./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3246688993
<...>
syzkaller
syzkaller login: [ 42.614486][ T26] kauditd_printk_skb: 42 callbacks suppressed
[ 42.614497][ T26] audit: type=1400 audit(1686927901.246:77): avc: denied { transition } for pid=4842 comm="sshd" path="/bin/sh" dev="sda1" ino=89 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 42.642883][ T26] audit: type=1400 audit(1686927901.256:78): avc: denied { noatsecure } for pid=4842 comm="sshd" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 42.662174][ T26] audit: type=1400 audit(1686927901.286:79): avc: denied { write } for pid=4842 comm="sh" path="pipe:[29777]" dev="pipefs" ino=29777 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 42.684701][ T26] audit: type=1400 audit(1686927901.286:80): avc: denied { rlimitinh } for pid=4842 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 42.704134][ T26] audit: type=1400 audit(1686927901.286:81): avc: denied { siginh } for pid=4842 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[ 43.391852][ T26] audit: type=1400 audit(1686927902.026:82): avc: denied { read } for pid=4429 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1
Warning: Permanently added '10.128.10.7' (ECDSA) to the list of known hosts.
execve("./syz-executor3246688993", ["./syz-executor3246688993"], 0x7ffc25f82da0 /* 10 vars */) = 0
brk(NULL) = 0x555556879000
brk(0x555556879c40) = 0x555556879c40
arch_prctl(ARCH_SET_FS, 0x555556879300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3246688993", 4096) = 28
brk(0x55555689ac40) = 0x55555689ac40
brk(0x55555689b000) = 0x55555689b000
mprotect(0x7f5e2540f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
openat(AT_FDCWD, "/sys/kernel/debug/failslab/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/ignore-private", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-highmem", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", O_WRONLY|O_CLOEXEC) = 3
write(3, "N", 1) = 1
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/min-order", O_WRONLY|O_CLOEXEC) = 3
write(3, "0", 1) = 1
close(3) = 0
getpid() = 4992
mkdir("./syzkaller.5UL24G", 0700) = 0
chmod("./syzkaller.5UL24G", 0777) = 0
chdir("./syzkaller.5UL24G") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
[ 60.705332][ T26] audit: type=1400 audit(1686927919.336:83): avc: denied { write } for pid=4989 comm="strace-static-x" path="pipe:[29918]" dev="pipefs" ino=29918 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1
[ 60.729394][ T26] audit: type=1400 audit(1686927919.356:84): avc: denied { execmem } for pid=4992 comm="syz-executor324" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555568795d0) = 4993
./strace-static-x86_64: Process 4993 attached
[pid 4993] chdir("./0") = 0
[pid 4993] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 4993] setpgid(0, 0) = 0
[pid 4993] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 4993] write(3, "1000", 4) = 4
[pid 4993] close(3) = 0
[ 60.751334][ T26] audit: type=1400 audit(1686927919.376:85): avc: denied { read write } for pid=4992 comm="syz-executor324" name="loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 60.776664][ T26] audit: type=1400 audit(1686927919.386:86): avc: denied { open } for pid=4992 comm="syz-executor324" path="/dev/loop0" dev="devtmpfs" ino=648 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[pid 4993] symlink("/dev/binderfs", "./binderfs") = 0
[pid 4993] memfd_create("syzkaller", 0) = 3
[pid 4993] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f5e1cf4d000
[ 60.802311][ T26] audit: type=1400 audit(1686927919.386:87): avc: denied { ioctl } for pid=4992 comm="syz-executor324" path="/dev/loop0" dev="devtmpfs" ino=648 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[ 60.831161][ T4993] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4993 'syz-executor324'
[pid 4993] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 4993] munmap(0x7f5e1cf4d000, 16777216) = 0
[pid 4993] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 4993] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 4993] close(3) = 0
[pid 4993] mkdir("./file0", 0777) = 0
[ 61.008780][ T4993] loop0: detected capacity change from 0 to 32768
[ 61.019003][ T26] audit: type=1400 audit(1686927919.646:88): avc: denied { mounton } for pid=4993 comm="syz-executor324" path="/root/syzkaller.5UL24G/0/file0" dev="sda1" ino=1930 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1
[ 61.023739][ T4993] BTRFS: device fsid d552757d-9c39-40e3-95f0-16d819589928 devid 1 transid 8 /dev/loop0 scanned by syz-executor324 (4993)
[ 61.066199][ T4993] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm
[ 61.075192][ T4993] BTRFS info (device loop0): using free space tree
[ 61.098799][ T4993] BTRFS info (device loop0): enabling ssd optimizations
[ 61.105924][ T4993] BTRFS info (device loop0): auto enabling async discard
[pid 4993] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid 4993] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 4993] chdir("./file0") = 0
[pid 4993] ioctl(4, LOOP_CLR_FD) = 0
[pid 4993] close(4) = 0
[pid 4993] open("./file0", O_RDONLY) = 4
[pid 4993] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid 4993] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 4993] write(6, "17", 2) = 2
[ 61.118312][ T26] audit: type=1400 audit(1686927919.756:89): avc: denied { mount } for pid=4993 comm="syz-executor324" name="/" dev="loop0" ino=256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[ 61.157094][ T26] audit: type=1400 audit(1686927919.786:90): avc: denied { write } for pid=4993 comm="syz-executor324" name="/" dev="loop0" ino=256 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[ 61.171564][ T4993] FAULT_INJECTION: forcing a failure.
