kernel BUG in btrfs_alloc_ordered_extent

Status: upstream: reported C repro on 2026/06/22 12:15
Subsystems: btrfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+ba2afde329fc27e3f22e@syzkaller.appspotmail.com
Fix commit: btrfs: always wait for ordered extents to avoid OE races
Patched on: [ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 56d, last: 1d17h
Cause bisection: failed (error log, bisect log)
  
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
3945cbb6 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ kernel BUG in btrfs_alloc_ordered_extent 2026/06/20 00:06 2026/06/20 00:06 2026/06/20 00:32 023e42b5
Discussions (3)
Title Replies (including bot) Last reply
[syzbot] Monthly btrfs report (Aug 2026) 0 (1) 2026/08/05 00:00
[PATCH] btrfs: wait for ordered extents before buffered write fallback in direct IO 5 (5) 2026/06/25 06:51
[syzbot] [btrfs?] kernel BUG in btrfs_alloc_ordered_extent 0 (2) 2026/06/24 18:17

Sample crash report:
BTRFS critical (device loop3): panic in insert_ordered_extent:264: overlapping ordered extents, existing oe file_offset 32768 num_bytes 430080 flags 0x1089, new oe file_offset 32768 num_bytes 430080 flags 0x80 (errno=-17 Object already exists)
------------[ cut here ]------------
kernel BUG at fs/btrfs/ordered-data.c:264!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 8830 Comm: syz.3.185 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:insert_ordered_extent fs/btrfs/ordered-data.c:261 [inline]
RIP: 0010:btrfs_alloc_ordered_extent+0x943/0xad0 fs/btrfs/ordered-data.c:336
Code: 87 8d ba 08 01 00 00 b9 ef ff ff ff 49 c7 c0 a0 46 b8 8b 4d 89 f9 ff 75 00 41 54 41 55 41 56 53 e8 22 53 1c fd 48 83 c4 28 90 <0f> 0b e8 76 dd b7 fd 48 c7 c7 00 3e b8 8b 48 c7 c6 60 3e b8 8b 48
RSP: 0018:ffffc9000e1fe890 EFLAGS: 00010296
RAX: 99635e2fd1aa0000 RBX: 0000000000069000 RCX: 1ffff92001c3fcf0
RDX: 0000000000000003 RSI: ffffffff8daf4ae5 RDI: ffff88802dcbdd00
RBP: ffff888039ea22a0 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52001c3fc61 R12: 0000000000069000
R13: 0000000000008000 R14: 0000000000001089 R15: 0000000000008000
FS:  00007f87f828e6c0(0000) GS:ffff888125c42000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d5d6eb30c0 CR3: 0000000011f92000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 cow_one_range fs/btrfs/inode.c:1241 [inline]
 cow_file_range+0x744/0x12a0 fs/btrfs/inode.c:1403
 fallback_to_cow+0x5ea/0xa00 fs/btrfs/inode.c:1751
 run_delalloc_nocow+0x110c/0x17a0 fs/btrfs/inode.c:2181
 btrfs_run_delalloc_range+0x8ba/0x1fd0 fs/btrfs/inode.c:2419
 writepage_delalloc+0x104d/0x1ba0 fs/btrfs/extent_io.c:1558
 extent_writepage fs/btrfs/extent_io.c:1930 [inline]
 extent_write_cache_pages fs/btrfs/extent_io.c:2593 [inline]
 btrfs_writepages+0x1667/0x28b0 fs/btrfs/extent_io.c:2725
 do_writepages+0x338/0x560 mm/page-writeback.c:2571
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_fdatawrite_range+0x1f2/0x300 mm/filemap.c:412
 btrfs_fdatawrite_range+0x54/0xf0 fs/btrfs/file.c:3884
 btrfs_direct_write+0x6a0/0xc30 fs/btrfs/direct-io.c:1038
 btrfs_do_write_iter+0x329/0x790 fs/btrfs/file.c:1449
 do_iter_readv_writev+0x624/0x8d0 fs/read_write.c:-1
 vfs_writev+0x34c/0x990 fs/read_write.c:1058
 do_pwritev fs/read_write.c:1154 [inline]
 __do_sys_pwritev2 fs/read_write.c:1212 [inline]
 __se_sys_pwritev2+0x17a/0x2a0 fs/read_write.c:1203
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f87f8c2de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f87f828e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
RAX: ffffffffffffffda RBX: 00007f87f8eb5fa0 RCX: 00007f87f8c2de99
RDX: 0000000000000001 RSI: 0000200000000240 RDI: 0000000000000004
RBP: 00007f87f8cc3eaf R08: 0000000000000000 R09: 0000000000000003
R10: 0000000000007000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f87f8eb6038 R14: 00007f87f8eb5fa0 R15: 00007ffcae1d2e08
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:insert_ordered_extent fs/btrfs/ordered-data.c:261 [inline]
RIP: 0010:btrfs_alloc_ordered_extent+0x943/0xad0 fs/btrfs/ordered-data.c:336
Code: 87 8d ba 08 01 00 00 b9 ef ff ff ff 49 c7 c0 a0 46 b8 8b 4d 89 f9 ff 75 00 41 54 41 55 41 56 53 e8 22 53 1c fd 48 83 c4 28 90 <0f> 0b e8 76 dd b7 fd 48 c7 c7 00 3e b8 8b 48 c7 c6 60 3e b8 8b 48
RSP: 0018:ffffc9000e1fe890 EFLAGS: 00010296
RAX: 99635e2fd1aa0000 RBX: 0000000000069000 RCX: 1ffff92001c3fcf0
RDX: 0000000000000003 RSI: ffffffff8daf4ae5 RDI: ffff88802dcbdd00
RBP: ffff888039ea22a0 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52001c3fc61 R12: 0000000000069000
R13: 0000000000008000 R14: 0000000000001089 R15: 0000000000008000
FS:  00007f87f828e6c0(0000) GS:ffff888125c42000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d5d6eb30c0 CR3: 0000000011f92000 CR4: 00000000003526f0

