Re: [syzbot] kernel BUG in lbmIODone

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    bbed346d5a96 Merge branch 'for-next/core' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=17935e48880000
kernel config:  https://syzkaller.appspot.com/x/.config?x=aae2d21e7dd80684
dashboard link: https://syzkaller.appspot.com/bug?extid=52ddb6c83a04ca55f975
compiler:       Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=111ad268880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/11078f50b80b/disk-bbed346d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/398e5f1e6c84/vmlinux-bbed346d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+52ddb6c83a04ca55f975@xxxxxxxxxxxxxxxxxxxxxxxxx

BUG at fs/jfs/jfs_logmgr.c:2298 assert(bp->l_flag & lbmRELEASE)
------------[ cut here ]------------
kernel BUG at fs/jfs/jfs_logmgr.c:2298!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : lbmIODone+0x2ec/0x340 fs/jfs/jfs_logmgr.c:2298
lr : lbmIODone+0x2ec/0x340 fs/jfs/jfs_logmgr.c:2298
sp : ffff80000f22bc20
x29: ffff80000f22bc20 x28: ffff80000d2609e0 x27: 000000000000000a
x26: 0000000000000001 x25: 0000000000000000 x24: 0000000000000020
x23: 0000000000000000 x22: ffff0000d0968c00 x21: 0000000000000020
x20: 0000000000000000 x19: ffff0000d0b7d600 x18: 00000000000000c0
x17: ffff80000dd0b198 x16: ffff80000db49158 x15: ffff0000c02d9a80
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c02d9a80
x11: ff808000081c0d5c x10: 0000000000000000 x9 : f6a2b00d81307a00
x8 : f6a2b00d81307a00 x7 : ffff80000819545c x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0001fefbecd0 x1 : 0000000100000101 x0 : 000000000000003f
Call trace:
 lbmIODone+0x2ec/0x340 fs/jfs/jfs_logmgr.c:2298
 bio_endio+0x28c/0x2d8 block/bio.c:1564
 req_bio_endio block/blk-mq.c:695 [inline]
 blk_update_request+0x25c/0x570 block/blk-mq.c:825
 blk_mq_end_request+0x2c/0x58 block/blk-mq.c:951
 lo_complete_rq+0xb8/0x138 drivers/block/loop.c:370
 blk_complete_reqs block/blk-mq.c:1022 [inline]
 blk_done_softirq+0x70/0xa0 block/blk-mq.c:1027
 _stext+0x168/0x37c
 run_ksoftirqd+0x4c/0x21c kernel/softirq.c:934
 smpboot_thread_fn+0x248/0x3e4 kernel/smpboot.c:164
 kthread+0x12c/0x158 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
Code: 9137e821 91101063 52811f42 94c93ef6 (d4210000) 
---[ end trace 0000000000000000 ]---