[ 61.171564][ T4993] name failslab, interval 1, probability 0, space 0, times 1
[ 61.192066][ T4993] CPU: 1 PID: 4993 Comm: syz-executor324 Not tainted 6.4.0-rc6-syzkaller-00049-g62d8779610bb #0
[ 61.202508][ T4993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 61.212570][ T4993] Call Trace:
[ 61.215853][ T4993] <TASK>
[ 61.218785][ T4993] dump_stack_lvl+0x136/0x150
[ 61.223485][ T4993] should_fail_ex+0x4a3/0x5b0
[ 61.228204][ T4993] should_failslab+0x9/0x20
[ 61.232740][ T4993] __kmem_cache_alloc_node+0x5b/0x3f0
[ 61.238127][ T4993] kmalloc_trace+0x26/0xe0
[ 61.242557][ T4993] btrfs_mksubvol+0x815/0x1310
[ 61.247336][ T4993] ? create_subvol+0x16f0/0x16f0
[ 61.252530][ T4993] ? make_vfsuid+0x113/0x170
[ 61.257141][ T4993] btrfs_mksnapshot+0xaf/0xf0
[ 61.261827][ T4993] __btrfs_ioctl_snap_create+0x42b/0x4d0
[ 61.267471][ T4993] btrfs_ioctl_snap_create+0x15f/0x200
[ 61.272942][ T4993] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 61.278846][ T4993] btrfs_ioctl+0x50e/0x5b30
[ 61.283357][ T4993] ? tomoyo_path_number_perm+0x166/0x570
[ 61.289007][ T4993] ? tomoyo_execute_permission+0x4a0/0x4a0
[ 61.294826][ T4993] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 61.301250][ T4993] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 61.307170][ T4993] ? do_vfs_ioctl+0x132/0x1670
[ 61.311949][ T4993] ? vfs_fileattr_set+0xc40/0xc40
[ 61.316987][ T4993] ? ioctl_has_perm.constprop.0.isra.0+0x28c/0x420
[ 61.323513][ T4993] ? ioctl_has_perm.constprop.0.isra.0+0x295/0x420
[ 61.330036][ T4993] ? selinux_bprm_creds_for_exec+0xb20/0xb20
[ 61.336030][ T4993] ? find_held_lock+0x2d/0x110
[ 61.340819][ T4993] ? do_one_initcall+0x270/0x540
[ 61.345798][ T4993] ? lock_downgrade+0x690/0x690
[ 61.350670][ T4993] ? selinux_file_ioctl+0xba/0x280
[ 61.355791][ T4993] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 61.362219][ T4993] __x64_sys_ioctl+0x197/0x210
[ 61.366988][ T4993] do_syscall_64+0x39/0xb0
[ 61.371409][ T4993] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 61.377319][ T4993] RIP: 0033:0x7f5e2539aa29
[ 61.381738][ T4993] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 61.401349][ T4993] RSP: 002b:00007fffdb72f738 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 61.409766][ T4993] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f5e2539aa29
[ 61.417756][ T4993] RDX: 00000000200000c0 RSI: 0000000050009401 RDI: 0000000000000004
[ 61.425743][ T4993] RBP: 00007fffdb72f760 R08: 0000000000000002 R09: 00007fffdb72f770
[ 61.433724][ T4993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
[ 61.441700][ T4993] R13: 00007fffdb72f7a0 R14: 00007fffdb72f780 R15: 0000000000000000
[ 61.449678][ T4993] </TASK>
[pid 4993] ioctl(4, BTRFS_IOC_SNAP_CREATE, {fd=5, name="\x42\x99\xc6\x3c\x6a\xca\x4b\xec\x68\x72\xd2\x02\x80\x8d\xda\x69\x34\x9c\x62\x54\x02\x9b\xbc\x4a\x38\xfb\x4e\x91\xbb\xa4\x82\x6c\xd7\x77\xcb\x59\x74\x4a\xdd\x18\x26\x71\x40\x88\x2a\x98\x37\x3f\xbb\xf4\xb5\xb0\x7c"}) = -1 ENOMEM (Cannot allocate memory)
[pid 4993] exit_group(0) = ?
