 R08: 0000000000000002 R09: 00007ffefe362a80
[ 52.685718][ T5063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
[ 52.693695][ T5063] R13: 00007ffefe362ab0 R14: 00007ffefe362a90 R15: 0000000000000000
[ 52.701708][ T5063]
[ 52.705483][ T5063] BTRFS error (device loop0: state A): Transaction aborted (error -12)
[pid 5063] ioctl(4, BTRFS_IOC_SNAP_CREATE, {fd=5, name="\x42\x99\xc6\x3c\x6a\xca\x4b\xec\x68\x72\xd2\x02\x80\x8d\xda\x69\x34\x9c\x62\x54\x02\x9b\xbc\x4a\x38\xfb\x4e\x91\xbb\xa4\x82\x6c\xd7\x77\xcb\x59\x74\x4a\xdd\x18\x26\x71\x40\x88\x2a\x98\x37\x3f\xbb\xf4\xb5\xb0\x7c"}) = -1 ENOMEM (Cannot allocate memory)
[pid 5063] exit_group(0) = ?
[pid 5063] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5063, si_uid=0, si_status=0, si_utime=0, si_stime=25 /* 0.25 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x555556021620 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./0/binderfs") = 0
[ 52.714393][ T5063] BTRFS: error (device loop0: state A) in btrfs_run_delayed_refs:2148: errno=-12 Out of memory
[ 52.724943][ T5063] BTRFS info (device loop0: state EA): forced readonly
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x555556029660 /* 2 entries */, 32768) = 48
getdents64(4, 0x555556029660 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./0/file0") = 0
getdents64(3, 0x555556021620 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./0") = 0
mkdir("./1", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555560205d0) = 5085
./strace-static-x86_64: Process 5085 attached
[pid 5085] chdir("./1") = 0
[pid 5085] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5085] setpgid(0, 0) = 0
[pid 5085] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5085] write(3, "1000", 4) = 4
[pid 5085] close(3) = 0
[pid 5085] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5085] memfd_create("syzkaller", 0) = 3
[pid 5085] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fda801f0000
[pid 5085] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5085] munmap(0x7fda801f0000, 16777216) = 0
[pid 5085] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5085] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5085] close(3) = 0
[pid 5085] mkdir("./file0", 0777) = 0
[ 52.994524][ T5085] loop0: detected capacity change from 0 to 32768
[ 53.008405][ T5085] BTRFS info (device loop0): using sha256 (sha256-ni) checksum algorithm
[ 53.017168][ T5085] BTRFS info (device loop0): using free space tree
[ 53.036434][ T5085] BTRFS info (device loop0): enabling ssd optimizations
[pid 5085] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid 5085] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5085] chdir("./file0") = 0
[pid 5085] ioctl(4, LOOP_CLR_FD) = 0
[pid 5085] close(4) = 0
[pid 5085] open("./file0", O_RDONLY) = 4
[pid 5085] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid 5085] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5085] write(6, "17", 2) = 2
[ 53.043487][ T5085] BTRFS info (device loop0): auto enabling async discard
[ 53.066921][ T27] audit: type=1800 audit(1672189851.900:3): pid=5085 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor334" name="bus" dev="loop0" ino=263 res=0 errno=0
[ 53.091442][ T5085] FAULT_INJECTION: forcing a failure.
