kernel BUG in wait_subpage_spinlock

Status: upstream: reported on 2026/09/22 19:05
Subsystems: btrfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+d6f123d4060990f0f3ff@syzkaller.appspotmail.com
First crash: 49d, last: 7d07h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
d23c1877 repro-c 💥 kernel BUG in wait_subpage_spinlock 2026/09/29 05:12 2026/09/29 05:12 2026/09/29 08:38 7bf4ea23
be5b687f repro-c 💥 kernel BUG in wait_subpage_spinlock 2026/09/27 11:41 2026/09/27 11:41 2026/09/27 18:33 a3c7249d
308b7a1c assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ kernel BUG in wait_subpage_spinlock 2026/09/20 00:00 2026/09/20 00:00 2026/09/20 01:07 853b104b
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [btrfs?] kernel BUG in wait_subpage_spinlock 0 (1) 2026/09/22 19:05

Sample crash report:
assertion failed: folio_test_private(folio) && folio_get_private(folio), in fs/btrfs/inode.c:7573
------------[ cut here ]------------
kernel BUG at fs/btrfs/inode.c:7573!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 38 Comm: kworker/u4:2 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: writeback wb_workfn (flush-btrfs-1)
RIP: 0010:wait_subpage_spinlock+0x2c5/0x2d0 fs/btrfs/inode.c:7573
Code: fb fc 90 0f 0b e8 bb f4 9c fd 48 c7 c7 c0 af 7a 8c 48 c7 c6 40 e4 7a 8c 48 c7 c2 a0 b0 7a 8c b9 95 1d 00 00 e8 6c 90 fb fc 90 <0f> 0b 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000406cc8 EFLAGS: 00010246
RAX: 0000000000000061 RBX: 0000000000000000 RCX: 3592c9487cf00e00
RDX: 0000000000000000 RSI: 8000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffc90000406a47 R09: 1ffff92000080d48
R10: dffffc0000000000 R11: fffff52000080d49 R12: 0000000000004000
R13: ffff888032390208 R14: 0000000000001000 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff88808aa04000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7d333fa6b8 CR3: 00000000144f2000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 btrfs_invalidate_folio+0x26e/0xc50 fs/btrfs/inode.c:7655
 extent_writepage fs/btrfs/extent_io.c:2049 [inline]
 extent_write_cache_pages fs/btrfs/extent_io.c:2834 [inline]
 btrfs_writepages+0x12a4/0x2830 fs/btrfs/extent_io.c:2966
 do_writepages+0x338/0x560 mm/page-writeback.c:2560
 __writeback_single_inode+0x136/0x1220 fs/fs-writeback.c:1800
 writeback_sb_inodes+0x9de/0x1af0 fs/fs-writeback.c:2111
 __writeback_inodes_wb+0x114/0x240 fs/fs-writeback.c:2187
 wb_writeback+0x42f/0xad0 fs/fs-writeback.c:2298
 wb_check_start_all fs/fs-writeback.c:2424 [inline]
 wb_do_writeback fs/fs-writeback.c:2471 [inline]
 wb_workfn+0x980/0x10f0 fs/fs-writeback.c:2509
 process_one_work kernel/workqueue.c:3495 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:wait_subpage_spinlock+0x2c5/0x2d0 fs/btrfs/inode.c:7573
Code: fb fc 90 0f 0b e8 bb f4 9c fd 48 c7 c7 c0 af 7a 8c 48 c7 c6 40 e4 7a 8c 48 c7 c2 a0 b0 7a 8c b9 95 1d 00 00 e8 6c 90 fb fc 90 <0f> 0b 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000406cc8 EFLAGS: 00010246
RAX: 0000000000000061 RBX: 0000000000000000 RCX: 3592c9487cf00e00
RDX: 0000000000000000 RSI: 8000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffc90000406a47 R09: 1ffff92000080d48
R10: dffffc0000000000 R11: fffff52000080d49 R12: 0000000000004000
R13: ffff888032390208 R14: 0000000000001000 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff88808aa04000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7d3404c008 CR3: 00000000517d8000 CR4: 0000000000352ef0

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/30 18:08 upstream d89e1d186ec9 0ec395f8 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in wait_subpage_spinlock
2026/09/18 18:57 upstream 5dd1818b15d9 853b104b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in wait_subpage_spinlock
* Struck through repros no longer work on HEAD.