[pid 4993] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4993, si_uid=0, si_status=0, si_utime=2 /* 0.02 s */, si_stime=27 /* 0.27 s */} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555687a620 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./0/binderfs") = 0
[ 61.458563][ T26] audit: type=1400 audit(1686927919.786:91): avc: denied { add_name } for pid=4993 comm="syz-executor324" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1
[ 61.480053][ T26] audit: type=1400 audit(1686927919.786:92): avc: denied { create } for pid=4993 comm="syz-executor324" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./0/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x555556882660 /* 2 entries */, 32768) = 48
getdents64(4, 0x555556882660 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./0/file0") = 0
getdents64(3, 0x55555687a620 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./0") = 0
mkdir("./1", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555568795d0) = 5022
./strace-static-x86_64: Process 5022 attached
[pid 5022] chdir("./1") = 0
[pid 5022] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5022] setpgid(0, 0) = 0
[pid 5022] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5022] write(3, "1000", 4) = 4
[pid 5022] close(3) = 0
[pid 5022] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5022] memfd_create("syzkaller", 0) = 3
[pid 5022] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f5e1cf4d000
[pid 5022] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5022] munmap(0x7f5e1cf4d000, 16777216) = 0
[pid 5022] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5022] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5022] close(3) = 0
[pid 5022] mkdir("./file0", 0777) = 0
[ 61.900733][ T5022] loop0: detected capacity change from 0 to 32768
[ 61.911552][ T5022] BTRFS: device fsid d552757d-9c39-40e3-95f0-16d819589928 devid 1 transid 8 /dev/loop0 scanned by syz-executor324 (5022)
[ 61.928996][ T5022] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm
[ 61.937984][ T5022] BTRFS info (device loop0): using free space tree
[pid 5022] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid 5022] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5022] chdir("./file0") = 0
[pid 5022] ioctl(4, LOOP_CLR_FD) = 0
[pid 5022] close(4) = 0
[pid 5022] open("./file0", O_RDONLY) = 4
[pid 5022] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid 5022] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5022] write(6, "17", 2) = 2
[ 61.956928][ T5022] BTRFS info (device loop0): enabling ssd optimizations
[ 61.963989][ T5022] BTRFS info (device loop0): auto enabling async discard
[ 61.992950][ T5022] FAULT_INJECTION: forcing a failure.
[ 61.992950][ T5022] name failslab, interval 1, probability 0, space 0, times 0
[ 62.006275][ T5022] CPU: 1 PID: 5022 Comm: syz-executor324 Not tainted 6.4.0-rc6-syzkaller-00049-g62d8779610bb #0
[ 62.016723][ T5022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 62.026808][ T5022] Call Trace:
[ 62.030107][ T5022] <TASK>
[ 62.033058][ T5022] dump_stack_lvl+0x136/0x150
[ 62.037768][ T5022] should_fail_ex+0x4a3/0x5b0
[ 62.042488][ T5022] should_failslab+0x9/0x20
[ 62.047029][ T5022] kmem_cache_alloc+0x5d/0x3f0
[ 62.051838][ T5022] ? btrfs_delayed_refs_rsv_refill+0x124/0x200
[ 62.058025][ T5022] start_transaction+0x345/0x14c0
[ 62.063078][ T5022] btrfs_mksubvol+0xa20/0x1310
[ 62.067856][ T5022] ? create_subvol+0x16f0/0x16f0
[ 62.072802][ T5022] ? make_vfsuid+0x113/0x170
[ 62.077406][ T5022] btrfs_mksnapshot+0xaf/0xf0
[ 62.082104][ T5022] __btrfs_ioctl_snap_create+0x42b/0x4d0
[ 62.087750][ T5022] btrfs_ioctl_snap_create+0x15f/0x200
[ 62.093220][ T5022] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 62.099122][ T5022] btrfs_ioctl+0x50e/0x5b30
[ 62.103633][ T5022] ? tomoyo_path_number_perm+0x166/0x570
[ 62.109282][ T5022] ? tomoyo_execute_permission+0x4a0/0x4a0
[ 62.115100][ T5022] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 62.121524][ T5022] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 62.127426][ T5022] ? do_vfs_ioctl+0x132/0x1670
[ 62.132198][ T5022] ? vfs_fileattr_set+0xc40/0xc40
[ 62.137226][ T5022] ? ioctl_has_perm.constprop.0.isra.0+0x28c/0x420
[ 62.143734][ T5022] ? ioctl_has_perm.constprop.0.isra.0+0x295/0x420
[ 62.150252][ T5022] ? selinux_bprm_creds_for_exec+0xb20/0xb20
[ 62.156238][ T5022] ? find_held_lock+0x2d/0x110
[ 62.161008][ T5022] ? do_one_initcall+0x270/0x540
[ 62.165956][ T5022] ? lock_downgrade+0x690/0x690
[ 62.170817][ T5022] ? selinux_file_ioctl+0xba/0x280
[ 62.175932][ T5022] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 62.182357][ T5022] __x64_sys_ioctl+0x197/0x210
[ 62.187124][ T5022] do_syscall_64+0x39/0xb0
[ 62.191543][ T5022] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 62.197451][ T5022] RIP: 0033:0x7f5e2539aa29
[ 62.201865][ T5022] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 62.221477][ T5022] RSP: 002b:00007fffdb72f738 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 62.229894][ T5022] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f5e2539aa29
[ 62.237868][ T5022] RDX: 00000000200000c0 RSI: 0000000050009401 RDI: 0000000000000004
[ 62.245837][ T5022] RBP: 00007fffdb72f760 R08: 0000000000000002 R09: 00007fffdb72f770
[pid 5022] ioctl(4, BTRFS_IOC_SNAP_CREATE, {fd=5, name="\x42\x99\xc6\x3c\x6a\xca\x4b\xec\x68\x72\xd2\x02\x80\x8d\xda\x69\x34\x9c\x62\x54\x02\x9b\xbc\x4a\x38\xfb\x4e\x91\xbb\xa4\x82\x6c\xd7\x77\xcb\x59\x74\x4a\xdd\x18\x26\x71\x40\x88\x2a\x98\x37\x3f\xbb\xf4\xb5\xb0\x7c"}) = -1 ENOMEM (Cannot allocate memory)
[pid 5022] exit_group(0) = ?
