[BUG] WARNING in btrfs_commit_transaction during balance/relocation

[Zw Tang]

Hi,

I am reporting a WARNING issue triggered by a syzkaller reproducer on
Linux 7.0.0-rc3.

The reproducer mounts a crafted Btrfs image and then issues
BTRFS_IOC_QGROUP_LIMIT on the mounted filesystem. The crash happens in the
Btrfs balance/relocation path, where the filesystem aborts a transaction
with error -28 and then hits a WARNING in btrfs_commit_transaction().

This seems to be related to ENOSPC handling in the Btrfs
balance/relocation path. The transaction gets aborted with error -28,
cleanup_transaction reports "No space left", and the filesystem is forced
read-only before btrfs_commit_transaction() emits the WARNING.

Reproducer:
C reproducer: pastebin.com/raw/SZTu4rBj
console output: pastebin.com/raw/AxuvZmnY
kernel config: pastebin.com/raw/uJh0PYV8

Kernel:
HEAD commit:1f318b96cc84d7c2ab792fcc0bfd42a7ca890681
git tree: torvalds/linux
kernel version: 7.0.0-rc3 #1 PREEMPT(full) (QEMU Standard PC (Q35 + ICH9, 2009))

Crash log:
[  104.838103] ------------[ cut here ]------------
[  104.838841] BTRFS: Transaction aborted (error -28)
[  104.839649] WARNING: fs/btrfs/transaction.c:2045 at
btrfs_commit_transaction+0x26f0/0x4c40, CPU#1: repro/635
[  104.841814] CPU: 1 UID: 0 PID: 635 Comm: repro Tainted: G    B D
      N  7.0.0-rc3 #1 PREEMPT(lazy)
[  104.845630] RIP: 0010:btrfs_commit_transaction+0x26f3/0x4c40
[  104.859441] Call Trace:
[  104.863409]  prepare_to_relocate+0x39d/0x520
[  104.864140]  relocate_block_group+0x127/0xe20
[  104.868107]  btrfs_relocate_block_group+0x1692/0x5aa0
[  104.877674]  btrfs_relocate_chunk+0x135/0x950
[  104.879094]  btrfs_balance+0x2392/0x5d60
[  104.884685]  btrfs_ioctl_balance+0x3a4/0x700
[  104.885434]  btrfs_ioctl+0x1edc/0x64b0
[  104.898312]  __x64_sys_ioctl+0x197/0x220
[  104.960636] BTRFS: error (device loop2 state A) in
cleanup_transaction:2045: errno=-28 No space left
[  104.962986] BTRFS info (device loop2 state EA): forced readonly
[  104.966206] BTRFS info (device loop2 state EA): 1 enospc errors
during balance
[  104.969915] BTRFS info (device loop2 state EA): balance: ended with
status: -28

Thanks.
Zw Tang