WARNING in create_reloc_root

Status: upstream: reported on 2026/07/09 08:51
Subsystems: btrfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+aca623fc25065fa06615@syzkaller.appspotmail.com
First crash: 61d, last: 1d07h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
13798e9d assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ WARNING in create_reloc_root 2026/07/07 00:05 2026/07/07 00:05 2026/07/07 01:15 93f57954
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [btrfs?] WARNING in create_reloc_root 0 (1) 2026/07/09 08:51

Sample crash report:
loop0: detected capacity change from 0 to 32768
BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.0 (5319)
BTRFS info (device loop0): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0
BTRFS info (device loop0): using crc32c checksum algorithm
BTRFS info (device loop0): rebuilding free space tree
BTRFS info (device loop0): enabling ssd optimizations
BTRFS info (device loop0): turning on async discard
BTRFS info (device loop0): enabling free space tree
BTRFS info (device loop0): force clearing of disk cache
BTRFS info (device loop0): enabling auto defrag
BTRFS info (device loop0): use zstd compression, level 3
BTRFS info (device loop0): balance: start -dconvert=raid0 -mconvert=raid0
BTRFS info (device loop0): relocating block group 6881280 flags data|metadata
BTRFS info (device loop0): relocating block group 5242880 flags data|metadata
------------[ cut here ]------------
btrfs_abort_should_print_stack(__error)
WARNING: fs/btrfs/relocation.c:725 at create_reloc_root+0xbdd/0xbf0 fs/btrfs/relocation.c:725, CPU#0: syz.0.0/5319
Modules linked in:
CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:create_reloc_root+0xbdd/0xbf0 fs/btrfs/relocation.c:725
Code: e2 74 13 41 83 fe fb 74 14 41 83 fe f4 75 15 e8 99 9f 97 fd eb 17 e8 92 9f 97 fd eb 10 e8 8b 9f 97 fd eb 09 e8 84 9f 97 fd 90 <0f> 0b 90 44 89 f1 f7 d9 e9 08 fd ff ff 66 0f 1f 44 00 00 90 90 90
RSP: 0018:ffffc9000de47340 EFLAGS: 00010293
RAX: ffffffff84302cac RBX: ffff888052828001 RCX: ffff888000accb00
RDX: 0000000000000000 RSI: ffffffff8f3fc0c0 RDI: 00000000ffffffef
RBP: ffffc9000de47490 R08: ffff888000accb00 R09: 0000000000000003
R10: 00000000fffffffb R11: 0000000000000000 R12: 1ffff92001bc8e70
R13: 1ffff1100a505003 R14: 00000000ffffffef R15: ffffc9000de473c0
FS:  00007f76ecc566c0(0000) GS:ffff88808c2cf000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f76dfe7b000 CR3: 00000000441c9000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 btrfs_init_reloc_root+0x395/0x590 fs/btrfs/relocation.c:792
 record_root_in_trans+0x27c/0x330 fs/btrfs/transaction.c:462
 btrfs_record_root_in_trans+0x15a/0x180 fs/btrfs/transaction.c:508
 relocate_tree_block fs/btrfs/relocation.c:2640 [inline]
 relocate_tree_blocks+0xe60/0x1fc0 fs/btrfs/relocation.c:2773
 relocate_block_group+0x77c/0xeb0 fs/btrfs/relocation.c:3701
 do_nonremap_reloc+0xa7/0x560 fs/btrfs/relocation.c:5391
 btrfs_relocate_block_group+0x6e2/0xaf0 fs/btrfs/relocation.c:5558
 btrfs_relocate_chunk+0x114/0x810 fs/btrfs/volumes.c:3694
 __btrfs_balance+0x1b5f/0x29d0 fs/btrfs/volumes.c:4633
 btrfs_balance+0xaa6/0x1180 fs/btrfs/volumes.c:5020
 btrfs_ioctl_balance+0x3da/0x640 fs/btrfs/ioctl.c:3479
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f76ebd9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f76ecc55fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f76ec025fa0 RCX: 00007f76ebd9e159
RDX: 0000200000000300 RSI: 00000000c4009420 RDI: 0000000000000004
RBP: 00007f76ebe35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f76ec026038 R14: 00007f76ec025fa0 R15: 00007ffd32de5f18
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/03 04:19 upstream 940de590b839 6a988719 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in create_reloc_root
2026/07/05 08:41 upstream 7404ce516372 fcece630 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root WARNING in create_reloc_root
* Struck through repros no longer work on HEAD.