[pid 5022] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5022, si_uid=0, si_status=0, si_utime=1 /* 0.01 s */, si_stime=19 /* 0.19 s */} ---
umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555687a620 /* 4 entries */, 32768) = 112
umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./1/binderfs") = 0
[ 62.253809][ T5022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
[ 62.261786][ T5022] R13: 00007fffdb72f7a0 R14: 00007fffdb72f780 R15: 0000000000000001
[ 62.269762][ T5022] </TASK>
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./1/file0", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
umount2("./1/file0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./1/file0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
fstat(4, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(4, 0x555556882660 /* 2 entries */, 32768) = 48
getdents64(4, 0x555556882660 /* 0 entries */, 32768) = 0
close(4) = 0
rmdir("./1/file0") = 0
getdents64(3, 0x55555687a620 /* 0 entries */, 32768) = 0
close(3) = 0
rmdir("./1") = 0
mkdir("./2", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = 0
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555568795d0) = 5051
./strace-static-x86_64: Process 5051 attached
[pid 5051] chdir("./2") = 0
[pid 5051] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5051] setpgid(0, 0) = 0
[pid 5051] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5051] write(3, "1000", 4) = 4
[pid 5051] close(3) = 0
[pid 5051] symlink("/dev/binderfs", "./binderfs") = 0
[pid 5051] memfd_create("syzkaller", 0) = 3
[pid 5051] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f5e1cf4d000
[pid 5051] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 16777216) = 16777216
[pid 5051] munmap(0x7f5e1cf4d000, 16777216) = 0
[pid 5051] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 5051] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 5051] close(3) = 0
[pid 5051] mkdir("./file0", 0777) = 0
[ 62.641903][ T5051] loop0: detected capacity change from 0 to 32768
[ 62.651929][ T5051] BTRFS: device fsid d552757d-9c39-40e3-95f0-16d819589928 devid 1 transid 8 /dev/loop0 scanned by syz-executor324 (5051)
[ 62.667480][ T5051] BTRFS info (device loop0): using sha256 (sha256-avx2) checksum algorithm
[ 62.676456][ T5051] BTRFS info (device loop0): using free space tree
[pid 5051] mount("/dev/loop0", "./file0", "btrfs", 0, "") = 0
[pid 5051] openat(AT_FDCWD, "./file0", O_RDONLY|O_DIRECTORY) = 3
[pid 5051] chdir("./file0") = 0
[pid 5051] ioctl(4, LOOP_CLR_FD) = 0
[pid 5051] close(4) = 0
[pid 5051] open("./file0", O_RDONLY) = 4
[pid 5051] open("./bus", O_RDWR|O_CREAT|O_TRUNC|O_SYNC|O_DIRECT|O_LARGEFILE|O_NOATIME|0x3c, 000) = 5
[pid 5051] openat(AT_FDCWD, "/proc/thread-self/fail-nth", O_RDWR) = 6
[pid 5051] write(6, "17", 2) = 2
[ 62.693716][ T5051] BTRFS info (device loop0): enabling ssd optimizations
[ 62.700810][ T5051] BTRFS info (device loop0): auto enabling async discard
[ 62.732139][ T5051] FAULT_INJECTION: forcing a failure.
