syzbot


BUG: corrupted list in btrfs_free_compr_folio

Status: upstream: reported on 2026/03/16 13:40
Subsystems: btrfs
[Documentation on labels]
Reported-by: syzbot+3c4d8371d65230f852a2@syzkaller.appspotmail.com
First crash: 5d04h, last: 5h33m
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [btrfs?] BUG: corrupted list in btrfs_free_compr_folio 0 (1) 2026/03/16 13:40

Sample crash report:
list_add double add: new=ffffea00010c2dc8, prev=ffffffff9a43a948, next=ffffea00010c2dc8.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:37!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 181 Comm: kworker/u4:6 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: btrfs-delalloc btrfs_work_helper
RIP: 0010:__list_add_valid_or_report+0xa5/0x130 lib/list_debug.c:35
Code: 74 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d e9 92 c4 f8 06 cc 48 c7 c7 e0 d7 27 8c 4c 89 fe 4c 89 f2 48 89 d9 e8 dc 47 6d fc 90 <0f> 0b 48 c7 c7 c0 d5 27 8c e8 cd 47 6d fc 90 0f 0b 48 c7 c7 80 d6
RSP: 0018:ffffc9000189f800 EFLAGS: 00010246
RAX: 0000000000000058 RBX: ffffea00010c2dc8 RCX: fc094ce083c57700
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 1ffffd40002185ba R08: ffffc9000189f587 R09: 1ffff92000313eb0
R10: dffffc0000000000 R11: fffff52000313eb1 R12: 1ffffffff3487529
R13: dffffc0000000000 R14: ffffffff9a43a948 R15: ffffea00010c2dc8
FS:  0000000000000000(0000) GS:ffff88808ca55000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd2d7cfd457 CR3: 0000000044a33000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 __list_add_valid include/linux/list.h:96 [inline]
 __list_add include/linux/list.h:158 [inline]
 list_add include/linux/list.h:177 [inline]
 btrfs_free_compr_folio+0x1e1/0x340 fs/btrfs/compression.c:218
 cleanup_compressed_bio fs/btrfs/compression.h:150 [inline]
 btrfs_compress_bio+0x35a/0x6b0 fs/btrfs/compression.c:1047
 compress_file_range+0x8df/0x19b0 fs/btrfs/inode.c:1023
 btrfs_work_helper+0x38c/0xc80 fs/btrfs/async-thread.c:312
 process_one_work kernel/workqueue.c:3276 [inline]
 process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report+0xa5/0x130 lib/list_debug.c:35
Code: 74 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d e9 92 c4 f8 06 cc 48 c7 c7 e0 d7 27 8c 4c 89 fe 4c 89 f2 48 89 d9 e8 dc 47 6d fc 90 <0f> 0b 48 c7 c7 c0 d5 27 8c e8 cd 47 6d fc 90 0f 0b 48 c7 c7 80 d6
RSP: 0018:ffffc9000189f800 EFLAGS: 00010246
RAX: 0000000000000058 RBX: ffffea00010c2dc8 RCX: fc094ce083c57700
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 1ffffd40002185ba R08: ffffc9000189f587 R09: 1ffff92000313eb0
R10: dffffc0000000000 R11: fffff52000313eb1 R12: 1ffffffff3487529
R13: dffffc0000000000 R14: ffffffff9a43a948 R15: ffffea00010c2dc8
FS:  0000000000000000(0000) GS:ffff88808ca55000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd2d7cfd457 CR3: 0000000044a33000 CR4: 0000000000352ef0

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/17 12:24 upstream 2d1373e4246d c01bca74 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/17 10:53 upstream 2d1373e4246d c01bca74 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/17 10:13 upstream 2d1373e4246d c01bca74 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/17 10:10 upstream 2d1373e4246d c01bca74 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/16 11:22 upstream f338e7738378 64e21424 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/15 11:49 upstream 267594792a71 ee8d34d6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/15 10:59 upstream 267594792a71 ee8d34d6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/15 10:55 upstream 267594792a71 ee8d34d6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/14 05:40 upstream 1c9982b49613 ee8d34d6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/13 17:19 upstream 0257f64bdac7 351cb5cf .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/12 13:35 upstream 80234b5ab240 4efadf07 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
* Struck through repros no longer work on HEAD.