------------[ cut here ]------------ BTRFS: Transaction aborted (error -28) WARNING: fs/btrfs/inode.c:3239 at btrfs_finish_one_ordered+0x1934/0x2b80 fs/btrfs/inode.c:3239, CPU#1: kworker/u32:0/12 Modules linked in: CPU: 1 UID: 0 PID: 12 Comm: kworker/u32:0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: btrfs-endio-write btrfs_work_helper RIP: 0010:btrfs_finish_one_ordered+0x1937/0x2b80 fs/btrfs/inode.c:3239 Code: d7 fd 41 8d 44 24 1e 83 f8 19 77 0f ba 01 00 04 02 48 0f a3 c2 0f 82 2e 03 00 00 e8 03 7b d7 fd 48 8d 3d 8c 68 a9 0c 44 89 e6 <67> 48 0f b9 3a c7 04 24 01 00 00 00 e8 e8 7a d7 fd 44 8b 04 24 44 RSP: 0018:ffffc900000f79d0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8880279b8b80 RCX: ffffffff83e780af RDX: ffff88801da84980 RSI: 00000000ffffffe4 RDI: ffffffff9090e960 RBP: ffff88803c746250 R08: 0000000000000005 R09: fffffffffffffffb R10: ffffffffffffffe4 R11: 0000000000002ba1 R12: 00000000ffffffe4 R13: ffff88803c7462b0 R14: ffff8880279b8bc0 R15: ffff88803e6c88a0 FS: 0000000000000000(0000) GS:ffff8880d69f4000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8779349d58 CR3: 0000000031c37000 CR4: 0000000000352ef0 Call Trace: btrfs_work_helper+0x21b/0xc10 fs/btrfs/async-thread.c:312 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 ---------------- Code disassembly (best guess): 0: d7 xlat %ds:(%rbx) 1: fd std 2: 41 8d 44 24 1e lea 0x1e(%r12),%eax 7: 83 f8 19 cmp $0x19,%eax a: 77 0f ja 0x1b c: ba 01 00 04 02 mov $0x2040001,%edx 11: 48 0f a3 c2 bt %rax,%rdx 15: 0f 82 2e 03 00 00 jb 0x349 1b: e8 03 7b d7 fd call 0xfdd77b23 20: 48 8d 3d 8c 68 a9 0c lea 0xca9688c(%rip),%rdi # 0xca968b3 27: 44 89 e6 mov %r12d,%esi * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: c7 04 24 01 00 00 00 movl $0x1,(%rsp) 36: e8 e8 7a d7 fd call 0xfdd77b23 3b: 44 8b 04 24 mov (%rsp),%r8d 3f: 44 rex.R