syzbot


kernel BUG in extent_writepage_io (2)

Status: upstream: reported on 2026/06/22 06:23
Subsystems: btrfs
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+11036d2e408a419c179c@syzkaller.appspotmail.com
First crash: 6d08h, last: 21h28m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
9517fd67-362a-4f88-957b-c1ea7a6bac24 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ kernel BUG in extent_writepage_io (2) 2026/06/20 00:32 2026/06/20 00:32 2026/06/20 01:42 023e42b533e586523329e56d8cc833583d338ca9

			
		
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [btrfs?] kernel BUG in extent_writepage_io (2) 0 (1) 2026/06/22 06:23
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in extent_writepage_io btrfs -1 C error done 6 186d 610d 0/29 auto-obsoleted due to no activity on 2026/03/29 20:26

Sample crash report:
assertion failed: !btrfs_extent_map_is_compressed(em), in fs/btrfs/extent_io.c:1720
------------[ cut here ]------------
kernel BUG at fs/btrfs/extent_io.c:1720!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 68 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_unbound btrfs_async_reclaim_metadata_space
RIP: 0010:submit_one_sector fs/btrfs/extent_io.c:1720 [inline]
RIP: 0010:extent_writepage_io+0x1022/0x11a0 fs/btrfs/extent_io.c:1826
Code: 28 fd 90 0f 0b e8 be 25 c7 fd 48 c7 c7 20 b2 17 8c 48 c7 c6 e0 c8 17 8c 48 c7 c2 a0 b2 17 8c b9 b8 06 00 00 e8 1f 94 28 fd 90 <0f> 0b e8 97 25 c7 fd 48 c7 c7 20 b2 17 8c 48 c7 c6 80 c9 17 8c 48
RSP: 0018:ffffc90000adedc0 EFLAGS: 00010246
RAX: 0000000000000053 RBX: 0000000000000004 RCX: 4db0a5a32afc0300
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffea0001493e40 R08: ffffc90000adeb47 R09: 1ffff9200015bd68
R10: dffffc0000000000 R11: fffff5200015bd69 R12: 0000000000001000
R13: dffffc0000000000 R14: ffff8880445cc4e8 R15: 000000000051d000
FS:  0000000000000000(0000) GS:ffff88808c821000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000180 CR3: 0000000011c56000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 extent_writepage fs/btrfs/extent_io.c:1936 [inline]
 extent_write_cache_pages fs/btrfs/extent_io.c:2593 [inline]
 btrfs_writepages+0x17a1/0x28b0 fs/btrfs/extent_io.c:2725
 do_writepages+0x338/0x560 mm/page-writeback.c:2571
 filemap_writeback mm/filemap.c:388 [inline]
 filemap_flush_nr+0x21b/0x360 mm/filemap.c:463
 start_delalloc_inodes+0x4cf/0xab0 fs/btrfs/inode.c:8752
 btrfs_start_delalloc_roots+0x513/0x790 fs/btrfs/inode.c:8812
 shrink_delalloc fs/btrfs/space-info.c:773 [inline]
 flush_space+0x73c/0xde0 fs/btrfs/space-info.c:883
 do_async_reclaim_metadata_space+0x3e8/0x940 fs/btrfs/space-info.c:1211
 btrfs_async_reclaim_metadata_space+0x89/0xe0 fs/btrfs/space-info.c:1278
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:submit_one_sector fs/btrfs/extent_io.c:1720 [inline]
RIP: 0010:extent_writepage_io+0x1022/0x11a0 fs/btrfs/extent_io.c:1826
Code: 28 fd 90 0f 0b e8 be 25 c7 fd 48 c7 c7 20 b2 17 8c 48 c7 c6 e0 c8 17 8c 48 c7 c2 a0 b2 17 8c b9 b8 06 00 00 e8 1f 94 28 fd 90 <0f> 0b e8 97 25 c7 fd 48 c7 c7 20 b2 17 8c 48 c7 c6 80 c9 17 8c 48
RSP: 0018:ffffc90000adedc0 EFLAGS: 00010246
RAX: 0000000000000053 RBX: 0000000000000004 RCX: 4db0a5a32afc0300
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffea0001493e40 R08: ffffc90000adeb47 R09: 1ffff9200015bd68
R10: dffffc0000000000 R11: fffff5200015bd69 R12: 0000000000001000
R13: dffffc0000000000 R14: ffff8880445cc4e8 R15: 000000000051d000
FS:  0000000000000000(0000) GS:