[ 62.732139][ T5051] name failslab, interval 1, probability 0, space 0, times 0
[ 62.745202][ T5051] CPU: 1 PID: 5051 Comm: syz-executor324 Not tainted 6.4.0-rc6-syzkaller-00049-g62d8779610bb #0
[ 62.755651][ T5051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 62.765713][ T5051] Call Trace:
[ 62.768991][ T5051] <TASK>
[ 62.771925][ T5051] dump_stack_lvl+0x136/0x150
[ 62.776625][ T5051] should_fail_ex+0x4a3/0x5b0
[ 62.781321][ T5051] should_failslab+0x9/0x20
[ 62.785841][ T5051] kmem_cache_alloc+0x5d/0x3f0
[ 62.790621][ T5051] ? set_extent_bit+0x41/0x50
[ 62.795304][ T5051] btrfs_alloc_tree_block+0xbcd/0x1490
[ 62.800779][ T5051] ? btrfs_alloc_logged_file_extent+0x600/0x600
[ 62.807034][ T5051] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 62.813212][ T5051] __btrfs_cow_block+0x3b2/0x1690
[ 62.818255][ T5051] ? update_ref_for_cow+0xb50/0xb50
[ 62.823469][ T5051] ? btrfs_qgroup_add_swapped_blocks+0x980/0x980
[ 62.829807][ T5051] ? down_write_nested+0x153/0x200
[ 62.834933][ T5051] btrfs_cow_block+0x2fa/0x820
[ 62.839712][ T5051] btrfs_search_slot+0x11c6/0x2da0
[ 62.844829][ T5051] ? split_leaf+0x13e0/0x13e0
[ 62.849509][ T5051] ? btrfs_global_root+0xf5/0x120
[ 62.854548][ T5051] ? btrfs_extent_root+0x13f/0x1a0
[ 62.859672][ T5051] ? btrfs_csum_root+0x1a0/0x1a0
[ 62.864621][ T5051] ? mark_lock.part.0+0xee/0x1970
[ 62.869658][ T5051] ? find_held_lock+0x2d/0x110
[ 62.874429][ T5051] lookup_inline_extent_backref+0x311/0x1210
[ 62.880419][ T5051] ? hash_extent_data_ref+0xf0/0xf0
[ 62.885641][ T5051] ? mark_held_locks+0x9f/0xe0
[ 62.890426][ T5051] lookup_extent_backref+0x46/0x110
[ 62.895657][ T5051] __btrfs_free_extent+0x234/0x27e0
[ 62.900873][ T5051] ? lookup_extent_backref+0x110/0x110
[ 62.906342][ T5051] ? __btrfs_run_delayed_refs+0x539/0x3770
[ 62.912156][ T5051] ? lock_downgrade+0x690/0x690
[ 62.917016][ T5051] ? _raw_read_unlock+0x28/0x40
[ 62.921892][ T5051] ? btrfs_tree_mod_log_lowest_seq+0x86/0xb0
[ 62.927887][ T5051] ? btrfs_merge_delayed_refs+0x41e/0x560
[ 62.933618][ T5051] __btrfs_run_delayed_refs+0x151d/0x3770
[ 62.939351][ T5051] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 62.945343][ T5051] ? check_ref_cleanup+0x3e0/0x3e0
[ 62.950466][ T5051] ? lock_sync+0x190/0x190
[ 62.954894][ T5051] btrfs_run_delayed_refs+0x19a/0x540
[ 62.960275][ T5051] btrfs_commit_transaction+0x80d/0x3fa0
[ 62.965919][ T5051] ? spin_bug+0x1c0/0x1c0
[ 62.970260][ T5051] ? btrfs_put_transaction+0x4c0/0x4c0
[ 62.975737][ T5051] ? join_transaction+0x22e/0x10e0
[ 62.980860][ T5051] ? create_pending_snapshots+0x2c0/0x2c0
[ 62.986587][ T5051] ? start_transaction+0x2aa/0x14c0
[ 62.991798][ T5051] btrfs_mksubvol+0xa6f/0x1310
[ 62.996575][ T5051] ? create_subvol+0x16f0/0x16f0
[ 63.001521][ T5051] ? make_vfsuid+0x113/0x170
[ 63.006134][ T5051] btrfs_mksnapshot+0xaf/0xf0
[ 63.010819][ T5051] __btrfs_ioctl_snap_create+0x42b/0x4d0
[ 63.016462][ T5051] btrfs_ioctl_snap_create+0x15f/0x200
[ 63.021931][ T5051] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 63.027839][ T5051] btrfs_ioctl+0x50e/0x5b30
[ 63.032352][ T5051] ? tomoyo_path_number_perm+0x166/0x570
[ 63.038001][ T5051] ? tomoyo_execute_permission+0x4a0/0x4a0
[ 63.043827][ T5051] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 63.050257][ T5051] ? __sanitizer_cov_trace_switch+0x54/0x90
[ 63.056162][ T5051] ? do_vfs_ioctl+0x132/0x1670
[ 63.060932][ T5051] ? vfs_fileattr_set+0xc40/0xc40
[ 63.065963][ T5051] ? ioctl_has_perm.constprop.0.isra.0+0x28c/0x420
