syzbot
kernel BUG in wait_subpage_spinlock
Status:
upstream: reported on 2026/09/22 19:05
Subsystems:
btrfs
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+d6f123d4060990f0f3ff@syzkaller.appspotmail.com
First crash: 49d, last: 7d07h
Sample crash report:
assertion failed: folio_test_private(folio) && folio_get_private(folio), in fs/btrfs/inode.c:7573
------------[ cut here ]------------
kernel BUG at fs/btrfs/inode.c:7573!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 38 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: writeback wb_workfn (flush-btrfs-1)
RIP: 0010:wait_subpage_spinlock+0x2c5/0x2d0 fs/btrfs/inode.c:7573
Code: fb fc 90 0f 0b e8 bb f4 9c fd 48 c7 c7 c0 af 7a 8c 48 c7 c6 40 e4 7a 8c 48 c7 c2 a0 b0 7a 8c b9 95 1d 00 00 e8 6c 90 fb fc 90 <0f> 0b 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000406cc8 EFLAGS: 00010246
RAX: 0000000000000061 RBX: 0000000000000000 RCX: 3592c9487cf00e00
RDX: 0000000000000000 RSI: 8000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffc90000406a47 R09: 1ffff92000080d48
R10: dffffc0000000000 R11: fffff52000080d49 R12: 0000000000004000
R13: ffff888032390208 R14: 0000000000001000 R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff88808aa04000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7d333fa6b8 CR3: 00000000144f2000 CR4: 0000000000352ef0
Call Trace:
<TASK>
btrfs_invalidate_folio+0x26e/0xc50 fs/btrfs/inode.c:7655
extent_writepage fs/btrfs/extent_io.c:2049 [inline]
extent_write_cache_pages fs/btrfs/extent_io.c:2834 [inline]
btrfs_writepages+0x12a4/0x2830 fs/btrfs/extent_io.c:2966
do_writepages+0x338/0x560 mm/page-writeback.c:2560
__writeback_single_inode+0x136/0x1220 fs/fs-writeback.c:1800
writeback_sb_inodes+0x9de/0x1af0 fs/fs-writeback.c:2111
__writeback_inodes_wb+0x114/0x240 fs/fs-writeback.c:2187
wb_writeback+0x42f/0xad0 fs/fs-writeback.c:2298
wb_check_start_all fs/fs-writeback.c:2424 [inline]
wb_do_writeback fs/fs-writeback.c:2471 [inline]
wb_workfn+0x980/0x10f0 fs/fs-writeback.c:2509
process_one_work kernel/workqueue.c:3495 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:wait_subpage_spinlock+0x2c5/0x2d0 fs/btrfs/inode.c:7573
Code: fb fc 90 0f 0b e8 bb f4 9c fd 48 c7 c7 c0 af 7a 8c 48 c7 c6 40 e4 7a 8c 48 c7 c2 a0 b0 7a 8c b9 95 1d 00 00 e8 6c 90 fb fc 90 <0f> 0b 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000406cc8 EFLAGS: 00010246
RAX: 0000000000000061 RBX: 0000000000000000 RCX: 3592c9487cf00e00
RDX: 0000000000000000 RSI: 8000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffc90000406a47 R09: 1ffff92000080d48
R10: dffffc0000000000 R11: fffff52000080d49 R12: 0000000000004000
R13: ffff888032390208 R14: 0000000000001000 R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff88808aa04000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7d3404c008 CR3: 00000000517d8000 CR4: 0000000000352ef0
* Struck through repros no longer work on HEAD.