[ 138.115349][ T1335] ieee802154 phy0 wpan0: encryption failed: -22
[ 138.115470][ T1335] ieee802154 phy1 wpan1: encryption failed: -22
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x198000)
[ 141.566452][ T1030] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 141.566480][ T1030] ata1: failed to read log page 10h (errno=-5)
[ 141.566491][ T1030] ata1.00: NCQ disabled due to excessive errors
[ 141.566499][ T1030] ata1.00: exception Emask 0x1 SAct 0x40000001 SErr 0x0 action 0x0
[ 141.566521][ T1030] ata1.00: irq_stat 0x41000000
[ 141.566531][ T1030] ata1.00: failed command: WRITE FPDMA QUEUED
[ 141.566537][ T1030] ata1.00: cmd 61/a0:00:36:21:08/0b:00:00:00:00/40 tag 0 ncq dma 1523712 ou
[ 141.566537][ T1030] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 141.566564][ T1030] ata1.00: status: { DRDY }
[ 141.566574][ T1030] ata1.00: failed command: WRITE FPDMA QUEUED
[ 141.566580][ T1030] ata1.00: cmd 61/c0:f0:36:c1:08/0c:00:00:00:00/40 tag 30 ncq dma 1671168 ou
[ 141.566580][ T1030] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 141.566608][ T1030] ata1.00: status: { DRDY }
[ 141.569224][ T1030] ata1.00: configured for UDMA/100
[ 141.630017][ T1030] ata1: EH complete
[ 141.671494][ T1030] ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
[ 141.671514][ T1030] ata1.00: irq_stat 0x40000000
[ 141.671524][ T1030] ata1.00: failed command: WRITE DMA EXT
[ 141.671532][ T1030] ata1.00: cmd 35/00:c8:ae:31:08/00:05:00:00:00/e0 tag 14 dma 757760 out
[ 141.671532][ T1030] res 41/04:c8:ae:31:08/00:05:00:00:00/e0 Emask 0x1 (device error)
[ 141.671562][ T1030] ata1.00: status: { DRDY ERR }
[ 141.671569][ T1030] ata1.00: error: { ABRT }
[ 141.672563][ T1030] ata1.00: configured for UDMA/100
[ 141.672634][ T1030] ata1: EH complete
Warning: Permanently added '[localhost]:60928' (ED25519) to the list of known hosts.
[*] Starting Btrfs reproducer for __add_block_group_free_space...
[+] Successfully created image file /tmp/btrfs.img
[+] Image file truncated to 0xf00000 bytes.
[+] Superblock written successfully at 0x10000.
[+] Chunk Tree leaf written at 0x100000.
[+] Root Tree leaf written at 0x200000.
[+] Extent Tree leaf written at 0x201000 (12 items).
[+] Dev Tree leaf written at 0x202000.
[+] FS Tree leaf written at 0x203000.
[+] CSUM Tree leaf written at 0x204000.
[+] Free Space Tree leaf written at 0x205000 (5 items).
[+] Data Reloc Tree leaf written at 0x206000.
[+] UUID Tree leaf written at 0x207000.
[+] Btrfs image file written successfully.
[+] Acquired loop device index: 0
[ 143.438837][ T5668] loop0: detected capacity change from 0 to 30720
[+] Attached /tmp/btrfs.img to /dev/loop0.
[+] Descriptors closed cleanly prior to mount.
[ 143.461199][ T5668] BTRFS: device fsid 5a112233-4455-6677-8899-aabbccddeeff devid 1 transid 1 /dev/loop0 (7:0) scanned by syz-executor385 (5668)
[ 143.526856][ T5668] BTRFS info (device loop0): first mount of filesystem 5a112233-4455-6677-8899-aabbccddeeff
[ 143.526906][ T5668] BTRFS info (device loop0): using crc32c checksum algorithm
[+] Successfully mounted /dev/loop0 on /tmp/btrfs_mnt.
[ 143.652162][ T5668] BTRFS info (device loop0): enabling ssd optimizations
[ 143.652183][ T5668] BTRFS info (device loop0): turning on async discard
[ 143.652192][ T5668] BTRFS info (device loop0): enabling free space tree
[+] Successfully opened /tmp/btrfs_mnt/f (fd = 3).
[*] Invoking fallocate() to request data space...