[ 53.091442][ T5085] name failslab, interval 1, probability 0, space 0, times 0
[ 53.104402][ T5085] CPU: 0 PID: 5085 Comm: syz-executor334 Not tainted 6.2.0-rc1-syzkaller #0
[ 53.113301][ T5085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 53.123446][ T5085] Call Trace:
[ 53.126721][ T5085]
[ 53.129648][ T5085] dump_stack_lvl+0xd1/0x138
[ 53.134261][ T5085] should_fail_ex.cold+0x5/0xa
[ 53.139049][ T5085] ? start_transaction+0x345/0x1410
[ 53.144438][ T5085] should_failslab+0x9/0x20
[ 53.148962][ T5085] kmem_cache_alloc+0x5a/0x430
[ 53.153729][ T5085] ? btrfs_delayed_refs_rsv_refill+0xd5/0x1a0
[ 53.159807][ T5085] start_transaction+0x345/0x1410
[ 53.164851][ T5085] btrfs_mksubvol+0xbba/0x1550
[ 53.169631][ T5085] ? create_subvol+0x13f0/0x13f0
[ 53.174593][ T5085] btrfs_mksnapshot+0xaf/0xf0
[ 53.179285][ T5085] __btrfs_ioctl_snap_create+0x3c1/0x430
[ 53.184944][ T5085] btrfs_ioctl_snap_create+0x148/0x1b0
[ 53.190505][ T5085] btrfs_ioctl+0x35b/0x5830
[ 53.195024][ T5085] ? tomoyo_path_number_perm+0x166/0x570
[ 53.200668][ T5085] ? tomoyo_execute_permission+0x4a0/0x4a0
[ 53.206505][ T5085] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 53.212934][ T5085] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 53.218844][ T5085] ? do_vfs_ioctl+0x132/0x15b0
[ 53.223716][ T5085] ? vfs_fileattr_set+0xbe0/0xbe0
[ 53.228753][ T5085] ? find_held_lock+0x2d/0x110
[ 53.233532][ T5085] ? do_one_initcall+0x470/0x790
[ 53.238476][ T5085] ? lock_downgrade+0x6e0/0x6e0
[ 53.243341][ T5085] ? bpf_lsm_file_ioctl+0x9/0x10
[ 53.248284][ T5085] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 53.254717][ T5085] __x64_sys_ioctl+0x197/0x210
[ 53.259484][ T5085] do_syscall_64+0x39/0xb0
[ 53.263915][ T5085] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 53.269806][ T5085] RIP: 0033:0x7fda8863da09
[ 53.274219][ T5085] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[pid 5085] ioctl(4, BTRFS_IOC_SNAP_CREATE, {fd=5, name="\x42\x99\xc6\x3c\x6a\xca\x4b\xec\x68\x72\xd2\x02\x80\x8d\xda\x69\x34\x9c\x62\x54\x02\x9b\xbc\x4a\x38\xfb\x4e\x91\xbb\xa4\x82\x6c\xd7\x77\xcb\x59\x74\x4a\xdd\x18\x26\x71\x40\x88\x2a\x98\x37\x3f\xbb\xf4\xb5\xb0\x7c"}) = -1 ENOMEM (Cannot allocate memory)
[pid 5085] exit_group(0) = ?
[pid 5085] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5085, si_uid=0, si_status=0, si_utime=0, si_stime=17 /* 0.17 s */} ---
umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x555556021620 /* 4 entries */, 32768) = 112
umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./1/binderfs") = 0
[ 53.293828][ T5085] RSP: 002b:00007ffefe362a48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 53.302240][ T5085] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fda8863da09
[ 53.310472][ T5085] RDX: 00000000200000c0 RSI: 0000000050009401 RDI: 0000000000000004
[ 53.318447][ T5085] RBP: 00007ffefe362a70 R08: 0000000000000002 R09: 00007ffefe362a80
[ 53.326415][ T5085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
[ 53.334383][ T5085] R13: 00007ffefe362ab0 R14: 00007ffefe362a90 R15: 0000000000000001
[ 53.342371][ T5085]
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x555556029660 /* 2 entries */, 32768) = 48
getdents64(4, 0x555556029660 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./1/file0") = 0
getdents64(3, 0x555556021620 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./1") = 0
mkdir("./2", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555560205d0) = 5112
./strace-static-x86_64: Process 5112 attached
[pid 5112] chdir("./2") = 0
[pid 5112] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5112] setpgid(0, 0) = 0
[pid 5112] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5112] write(3, "1000", 4) = 4
[pid 5112] close(3) = 0
[pid 5112] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5112] memfd_create("syzkaller", 0) = 3
[pid 5112] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fda801f0000
[pid 5112] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5112] munmap(0x7fda801f0000, 16777216) = 0
[pid 5112] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5112] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5112] close(3) = 0
[pid 5112] mkdir("./file0", 0777) = 0
[ 53.655381][ T5112] loop0: detected capacity change from 0 to 32768
[ 53.669507][ T5112] BTRFS info (device loop0): using sha256 (sha256-ni) checksum algorithm
[ 53.678174][ T5112] BTRFS info (device loop0): using free space tree
[ 53.696642][ T5112] BTRFS info (device loop0): enabling ssd optimizations
[pid 5112] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid 5112] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5112] chdir("./file0") = 0
[pid 5112] ioctl(4, LOOP_CLR_FD) = 0
[pid 5112] close(4) = 0
[pid 5112] open("./file0", O_RDONLY) = 4
[pid 5112] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid 5112] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5112] write(6, "17", 2) = 2
[pid 5112] ioctl(4, BTRFS_IOC_SNAP_CREATE, {fd=5, name="\x42\x99\xc6\x3c\x6a\xca\x4b\xec\x68\x72\xd2\x02\x80\x8d\xda\x69\x34\x9c\x62\x54\x02\x9b\xbc\x4a\x38\xfb\x4e\x91\xbb\xa4\x82\x6c\xd7\x77\xcb\x59\x74\x4a\xdd\x18\x26\x71\x40\x88\x2a\x98\x37\x3f\xbb\xf4\xb5\xb0\x7c"}) = 0
[pid 5112] exit_group(0) = ?