Crashes (276):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/26 00:18 upstream 0ce37745d4bf 492bab15 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/06/24 18:16 upstream 840ef6c78e6a 302586aa .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/07/30 13:23 upstream 11028ab62899 2377cd3d .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/06/20 21:34 upstream 1a3746ccbb0a 43bfcdb0 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro #1 (corrupt fs)] [mounted in repro #2 (corrupt fs)] ci-upstream-kasan-gce-root kernel BUG in btrfs_alloc_ordered_extent
2026/08/12 11:55 upstream f5bbbfec59b4 f8d35649 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root kernel BUG in btrfs_alloc_ordered_extent
2026/08/10 14:50 upstream db2ddb871435 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/10 08:35 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/10 01:30 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/09 22:03 upstream b9b3e33b70b7 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/09 13:26 upstream 06cf61899d64 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/09 01:40 upstream a7c7074b58d2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/08 09:10 upstream bcc44b6785f2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/07 20:53 upstream f9a2394a2348 e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root kernel BUG in btrfs_alloc_ordered_extent
2026/08/07 17:37 upstream 364465ab19de e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/07 09:21 upstream 364465ab19de c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/07 05:48 upstream 364465ab19de c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/07 00:48 upstream 0d8395707651 c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/06 15:46 upstream 0d8395707651 c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/06 13:26 upstream 0d8395707651 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root kernel BUG in btrfs_alloc_ordered_extent
2026/08/06 06:41 upstream 0d8395707651 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/06 03:28 upstream 0d8395707651 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/05 21:42 upstream 0d8395707651 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/05 13:14 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/05 10:00 upstream c21bb4193868 b3eac40e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root kernel BUG in btrfs_alloc_ordered_extent
2026/08/05 08:18 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/05 06:23 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/05 06:17 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/05 05:15 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/05 05:13 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/04 01:40 upstream 848acc8ffe1b 9451e17e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/04 01:06 upstream 848acc8ffe1b 9451e17e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/03 12:32 upstream 075b74841bd0 6b7c9f71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/03 11:35 upstream 075b74841bd0 6b7c9f71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/03 11:25 upstream 075b74841bd0 6b7c9f71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/03 09:45 upstream 075b74841bd0 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/03 09:10 upstream 075b74841bd0 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/03 04:56 upstream bd1dde877520 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/03 03:06 upstream bd1dde877520 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/02 06:49 upstream 2d2338c93da7 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/02 01:38 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/01 22:40 upstream 02dc699f83d0 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/01 07:12 upstream 0131b508c0e2 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/08/01 06:00 upstream 0131b508c0e2 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/07/31 23:14 upstream 8ba098e6b6ff 7664cf44 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/07/31 19:24 upstream 8ba098e6b6ff 7664cf44 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/07/31 16:48 upstream 8ba098e6b6ff 7664cf44 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/07/30 18:44 upstream 11028ab62899 aaffb173 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/07/30 10:05 upstream 11028ab62899 2377cd3d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/07/30 09:34 upstream 11028ab62899 2377cd3d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs kernel BUG in btrfs_alloc_ordered_extent
2026/06/18 20:53 upstream e771677c937d a776b0d0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root kernel BUG in btrfs_alloc_ordered_extent
2026/08/07 02:28 upstream fcaeecb8b0cd c38879ea .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in btrfs_alloc_ordered_extent
* Struck through repros no longer work on HEAD.