------------[ cut here ]------------
BTRFS: Transaction aborted (error -28)
WARNING: fs/btrfs/delayed-inode.c:1162 at __btrfs_run_delayed_items+0x443/0x510 fs/btrfs/delayed-inode.c:1162, CPU#0: kworker/u4:3/37
Modules linked in:
CPU: 0 UID: 0 PID: 37 Comm: kworker/u4:3 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_unbound btrfs_async_reclaim_metadata_space
RIP: 0010:__btrfs_run_delayed_items+0x445/0x510 fs/btrfs/delayed-inode.c:1162
Code: 45 85 f6 75 07 e8 4b 54 c1 fd eb 79 e8 14 59 a6 fd 84 c0 74 1f e8 3b 54 c1 fd eb 69 e8 34 54 c1 fd 48 8d 3d 7d c7 16 0c 89 ee <67> 48 0f b9 3a e9 e1 fe ff ff e8 9c b4 aa 07 41 89 c6 31 ff 89 c6
RSP: 0018:ffffc900003f77b0 EFLAGS: 00010293
RAX: ffffffff8404434c RBX: ffff888035ed2370 RCX: ffff88801eb3c900
RDX: 0000000000000000 RSI: 00000000ffffffe4 RDI: ffffffff901b0ad0
RBP: 00000000ffffffe4 R08: ffff88801eb3c900 R09: 0000000000000003
R10: 00000000fffffffb R11: 0000000000000000 R12: 0000000000000000
R13: ffff888041ecc3d0 R14: ffff888042b1c001 R15: 1ffff11006bda46e
FS: 0000000000000000(0000) GS:ffff88808ca5b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa8b2fff000 CR3: 0000000012855000 CR4: 0000000000352ef0
Call Trace:
<TASK>
flush_space+0x569/0xd80 fs/btrfs/space-info.c:863
do_async_reclaim_metadata_space+0x3fc/0x960 fs/btrfs/space-info.c:1187
btrfs_async_reclaim_metadata_space+0x89/0xe0 fs/btrfs/space-info.c:1254
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
----------------
Code disassembly (best guess):
0: 45 85 f6 test %r14d,%r14d
3: 75 07 jne 0xc
5: e8 4b 54 c1 fd call 0xfdc15455
a: eb 79 jmp 0x85
c: e8 14 59 a6 fd call 0xfda65925
11: 84 c0 test %al,%al
13: 74 1f je 0x34
15: e8 3b 54 c1 fd call 0xfdc15455
1a: eb 69 jmp 0x85
1c: e8 34 54 c1 fd call 0xfdc15455
21: 48 8d 3d 7d c7 16 0c lea 0xc16c77d(%rip),%rdi # 0xc16c7a5
28: 89 ee mov %ebp,%esi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: e9 e1 fe ff ff jmp 0xffffff15
34: e8 9c b4 aa 07 call 0x7aab4d5
39: 41 89 c6 mov %eax,%r14d
3c: 31 ff xor %edi,%edi
3e: 89 c6 mov %eax,%esi