[pid 5112] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5112, si_uid=0, si_status=0, si_utime=4 /* 0.04 s */, si_stime=16 /* 0.16 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
[ 53.703895][ T5112] BTRFS info (device loop0): auto enabling async discard
[ 53.719079][ T27] audit: type=1800 audit(1672189852.550:4): pid=5112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor334" name="bus" dev="loop0" ino=263 res=0 errno=0
openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x555556021620 /* 4 entries */, 32768) = 112
umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./2/binderfs") = 0
umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./2/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./2/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x555556029660 /* 2 entries */, 32768) = 48
getdents64(4, 0x555556029660 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./2/file0") = 0
getdents64(3, 0x555556021620 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./2") = 0
mkdir("./3", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555560205d0) = 5130
./strace-static-x86_64: Process 5130 attached
[pid 5130] chdir("./3") = 0
[pid 5130] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5130] setpgid(0, 0) = 0
[pid 5130] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5130] write(3, "1000", 4) = 4
[pid 5130] close(3) = 0
[pid 5130] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5130] memfd_create("syzkaller", 0) = 3
[pid 5130] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fda801f0000
[pid 5130] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5130] munmap(0x7fda801f0000, 16777216) = 0
[pid 5130] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5130] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5130] close(3) = 0
[pid 5130] mkdir("./file0", 0777) = 0
[ 54.069363][ T5130] loop0: detected capacity change from 0 to 32768
[ 54.087170][ T5130] BTRFS info (device loop0): using sha256 (sha256-ni) checksum algorithm
[ 54.095699][ T5130] BTRFS info (device loop0): using free space tree
[pid 5130] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid 5130] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5130] chdir("./file0") = 0
[pid 5130] ioctl(4, LOOP_CLR_FD) = 0
[pid 5130] close(4) = 0
[pid 5130] open("./file0", O_RDONLY) = 4
[pid 5130] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid 5130] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5130] write(6, "17", 2) = 2
[ 54.114684][ T5130] BTRFS info (device loop0): enabling ssd optimizations
[ 54.121901][ T5130] BTRFS info (device loop0): auto enabling async discard
[ 54.142608][ T27] audit: type=1800 audit(1672189852.980:5): pid=5130 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor334" name="bus" dev="loop0" ino=263 res=0 errno=0
[ 54.168077][ T5130] FAULT_INJECTION: forcing a failure.