[ 63.072471][ T5051] ? ioctl_has_perm.constprop.0.isra.0+0x295/0x420
[ 63.078980][ T5051] ? selinux_bprm_creds_for_exec+0xb20/0xb20
[ 63.084966][ T5051] ? find_held_lock+0x2d/0x110
[ 63.089736][ T5051] ? do_one_initcall+0x270/0x540
[ 63.094692][ T5051] ? lock_downgrade+0x690/0x690
[ 63.099555][ T5051] ? selinux_file_ioctl+0xba/0x280
[ 63.104671][ T5051] ? btrfs_ioctl_get_supported_features+0x50/0x50
[ 63.111097][ T5051] __x64_sys_ioctl+0x197/0x210
[ 63.115878][ T5051] do_syscall_64+0x39/0xb0
[ 63.120298][ T5051] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 63.126210][ T5051] RIP: 0033:0x7f5e2539aa29
[ 63.130627][ T5051] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 63.150253][ T5051] RSP: 002b:00007fffdb72f738 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 63.158680][ T5051] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f5e2539aa29
[ 63.166656][ T5051] RDX: 00000000200000c0 RSI: 0000000050009401 RDI: 0000000000000004
[ 63.174634][ T5051] RBP: 00007fffdb72f760 R08: 0000000000000002 R09: 00007fffdb72f770
[ 63.182608][ T5051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
[ 63.190585][ T5051] R13: 00007fffdb72f7a0 R14: 00007fffdb72f780 R15: 0000000000000002
[ 63.198568][ T5051] </TASK>
[ 63.203491][ T5051] BTRFS: error (device loop0: state A) in __btrfs_free_extent:3053: errno=-12 Out of memory
[ 63.214476][ T5051] BTRFS info (device loop0: state EA): forced readonly
[ 63.222248][ T5051] BTRFS error (device loop0: state EA): failed to run delayed ref for logical 5255168 num_bytes 4096 type 176 action 2 ref_mod 1: -12
[pid 5051] ioctl(4, BTRFS_IOC_SNAP_CREATE, {fd=5, name="\x42\x99\xc6\x3c\x6a\xca\x4b\xec\x68\x72\xd2\x02\x80\x8d\xda\x69\x34\x9c\x62\x54\x02\x9b\xbc\x4a\x38\xfb\x4e\x91\xbb\xa4\x82\x6c\xd7\x77\xcb\x59\x74\x4a\xdd\x18\x26\x71\x40\x88\x2a\x98\x37\x3f\xbb\xf4\xb5\xb0\x7c"}) = -1 ENOMEM (Cannot allocate memory)
[pid 5051] exit_group(0) = ?
[pid 5051] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5051, si_uid=0, si_status=0, si_utime=5 /* 0.05 s */, si_stime=28 /* 0.28 s */} ---
umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x55555687a620 /* 4 entries */, 32768) = 112
umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./2/binderfs") = 0
[ 63.236880][ T5051] BTRFS: error (device loop0: state EA) in btrfs_run_delayed_refs:2127: errno=-12 Out of memory
[ 63.302696][ T4992] ------------[ cut here ]------------
[ 63.308430][ T4992] WARNING: CPU: 1 PID: 4992 at fs/btrfs/space-info.h:198 btrfs_space_info_update_bytes_may_use+0x452/0x590
[ 63.320256][ T4992] Modules linked in:
[ 63.324240][ T4992] CPU: 1 PID: 4992 Comm: syz-executor324 Not tainted 6.4.0-rc6-syzkaller-00049-g62d8779610bb #0
[ 63.334729][ T4992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 63.344863][ T4992] RIP: 0010:btrfs_space_info_update_bytes_may_use+0x452/0x590
[ 63.352432][ T4992] Code: fd e9 40 fc ff ff e8 8d 08 fc fd 49 89 ed 4c 89 e6 49 f7 dd 4c 89 ef e8 3c 04 fc fd 4d 39 e5 0f 86 2a fd ff ff e8 6e 08 fc fd <0f> 0b 31 ed e9 24 fd ff ff e8 60 08 fc fd 48 8d 7b 18 be ff ff ff
[ 63.372111][ T4992] RSP: 0018:ffffc900033bfab0 EFLAGS: 00010293
[ 63.378170][ T4992] RAX: 0000000000000000 RBX: ffff88807d1fd000 RCX: 0000000000000000
[ 63.386177][ T4992] RDX: ffff88807c9381c0 RSI: ffffffff83875f42 RDI: 0000000000000006
[ 63.394193][ T4992] RBP: ffffffffffea0000 R08: 0000000000000006 R09: 0000000000160000
[ 63.402236][ T4992] R10: 000000000015f000 R11: 0000000000094001 R12: 000000000015f000
