Re: [syzbot] Re: [syzbot] [btrfs?] kernel BUG in __extent_writepage_io (2)

From: syzbot
Date: Thu Aug 29 2024 - 00:13:35 EST


For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: Re: [syzbot] [btrfs?] kernel BUG in __extent_writepage_io (2)
Author: lizhi.xu@xxxxxxxxxxxxx

#syz test

diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 10ac5f657e38..3a6d2b758587 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -384,6 +384,7 @@ static void try_merge_map(struct btrfs_inode *inode, struct extent_map *em)
free_extent_map(merge);
dec_evictable_extent_maps(inode);
}
+ printk("em: %p, blockstart: %llu, mblockstart: %llu, %s\n", em, em->block_start, merge->block_start, __func__);
}

/*
@@ -493,7 +494,11 @@ static int add_extent_mapping(struct btrfs_inode *inode,
if (ret)
return ret;

+ printk("em: %p, blockstart: %llu, em refs: %d, %s\n",
+ em, em->block_start, refcount_read(&em->refs), __func__);
setup_extent_mapping(inode, em, modified);
+ printk("setuped, em: %p, blockstart: %llu, em refs: %d, %s\n",
+ em, em->block_start, refcount_read(&em->refs), __func__);

if (!btrfs_is_testing(fs_info) && is_fstree(btrfs_root_id(root)))
percpu_counter_inc(&fs_info->evictable_extent_maps);
@@ -743,6 +748,8 @@ int btrfs_add_extent_mapping(struct btrfs_inode *inode,
}
free_extent_map(existing);
}
+ } else if (!ret) {
+ ASSERT(em->block_start != EXTENT_MAP_HOLE);
}

ASSERT(ret == 0 || ret == -EEXIST);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index b1b6564ab68f..d54c8d2ff1c1 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6958,7 +6958,9 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,
}

write_lock(&em_tree->lock);
+ printk("em: %p, blockstart: %llu, start: %llu, len: %llu, %s\n", em, em->block_start, start, len, __func__);
ret = btrfs_add_extent_mapping(inode, &em, start, len);
+ printk("ret: %d, em: %p, blockstart: %llu, start: %llu, len: %llu, %s\n", ret, em, em->block_start, start, len, __func__);
write_unlock(&em_tree->lock);
out:
btrfs_free_path(path);