[ 54.168077][ T5130] name failslab, interval 1, probability 0, space 0, times 0
[ 54.181437][ T5130] CPU: 0 PID: 5130 Comm: syz-executor334 Not tainted 6.2.0-rc1-syzkaller #0
[ 54.190156][ T5130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 54.200260][ T5130] Call Trace:
[ 54.203580][ T5130]
[ 54.206536][ T5130] dump_stack_lvl+0xd1/0x138
[ 54.211177][ T5130] should_fail_ex.cold+0x5/0xa
[ 54.215995][ T5130] ? btrfs_add_delayed_tree_ref+0x23f/0x1080
[ 54.222032][ T5130] should_failslab+0x9/0x20
[ 54.226599][ T5130] kmem_cache_alloc+0x5a/0x430
[ 54.231421][ T5130] btrfs_add_delayed_tree_ref+0x23f/0x1080
[ 54.237348][ T5130] ? btrfs_delete_ref_head+0x2c0/0x2c0
[ 54.242828][ T5130] ? rcu_read_lock_sched_held+0x3e/0x70
[ 54.248397][ T5130] ? trace_kmem_cache_alloc+0x35/0x100
[ 54.253878][ T5130] ? kmem_cache_alloc+0x234/0x430
[ 54.258919][ T5130] btrfs_alloc_tree_block+0xe38/0x1320
[ 54.264411][ T5130] ? btrfs_alloc_logged_file_extent+0x600/0x600
[ 54.270842][ T5130] ? __lock_acquire+0xbc3/0x56d0
[ 54.275790][ T5130] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 54.281792][ T5130] ? memcpy+0x3d/0x60
[ 54.285788][ T5130] __btrfs_cow_block+0x3b2/0x1420
[ 54.291016][ T5130] ? update_ref_for_cow+0xb30/0xb30
[ 54.296225][ T5130] ? btrfs_qgroup_add_swapped_blocks+0x990/0x990
[ 54.302591][ T5130] btrfs_cow_block+0x2fa/0x950
[ 54.307551][ T5130] btrfs_search_slot+0x11c7/0x2c90
[ 54.312697][ T5130] ? split_leaf+0x13c0/0x13c0
[ 54.317381][ T5130] ? btrfs_global_root+0xf5/0x120
[ 54.322431][ T5130] ? btrfs_extent_root+0x13f/0x1a0
[ 54.327565][ T5130] ? btrfs_csum_root+0x1a0/0x1a0
[ 54.332530][ T5130] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.338617][ T5130] ? find_held_lock+0x2d/0x110
[ 54.343412][ T5130] lookup_inline_extent_backref+0x313/0x10e0
[ 54.349427][ T5130] ? hash_extent_data_ref+0xf0/0xf0
[ 54.354642][ T5130] ? fs_reclaim_acquire+0xba/0x160
[ 54.359784][ T5130] lookup_extent_backref+0x46/0x110
[ 54.365025][ T5130] __btrfs_free_extent+0x233/0x1370
[ 54.370264][ T5130] ? lookup_extent_backref+0x110/0x110
[ 54.375923][ T5130] ? __btrfs_run_delayed_refs+0x55c/0x3760
[ 54.381747][ T5130] ? lock_downgrade+0x6e0/0x6e0
[ 54.386600][ T5130] ? _raw_read_unlock+0x28/0x40
[ 54.391464][ T5130] ? btrfs_tree_mod_log_lowest_seq+0x86/0xb0
[ 54.397642][ T5130] __btrfs_run_delayed_refs+0x141c/0x3760
[ 54.403409][ T5130] ? check_ref_cleanup+0x3e0/0x3e0
[ 54.408558][ T5130] ? lock_release+0x810/0x810
[ 54.413258][ T5130] btrfs_run_delayed_refs+0x19a/0x490
[ 54.418662][ T5130] btrfs_commit_transaction+0x1e94/0x36c0
[ 54.424393][ T5130] ? do_raw_spin_lock+0x124/0x2b0
[ 54.429603][ T5130] ? rwlock_bug.part.0+0x90/0x90
[ 54.434583][ T5130] ? join_transaction+0x43e/0x10e0
[ 54.439715][ T5130] ? btrfs_commit_transaction_async+0x3f0/0x3f0
[ 54.445986][ T5130] ? start_transaction+0x2aa/0x1410
[ 54.451214][ T5130] btrfs_mksubvol+0xc09/0x1550
[ 54.456005][ T5130] ? create_subvol+0x13f0/0x13f0
[ 54.460972][ T5130] btrfs_mksnapshot+0xaf/0xf0
[ 54.465670][ T5130] __btrfs_ioctl_snap_create+0x3c1/0x430
[ 54.471332][ T5130] btrfs_ioctl_snap_create+0x148/0x1b0
[ 54.476811][ T5130] btrfs_ioctl+0x35b/0x5830
[ 54.481331][ T5130] ? tomoyo_path_number_perm+0x166/0x570
