------------[ cut here ]------------ BTRFS: Transaction aborted (error -28) WARNING: fs/btrfs/inode.c:3216 at btrfs_finish_one_ordered+0x1934/0x2b80 fs/btrfs/inode.c:3216, CPU#0: kworker/u32:9/1178 Modules linked in: CPU: 0 UID: 0 PID: 1178 Comm: kworker/u32:9 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: btrfs-endio-write btrfs_work_helper RIP: 0010:btrfs_finish_one_ordered+0x1937/0x2b80 fs/btrfs/inode.c:3216 Code: d7 fd 41 8d 44 24 1e 83 f8 19 77 0f ba 01 00 04 02 48 0f a3 c2 0f 82 2e 03 00 00 e8 c3 89 d7 fd 48 8d 3d 4c 7f a9 0c 44 89 e6 <67> 48 0f b9 3a c7 04 24 01 00 00 00 e8 a8 89 d7 fd 44 8b 04 24 44 RSP: 0018:ffffc900064779d0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888038980b80 RCX: ffffffff83e75a1f RDX: ffff888029854980 RSI: 00000000ffffffe4 RDI: ffffffff9090d990 RBP: ffff88803c712b90 R08: 0000000000000005 R09: fffffffffffffffb R10: ffffffffffffffe4 R11: 0000000000002ba1 R12: 00000000ffffffe4 R13: ffff88803c712bf0 R14: ffff888038980bc0 R15: ffff88803d708000 FS: 0000000000000000(0000) GS:ffff8880d68f6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc29256fd58 CR3: 000000003d220000 CR4: 0000000000352ef0 Call Trace: btrfs_work_helper+0x21b/0xc10 fs/btrfs/async-thread.c:312 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 ---------------- Code disassembly (best guess): 0: d7 xlat %ds:(%rbx) 1: fd std 2: 41 8d 44 24 1e lea 0x1e(%r12),%eax 7: 83 f8 19 cmp $0x19,%eax a: 77 0f ja 0x1b c: ba 01 00 04 02 mov $0x2040001,%edx 11: 48 0f a3 c2 bt %rax,%rdx 15: 0f 82 2e 03 00 00 jb 0x349 1b: e8 c3 89 d7 fd call 0xfdd789e3 20: 48 8d 3d 4c 7f a9 0c lea 0xca97f4c(%rip),%rdi # 0xca97f73 27: 44 89 e6 mov %r12d,%esi * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: c7 04 24 01 00 00 00 movl $0x1,(%rsp) 36: e8 a8 89 d7 fd call 0xfdd789e3 3b: 44 8b 04 24 mov (%rsp),%r8d 3f: 44 rex.R