[ 143.729194][ T185] ------------[ cut here ]------------
[ 143.729206][ T185] btrfs_abort_should_print_stack(__error)
[ 143.729212][ T185] WARNING: fs/btrfs/free-space-tree.c:1446 at __add_block_group_free_space+0x5a3/0x5b0, CPU#0: kworker/u4:7/185
[ 143.740191][ T185] Modules linked in:
[ 143.742117][ T185] CPU: 0 UID: 0 PID: 185 Comm: kworker/u4:7 Not tainted syzkaller #0 PREEMPT(full)
[ 143.746240][ T185] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 143.750637][ T185] Workqueue: events_unbound btrfs_async_reclaim_data_space
[ 143.753962][ T185] RIP: 0010:__add_block_group_free_space+0x5a3/0x5b0
[ 143.756985][ T185] Code: 07 38 c1 0f 8c ce fc ff ff 4c 89 f7 e8 66 3c f5 fd e9 c1 fc ff ff e8 cc 98 7c fd eb 10 e8 c5 98 7c fd eb 09 e8 be 98 7c fd 90 <0f> 0b 90 44 89 e1 f7 d9 e9 51 fe ff ff 90 90 90 90 90 90 90 90 90
[ 143.766517][ T185] RSP: 0018:ffffc90001a7f578 EFLAGS: 00010293
[ 143.769274][ T185] RAX: ffffffff844c8872 RBX: ffff888013790001 RCX: ffff888034dc0000
[ 143.772919][ T185] RDX: 0000000000000000 RSI: ffffffff9081ef80 RDI: 00000000ffffffe4
[ 143.776358][ T185] RBP: ffff888037aea758 R08: ffff888034dc0000 R09: 0000000000000003
[ 143.779954][ T185] R10: 00000000fffffffb R11: 0000000000000000 R12: 00000000ffffffe4
[ 143.783550][ T185] R13: ffff88801377d000 R14: ffff888037aea7b8 R15: 0000000000000000
[ 143.786996][ T185] FS: 0000000000000000(0000) GS:ffff88808aa01000(0000) knlGS:0000000000000000
[ 143.791026][ T185] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 143.794024][ T185] CR2: 00007f4b3d8dd080 CR3: 0000000041dd5000 CR4: 0000000000352ef0
[ 143.797648][ T185] Call Trace:
[ 143.799189][ T185]
[ 143.800552][ T185] ? btrfs_create_pending_block_groups+0xad2/0x15e0
[ 143.803794][ T185] btrfs_add_block_group_free_space+0xd0/0x130
[ 143.806565][ T185] btrfs_create_pending_block_groups+0xcc6/0x15e0
[ 143.809470][ T185] ? __pfx_btrfs_create_pending_block_groups+0x10/0x10
[ 143.812566][ T185] ? btrfs_trans_release_metadata+0x224/0x330
[ 143.815263][ T185] __btrfs_end_transaction+0x140/0x640
[ 143.817777][ T185] flush_space+0x3e9/0xde0
[ 143.819884][ T185] ? __pfx_flush_space+0x10/0x10
[ 143.822276][ T185] ? do_raw_spin_unlock+0x4d/0x200
[ 143.824605][ T185] do_async_reclaim_data_space+0x137/0x550
[ 143.827168][ T185] ? process_scheduled_works+0x97a/0x1630
[ 143.829847][ T185] btrfs_async_reclaim_data_space+0x41/0x90
[ 143.832618][ T185] process_scheduled_works+0xc3d/0x1630
[ 143.835162][ T185] ? __pfx_process_scheduled_works+0x10/0x10
[ 143.837761][ T185] ? assign_work+0x3cf/0x5d0
[ 143.841490][ T185] worker_thread+0xa47/0xfb0
[ 143.843663][ T185] kthread+0x38b/0x480
[ 143.845542][ T185] ? __pfx_worker_thread+0x10/0x10
[ 143.847793][ T185] ? __pfx_kthread+0x10/0x10
[ 143.849762][ T185] ret_from_fork+0x514/0xb70
[ 143.851841][ T185] ? __pfx_ret_from_fork+0x10/0x10
[ 143.854191][ T185] ? __switch_to+0xc78/0x1410
[ 143.856276][ T185] ? __pfx_kthread+0x10/0x10
[ 143.858403][ T185] ret_from_fork_asm+0x1a/0x30
[ 143.860483][ T185]
[ 143.861926][ T185] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 143.865050][ T185] CPU: 0 UID: 0 PID: 185 Comm: kworker/u4:7 Not tainted syzkaller #0 PREEMPT(full)
[ 143.869035][ T185] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 143.873434][ T185] Workqueue: events_unbound btrfs_async_reclaim_data_space
[ 143.876525][ T185] Call Trace:
[ 143.878143][ T185]