[ 54.486982][ T5130] ? tomoyo_execute_permission+0x4a0/0x4a0
[ 54.492810][ T5130] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 54.499337][ T5130] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 54.505260][ T5130] ? do_vfs_ioctl+0x132/0x15b0
[ 54.510042][ T5130] ? vfs_fileattr_set+0xbe0/0xbe0
[ 54.515190][ T5130] ? find_held_lock+0x2d/0x110
[ 54.519988][ T5130] ? do_one_initcall+0x470/0x790
[ 54.524951][ T5130] ? lock_downgrade+0x6e0/0x6e0
[ 54.529833][ T5130] ? bpf_lsm_file_ioctl+0x9/0x10
[ 54.534796][ T5130] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 54.541237][ T5130] __x64_sys_ioctl+0x197/0x210
[ 54.546021][ T5130] do_syscall_64+0x39/0xb0
[ 54.550459][ T5130] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.556371][ T5130] RIP: 0033:0x7fda8863da09
[ 54.560799][ T5130] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 54.580423][ T5130] RSP: 002b:00007ffefe362a48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 54.588853][ T5130] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fda8863da09
[ 54.596851][ T5130] RDX: 00000000200000c0 RSI: 0000000050009401 RDI: 0000000000000004
[ 54.604838][ T5130] RBP: 00007ffefe362a70 R08: 0000000000000002 R09: 00007ffefe362a80
[ 54.612820][ T5130] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
[ 54.620796][ T5130] R13: 00007ffefe362ab0 R14: 00007ffefe362a90 R15: 0000000000000003
[ 54.628798][ T5130]
[ 54.635843][ T5130] BTRFS error (device loop0: state A): Transaction aborted (error -12)
[ 54.644606][ T5130] BTRFS: error (device loop0: state A) in __btrfs_free_extent:3074: errno=-12 Out of memory
[ 54.654935][ T5130] BTRFS info (device loop0: state EA): forced readonly
[pid 5130] ioctl(4, BTRFS_IOC_SNAP_CREATE, {fd=5, name="\x42\x99\xc6\x3c\x6a\xca\x4b\xec\x68\x72\xd2\x02\x80\x8d\xda\x69\x34\x9c\x62\x54\x02\x9b\xbc\x4a\x38\xfb\x4e\x91\xbb\xa4\x82\x6c\xd7\x77\xcb\x59\x74\x4a\xdd\x18\x26\x71\x40\x88\x2a\x98\x37\x3f\xbb\xf4\xb5\xb0\x7c"}) = -1 ENOMEM (Cannot allocate memory)
[pid 5130] exit_group(0) = ?
[pid 5130] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5130, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=23 /* 0.23 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x555556021620 /* 4 entries */, 32768) = 112
umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./3/binderfs") = 0
[ 54.662296][ T5130] BTRFS: error (device loop0: state EA) in btrfs_run_delayed_refs:2148: errno=-12 Out of memory
[ 54.720242][ T5062] ------------[ cut here ]------------
[ 54.726518][ T5062] WARNING: CPU: 0 PID: 5062 at fs/btrfs/space-info.h:199 btrfs_space_info_update_bytes_may_use+0x524/0x820
[ 54.737996][ T5062] Modules linked in:
[ 54.741965][ T5062] CPU: 0 PID: 5062 Comm: syz-executor334 Not tainted 6.2.0-rc1-syzkaller #0
[ 54.750629][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 54.760928][ T5062] RIP: 0010:btrfs_space_info_update_bytes_may_use+0x524/0x820
[ 54.768456][ T5062] Code: fd e9 77 fb ff ff e8 6b 14 fd fd 4d 89 e6 48 89 de 49 f7 de 4c 89 f7 e8 aa 10 fd fd 49 39 de 0f 86 b5 fc ff ff e8 4c 14 fd fd <0f> 0b 31 db e9 af fc ff ff e8 3e 14 fd fd 48 8d 7d 18 be ff ff ff
[ 54.788185][ T5062] RSP: 0018:ffffc90003adfa90 EFLAGS: 00010293
