loop0: detected capacity change from 0 to 32768 BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.0 (5325) BTRFS info (device loop0): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm BTRFS info (device loop0): using free-space-tree FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller-00012-g3022e9d00ebe #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 fail_dump lib/fault-inject.c:53 [inline] should_fail_ex+0x3b0/0x4e0 lib/fault-inject.c:154 should_failslab+0xac/0x100 mm/failslab.c:46 slab_pre_alloc_hook mm/slub.c:4038 [inline] slab_alloc_node mm/slub.c:4114 [inline] kmem_cache_alloc_noprof+0x6c/0x2a0 mm/slub.c:4141 add_to_free_space_tree+0xc7/0x2e0 fs/btrfs/free-space-tree.c:1036 do_free_extent_accounting fs/btrfs/extent-tree.c:2992 [inline] __btrfs_free_extent+0x1d65/0x3a10 fs/btrfs/extent-tree.c:3362 run_delayed_tree_ref fs/btrfs/extent-tree.c:1740 [inline] run_one_delayed_ref fs/btrfs/extent-tree.c:1766 [inline] btrfs_run_delayed_refs_for_head fs/btrfs/extent-tree.c:2031 [inline] __btrfs_run_delayed_refs+0x112e/0x4680 fs/btrfs/extent-tree.c:2101 btrfs_run_delayed_refs+0xe3/0x2c0 fs/btrfs/extent-tree.c:2213 btrfs_commit_transaction+0x4be/0x3740 fs/btrfs/transaction.c:2197 try_flush_qgroup+0x1ec/0x340 fs/btrfs/qgroup.c:4206 btrfs_qgroup_reserve_data+0x68/0xb0 fs/btrfs/qgroup.c:4287 btrfs_check_data_free_space+0x149/0x240 fs/btrfs/delalloc-space.c:152 btrfs_buffered_write+0x5c7/0x1360 fs/btrfs/file.c:1264 btrfs_do_write_iter+0x279/0x760 fs/btrfs/file.c:1508 aio_write+0x56b/0x7c0 fs/aio.c:1633 io_submit_one+0x8a7/0x18a0 fs/aio.c:2052 __do_sys_io_submit fs/aio.c:2111 [inline] __se_sys_io_submit+0x179/0x2f0 fs/aio.c:2081 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f48cbb7e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f48cb5fe038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 RAX: ffffffffffffffda RBX: 00007f48cbd35f80 RCX: 00007f48cbb7e719 RDX: 0000000020000540 RSI: 0000000000000001 RDI: 00007f48cc885000 RBP: 00007f48cb5fe090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 0000000000000000 R14: 00007f48cbd35f80 R15: 00007ffe00530ba8 BTRFS error (device loop0 state A): Transaction aborted (error -12) BTRFS: error (device loop0 state A) in add_to_free_space_tree:1057: errno=-12 Out of memory BTRFS info (device loop0 state EA): forced readonly BTRFS: error (device loop0 state EA) in do_free_extent_accounting:2994: errno=-12 Out of memory BTRFS error (device loop0 state EA): failed to run delayed ref for logical 5255168 num_bytes 4096 type 176 action 2 ref_mod 1: -12 BTRFS: error (device loop0 state EA) in btrfs_run_delayed_refs:2215: errno=-12 Out of memory BUG: MAX_LOCK_DEPTH too low! turning off the locking correctness validator. depth: 48 max: 48! 48 locks held by syz.0.0/5325: #0: ffff888043eb9638 (&sb->s_type->i_mutex_key#19){+.+.}-{3:3}, at: inode_trylock include/linux/fs.h:835 [inline] #0: ffff888043eb9638 (&sb->s_type->i_mutex_key#19){+.+.}-{3:3}, at: btrfs_inode_lock+0x87/0xe0 fs/btrfs/inode.c:357 #1: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #2: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #3: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #4: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #5: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #6: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #7: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #8: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #9: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #10: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #11: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #12: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #13: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #14: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #15: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #16: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #17: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #18: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #19: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #20: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #21: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #22: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #23: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #24: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #25: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #26: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #27: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #28: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #29: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #30: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #31: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #32: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #33: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #34: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #35: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #36: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #37: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #38: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #39: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #40: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #41: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #42: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #43: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #44: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #45: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #46: ffff8880510c54b8 (btrfs-tree-01){++++}-{3:3}, at: btrfs_try_tree_read_lock+0x1c/0x240 fs/btrfs/locking.c:157 #47: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #47: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #47: ffffffff8e937da0 (rcu_read_lock){....}-{1:2}, at: find_extent_buffer_nolock+0x21/0x320 fs/btrfs/extent_io.c:1615 INFO: lockdep is turned off. CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller-00012-g3022e9d00ebe #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 __lock_acquire+0x10ee/0x2050 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 rcu_lock_acquire include/linux/rcupdate.h:337 [inline] rcu_read_lock include/linux/rcupdate.h:849 [inline] find_extent_buffer_nolock+0x3e/0x320 fs/btrfs/extent_io.c:1615 find_extent_buffer+0x24/0x340 fs/btrfs/extent_io.c:2710 read_block_for_search+0x348/0x920 fs/btrfs/ctree.c:1540 btrfs_search_slot+0x120d/0x30d0 fs/btrfs/ctree.c:2200 btrfs_lookup_file_extent+0x14c/0x210 fs/btrfs/file-item.c:267 can_nocow_extent+0x1c5/0x940 fs/btrfs/inode.c:7055 btrfs_check_nocow_lock+0x274/0x400 fs/btrfs/file.c:1106 btrfs_buffered_write+0x63f/0x1360 fs/btrfs/file.c:1280 btrfs_do_write_iter+0x279/0x760 fs/btrfs/file.c:1508 aio_write+0x56b/0x7c0 fs/aio.c:1633 io_submit_one+0x8a7/0x18a0 fs/aio.c:2052 __do_sys_io_submit fs/aio.c:2111 [inline] __se_sys_io_submit+0x179/0x2f0 fs/aio.c:2081 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f48cbb7e719 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f48cb5fe038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 RAX: ffffffffffffffda RBX: 00007f48cbd35f80 RCX: 00007f48cbb7e719 RDX: 0000000020000540 RSI: 0000000000000001 RDI: 00007f48cc885000 RBP: 00007f48cb5fe090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 0000000000000000 R14: 00007f48cbd35f80 R15: 00007ffe00530ba8