[ 63.410229][ T4992] R13: 0000000000160000 R14: ffff88807d1fd060 R15: ffff88807d1fd000
[ 63.418253][ T4992] FS: 0000555556879300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
[ 63.427232][ T4992] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 63.433852][ T4992] CR2: 00007f5e253de0b8 CR3: 000000002d5a2000 CR4: 00000000003506e0
[ 63.441858][ T4992] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 63.449818][ T4992] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 63.457823][ T4992] Call Trace:
[ 63.461157][ T4992] <TASK>
[ 63.464091][ T4992] ? __warn+0xe6/0x390
[ 63.468156][ T4992] ? btrfs_space_info_update_bytes_may_use+0x452/0x590
[ 63.475042][ T4992] ? report_bug+0x2da/0x500
[ 63.479578][ T4992] ? handle_bug+0x3c/0x70
[ 63.483961][ T4992] ? exc_invalid_op+0x18/0x50
[ 63.488647][ T4992] ? asm_exc_invalid_op+0x1a/0x20
[ 63.493722][ T4992] ? btrfs_space_info_update_bytes_may_use+0x452/0x590
[ 63.500630][ T4992] ? btrfs_space_info_update_bytes_may_use+0x452/0x590
[ 63.507485][ T4992] btrfs_block_rsv_release+0x4af/0x5e0
[ 63.512976][ T4992] btrfs_release_global_block_rsv+0x26/0x2e0
[ 63.518972][ T4992] btrfs_free_block_groups+0xa0c/0x11d0
[ 63.524563][ T4992] ? free_root_pointers+0x6fe/0x980
[ 63.529779][ T4992] close_ctree+0x552/0xf60
[ 63.534244][ T4992] ? btrfs_cleanup_transaction.isra.0+0x1340/0x1340
[ 63.540905][ T4992] ? collect_domain_accesses+0x900/0x900
[ 63.546595][ T4992] ? __fsnotify_vfsmount_delete+0x20/0x20
[ 63.552368][ T4992] ? dispose_list+0x1e0/0x1e0
[ 63.557071][ T4992] ? fscrypt_destroy_keyring+0x1a/0x350
[ 63.562658][ T4992] ? btrfs_set_super+0x70/0x70
[ 63.567440][ T4992] generic_shutdown_super+0x158/0x480
[ 63.572859][ T4992] kill_anon_super+0x3a/0x60
[ 63.577466][ T4992] btrfs_kill_super+0x3c/0x50
[ 63.582191][ T4992] deactivate_locked_super+0x98/0x160
[ 63.587582][ T4992] deactivate_super+0xb1/0xd0
[ 63.592329][ T4992] cleanup_mnt+0x2ae/0x3d0
[ 63.597380][ T4992] task_work_run+0x16f/0x270
[ 63.602059][ T4992] ? task_work_cancel+0x30/0x30
[ 63.606936][ T4992] ? __x64_sys_umount+0x118/0x190
[ 63.612022][ T4992] ptrace_notify+0x118/0x140
[ 63.616626][ T4992] syscall_exit_to_user_mode_prepare+0x129/0x220
[ 63.623003][ T4992] syscall_exit_to_user_mode+0xd/0x50
[ 63.628395][ T4992] do_syscall_64+0x46/0xb0
[ 63.632855][ T4992] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 63.638777][ T4992] RIP: 0033:0x7f5e2539bdc7
[ 63.643231][ T4992] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 63.663252][ T4992] RSP: 002b:00007fffdb72e648 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 63.671711][ T4992] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5e2539bdc7
[ 63.679692][ T4992] RDX: 00007fffdb72e709 RSI: 000000000000000a RDI: 00007fffdb72e700
[ 63.687705][ T4992] RBP: 00007fffdb72e700 R08: 00000000ffffffff R09: 00007fffdb72e4e0
[ 63.695717][ T4992] R10: 000055555687a653 R11: 0000000000000206 R12: 00007fffdb72f780
[ 63.703720][ T4992] R13: 000055555687a5f0 R14: 00007fffdb72e670 R15: 0000000000000003
[ 63.711725][ T4992] </TASK>
[ 63.714734][ T4992] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 63.722001][ T4992] CPU: 1 PID: 4992 Comm: syz-executor324 Not tainted 6.4.0-rc6-syzkaller-00049-g62d8779610bb #0
[ 63.732414][ T4992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[ 63.742469][ T4992] Call Trace:
[ 63.745748][ T4992] <TASK>
[ 63.748678][ T4992] dump_stack_lvl+0xd9/0x150
[ 63.753275][ T4992] panic+0x686/0x730
[ 63.757181][ T4992] ? panic_smp_self_stop+0xa0/0xa0