[ 54.794357][ T5062] RAX: 0000000000000000 RBX: 00000000000df000 RCX: 0000000000000000
[ 54.802414][ T5062] RDX: ffff88801ea1ba80 RSI: ffffffff83843df4 RDI: 0000000000000006
[ 54.810514][ T5062] RBP: ffff88802b0b8800 R08: 0000000000000006 R09: 00000000000e0000
[ 54.818581][ T5062] R10: 00000000000df000 R11: 0000000000000000 R12: fffffffffff20000
[ 54.826648][ T5062] R13: ffff88802b0b8860 R14: 00000000000e0000 R15: 0000000000000002
[ 54.834787][ T5062] FS: 0000555556020300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
[ 54.843807][ T5062] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 54.850392][ T5062] CR2: 00007f6f0d15f300 CR3: 0000000074e98000 CR4: 0000000000350ef0
[ 54.858446][ T5062] Call Trace:
[ 54.861795][ T5062]
[ 54.864722][ T5062] btrfs_block_rsv_release+0x519/0x650
[ 54.870186][ T5062] btrfs_release_global_block_rsv+0x26/0x2e0
[ 54.876249][ T5062] btrfs_free_block_groups+0x958/0x1110
[ 54.881915][ T5062] close_ctree+0xd23/0xdcf
[ 54.886334][ T5062] ? btrfs_cleanup_one_transaction.cold+0x5d/0x5d
[ 54.892818][ T5062] ? hook_sb_remount+0xf0/0xf0
[ 54.897657][ T5062] ? __fsnotify_vfsmount_delete+0x20/0x20
[ 54.903504][ T5062] ? dispose_list+0x1e0/0x1e0
[ 54.908266][ T5062] ? parse_rescue_options.cold+0x21d/0x21d
[ 54.914205][ T5062] generic_shutdown_super+0x158/0x410
[ 54.919626][ T5062] kill_anon_super+0x3a/0x60
[ 54.924318][ T5062] btrfs_kill_super+0x3c/0x50
[ 54.929079][ T5062] deactivate_locked_super+0x98/0x160
[ 54.934541][ T5062] deactivate_super+0xb1/0xd0
[ 54.939283][ T5062] cleanup_mnt+0x2ae/0x3d0
[ 54.943799][ T5062] task_work_run+0x16f/0x270
[ 54.948451][ T5062] ? task_work_cancel+0x30/0x30
[ 54.953393][ T5062] ? __x64_sys_umount+0x118/0x190
[ 54.958470][ T5062] ptrace_notify+0x118/0x140
[ 54.963140][ T5062] syscall_exit_to_user_mode_prepare+0x129/0x280
[ 54.969540][ T5062] syscall_exit_to_user_mode+0xd/0x50
[ 54.974993][ T5062] do_syscall_64+0x46/0xb0
[ 54.979467][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 54.985444][ T5062] RIP: 0033:0x7fda8863eda7
[ 54.989898][ T5062] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 55.009603][ T5062] RSP: 002b:00007ffefe361958 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 55.018161][ T5062] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fda8863eda7
[ 55.026242][ T5062] RDX: 00007ffefe361a19 RSI: 000000000000000a RDI: 00007ffefe361a10
[ 55.034285][ T5062] RBP: 00007ffefe361a10 R08: 00000000ffffffff R09: 00007ffefe3617f0
[ 55.042345][ T5062] R10: 0000555556021653 R11: 0000000000000202 R12: 00007ffefe362a90
[ 55.050330][ T5062] R13: 00005555560215f0 R14: 00007ffefe361980 R15: 0000000000000004
[ 55.058407][ T5062]
[ 55.061500][ T5062] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 55.068761][ T5062] CPU: 0 PID: 5062 Comm: syz-executor334 Not tainted 6.2.0-rc1-syzkaller #0
[ 55.077416][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 55.087457][ T5062] Call Trace:
[ 55.090729][ T5062]
[ 55.093654][ T5062] dump_stack_lvl+0xd1/0x138
[ 55.098235][ T5062] panic+0x2cc/0x626
[ 55.102123][ T5062] ? panic_print_sys_info.part.0+0x110/0x110
[ 55.108098][ T5062] ? btrfs_space_info_update_bytes_may_use+0x524/0x820
[ 55.114937][ T5062] check_panic_on_warn.cold+0x19/0x35