[ 143.879629][ T185] vpanic+0x26f/0x710
[ 143.881484][ T185] panic+0xc5/0xd0
[ 143.883217][ T185] ? __pfx_panic+0x10/0x10
[ 143.885271][ T185] ? ret_from_fork_asm+0x1a/0x30
[ 143.887355][ T185] __warn+0x315/0x4c0
[ 143.889221][ T185] ? __add_block_group_free_space+0x5a3/0x5b0
[ 143.891734][ T185] ? __add_block_group_free_space+0x5a3/0x5b0
[ 143.894429][ T185] __report_bug+0x276/0x570
[ 143.896587][ T185] ? __add_block_group_free_space+0x5a3/0x5b0
[ 143.899346][ T185] ? __pfx___report_bug+0x10/0x10
[ 143.901651][ T185] ? btrfs_insert_empty_items+0x119/0x1a0
[ 143.904244][ T185] ? add_new_free_space_info+0x2c3/0x420
[ 143.906648][ T185] ? __add_block_group_free_space+0x5a3/0x5b0
[ 143.909186][ T185] report_bug+0x16b/0x220
[ 143.911061][ T185] ? __add_block_group_free_space+0x5a3/0x5b0
[ 143.913643][ T185] ? __add_block_group_free_space+0x5a5/0x5b0
[ 143.916304][ T185] handle_bug+0x9c/0x200
[ 143.918190][ T185] exc_invalid_op+0x1a/0x50
[ 143.920213][ T185] asm_exc_invalid_op+0x1a/0x20
[ 143.922364][ T185] RIP: 0010:__add_block_group_free_space+0x5a3/0x5b0
[ 143.925289][ T185] Code: 07 38 c1 0f 8c ce fc ff ff 4c 89 f7 e8 66 3c f5 fd e9 c1 fc ff ff e8 cc 98 7c fd eb 10 e8 c5 98 7c fd eb 09 e8 be 98 7c fd 90 <0f> 0b 90 44 89 e1 f7 d9 e9 51 fe ff ff 90 90 90 90 90 90 90 90 90
[ 143.933540][ T185] RSP: 0018:ffffc90001a7f578 EFLAGS: 00010293
[ 143.936226][ T185] RAX: ffffffff844c8872 RBX: ffff888013790001 RCX: ffff888034dc0000
[ 143.939816][ T185] RDX: 0000000000000000 RSI: ffffffff9081ef80 RDI: 00000000ffffffe4
[ 143.943210][ T185] RBP: ffff888037aea758 R08: ffff888034dc0000 R09: 0000000000000003
[ 143.946747][ T185] R10: 00000000fffffffb R11: 0000000000000000 R12: 00000000ffffffe4
[ 143.950278][ T185] R13: ffff88801377d000 R14: ffff888037aea7b8 R15: 0000000000000000
[ 143.953817][ T185] ? __add_block_group_free_space+0x5a2/0x5b0
[ 143.956548][ T185] ? __add_block_group_free_space+0x5a2/0x5b0
[ 143.959354][ T185] ? btrfs_create_pending_block_groups+0xad2/0x15e0
[ 143.962231][ T185] btrfs_add_block_group_free_space+0xd0/0x130
[ 143.964918][ T185] btrfs_create_pending_block_groups+0xcc6/0x15e0
[ 143.967723][ T185] ? __pfx_btrfs_create_pending_block_groups+0x10/0x10
[ 143.970764][ T185] ? btrfs_trans_release_metadata+0x224/0x330
[ 143.973498][ T185] __btrfs_end_transaction+0x140/0x640
[ 143.975947][ T185] flush_space+0x3e9/0xde0
[ 143.977990][ T185] ? __pfx_flush_space+0x10/0x10
[ 143.980105][ T185] ? do_raw_spin_unlock+0x4d/0x200
[ 143.982188][ T185] do_async_reclaim_data_space+0x137/0x550
[ 143.984858][ T185] ? process_scheduled_works+0x97a/0x1630
[ 143.987364][ T185] btrfs_async_reclaim_data_space+0x41/0x90
[ 143.990021][ T185] process_scheduled_works+0xc3d/0x1630
[ 143.992437][ T185] ? __pfx_process_scheduled_works+0x10/0x10
[ 143.995072][ T185] ? assign_work+0x3cf/0x5d0
[ 143.997181][ T185] worker_thread+0xa47/0xfb0
[ 143.999295][ T185] kthread+0x38b/0x480
[ 144.001094][ T185] ? __pfx_worker_thread+0x10/0x10
[ 144.003314][ T185] ? __pfx_kthread+0x10/0x10
[ 144.005312][ T185] ret_from_fork+0x514/0xb70
[ 144.007400][ T185] ? __pfx_ret_from_fork+0x10/0x10
[ 144.009841][ T185] ? __switch_to+0xc78/0x1410
[ 144.011844][ T185] ? __pfx_kthread+0x10/0x10
[ 144.013987][ T185] ret_from_fork_asm+0x1a/0x30
[ 144.016187][ T185]
[ 144.018024][ T185] Kernel Offset: disabled
[ 144.019981][ T185] Rebooting in 86400 seconds..