[ 63.762303][ T4992] ? show_trace_log_lvl+0x284/0x390
[ 63.767515][ T4992] ? btrfs_space_info_update_bytes_may_use+0x452/0x590
[ 63.774374][ T4992] check_panic_on_warn+0xb1/0xc0
[ 63.779323][ T4992] __warn+0xf2/0x390
[ 63.783254][ T4992] ? btrfs_space_info_update_bytes_may_use+0x452/0x590
[ 63.790113][ T4992] report_bug+0x2da/0x500
[ 63.794458][ T4992] handle_bug+0x3c/0x70
[ 63.798616][ T4992] exc_invalid_op+0x18/0x50
[ 63.803121][ T4992] asm_exc_invalid_op+0x1a/0x20
[ 63.807985][ T4992] RIP: 0010:btrfs_space_info_update_bytes_may_use+0x452/0x590
[ 63.815452][ T4992] Code: fd e9 40 fc ff ff e8 8d 08 fc fd 49 89 ed 4c 89 e6 49 f7 dd 4c 89 ef e8 3c 04 fc fd 4d 39 e5 0f 86 2a fd ff ff e8 6e 08 fc fd <0f> 0b 31 ed e9 24 fd ff ff e8 60 08 fc fd 48 8d 7b 18 be ff ff ff
[ 63.835066][ T4992] RSP: 0018:ffffc900033bfab0 EFLAGS: 00010293
[ 63.841135][ T4992] RAX: 0000000000000000 RBX: ffff88807d1fd000 RCX: 0000000000000000
[ 63.849106][ T4992] RDX: ffff88807c9381c0 RSI: ffffffff83875f42 RDI: 0000000000000006
[ 63.857078][ T4992] RBP: ffffffffffea0000 R08: 0000000000000006 R09: 0000000000160000
[ 63.865052][ T4992] R10: 000000000015f000 R11: 0000000000094001 R12: 000000000015f000
[ 63.873024][ T4992] R13: 0000000000160000 R14: ffff88807d1fd060 R15: ffff88807d1fd000
[ 63.881000][ T4992] ? btrfs_space_info_update_bytes_may_use+0x452/0x590
[ 63.887860][ T4992] btrfs_block_rsv_release+0x4af/0x5e0
[ 63.893324][ T4992] btrfs_release_global_block_rsv+0x26/0x2e0
[ 63.899311][ T4992] btrfs_free_block_groups+0xa0c/0x11d0
[ 63.904868][ T4992] ? free_root_pointers+0x6fe/0x980
[ 63.910078][ T4992] close_ctree+0x552/0xf60
[ 63.914512][ T4992] ? btrfs_cleanup_transaction.isra.0+0x1340/0x1340
[ 63.921116][ T4992] ? collect_domain_accesses+0x900/0x900
[ 63.926759][ T4992] ? __fsnotify_vfsmount_delete+0x20/0x20
[ 63.932488][ T4992] ? dispose_list+0x1e0/0x1e0
[ 63.937177][ T4992] ? fscrypt_destroy_keyring+0x1a/0x350
[ 63.942726][ T4992] ? btrfs_set_super+0x70/0x70
[ 63.947502][ T4992] generic_shutdown_super+0x158/0x480
[ 63.952886][ T4992] kill_anon_super+0x3a/0x60
[ 63.957486][ T4992] btrfs_kill_super+0x3c/0x50
[ 63.962172][ T4992] deactivate_locked_super+0x98/0x160
[ 63.967556][ T4992] deactivate_super+0xb1/0xd0
[ 63.972244][ T4992] cleanup_mnt+0x2ae/0x3d0
[ 63.976673][ T4992] task_work_run+0x16f/0x270
[ 63.981281][ T4992] ? task_work_cancel+0x30/0x30
[ 63.986144][ T4992] ? __x64_sys_umount+0x118/0x190
[ 63.991180][ T4992] ptrace_notify+0x118/0x140
[ 63.995777][ T4992] syscall_exit_to_user_mode_prepare+0x129/0x220
[ 64.002118][ T4992] syscall_exit_to_user_mode+0xd/0x50
[ 64.007500][ T4992] do_syscall_64+0x46/0xb0
[ 64.011916][ T4992] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 64.017822][ T4992] RIP: 0033:0x7f5e2539bdc7
[ 64.022239][ T4992] Code: 07 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 64.041854][ T4992] RSP: 002b:00007fffdb72e648 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 64.050271][ T4992] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f5e2539bdc7
[ 64.058244][ T4992] RDX: 00007fffdb72e709 RSI: 000000000000000a RDI: 00007fffdb72e700
[ 64.066215][ T4992] RBP: 00007fffdb72e700 R08: 00000000ffffffff R09: 00007fffdb72e4e0
[ 64.074191][ T4992] R10: 000055555687a653 R11: 0000000000000206 R12: 00007fffdb72f780
[ 64.082163][ T4992] R13: 000055555687a5f0 R14: 00007fffdb72e670 R15: 0000000000000003
[ 64.090141][ T4992] </TASK>
[ 64.093211][ T4992] Kernel Offset: disabled
[ 64.097652][ T4992] Rebooting in 86400 seconds..