[ 55.120300][ T5062] __warn+0xf2/0x1a0
[ 55.124188][ T5062] ? btrfs_space_info_update_bytes_may_use+0x524/0x820
[ 55.131027][ T5062] report_bug+0x1c0/0x210
[ 55.135447][ T5062] handle_bug+0x3c/0x70
[ 55.139589][ T5062] exc_invalid_op+0x18/0x50
[ 55.144084][ T5062] asm_exc_invalid_op+0x1a/0x20
[ 55.148921][ T5062] RIP: 0010:btrfs_space_info_update_bytes_may_use+0x524/0x820
[ 55.156374][ T5062] Code: fd e9 77 fb ff ff e8 6b 14 fd fd 4d 89 e6 48 89 de 49 f7 de 4c 89 f7 e8 aa 10 fd fd 49 39 de 0f 86 b5 fc ff ff e8 4c 14 fd fd <0f> 0b 31 db e9 af fc ff ff e8 3e 14 fd fd 48 8d 7d 18 be ff ff ff
[ 55.175981][ T5062] RSP: 0018:ffffc90003adfa90 EFLAGS: 00010293
[ 55.182042][ T5062] RAX: 0000000000000000 RBX: 00000000000df000 RCX: 0000000000000000
[ 55.190003][ T5062] RDX: ffff88801ea1ba80 RSI: ffffffff83843df4 RDI: 0000000000000006
[ 55.197974][ T5062] RBP: ffff88802b0b8800 R08: 0000000000000006 R09: 00000000000e0000
[ 55.206030][ T5062] R10: 00000000000df000 R11: 0000000000000000 R12: fffffffffff20000
[ 55.214007][ T5062] R13: ffff88802b0b8860 R14: 00000000000e0000 R15: 0000000000000002
[ 55.221993][ T5062] ? btrfs_space_info_update_bytes_may_use+0x524/0x820
[ 55.228869][ T5062] btrfs_block_rsv_release+0x519/0x650
[ 55.234355][ T5062] btrfs_release_global_block_rsv+0x26/0x2e0
[ 55.240349][ T5062] btrfs_free_block_groups+0x958/0x1110
[ 55.245920][ T5062] close_ctree+0xd23/0xdcf
[ 55.250350][ T5062] ? btrfs_cleanup_one_transaction.cold+0x5d/0x5d
[ 55.256775][ T5062] ? hook_sb_remount+0xf0/0xf0
[ 55.261554][ T5062] ? __fsnotify_vfsmount_delete+0x20/0x20
[ 55.267281][ T5062] ? dispose_list+0x1e0/0x1e0
[ 55.271976][ T5062] ? parse_rescue_options.cold+0x21d/0x21d
[ 55.277792][ T5062] generic_shutdown_super+0x158/0x410
[ 55.283179][ T5062] kill_anon_super+0x3a/0x60
[ 55.287778][ T5062] btrfs_kill_super+0x3c/0x50
[ 55.292472][ T5062] deactivate_locked_super+0x98/0x160
[ 55.297858][ T5062] deactivate_super+0xb1/0xd0
[ 55.302547][ T5062] cleanup_mnt+0x2ae/0x3d0
[ 55.306972][ T5062] task_work_run+0x16f/0x270
[ 55.311580][ T5062] ? task_work_cancel+0x30/0x30
[ 55.316444][ T5062] ? __x64_sys_umount+0x118/0x190
[ 55.321484][ T5062] ptrace_notify+0x118/0x140
[ 55.326075][ T5062] syscall_exit_to_user_mode_prepare+0x129/0x280
[ 55.332408][ T5062] syscall_exit_to_user_mode+0xd/0x50
[ 55.337779][ T5062] do_syscall_64+0x46/0xb0
[ 55.342205][ T5062] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 55.348101][ T5062] RIP: 0033:0x7fda8863eda7
[ 55.352525][ T5062] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 55.372141][ T5062] RSP: 002b:00007ffefe361958 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6
[ 55.380557][ T5062] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fda8863eda7
[ 55.388615][ T5062] RDX: 00007ffefe361a19 RSI: 000000000000000a RDI: 00007ffefe361a10
[ 55.396592][ T5062] RBP: 00007ffefe361a10 R08: 00000000ffffffff R09: 00007ffefe3617f0
[ 55.404569][ T5062] R10: 0000555556021653 R11: 0000000000000202 R12: 00007ffefe362a90
[ 55.412542][ T5062] R13: 00005555560215f0 R14: 00007ffefe361980 R15: 0000000000000004
[ 55.420537][ T5062]
[ 55.424245][ T5062] Kernel Offset: disabled
[ 55.428681][ T5062] Rebooting in 86400 seconds..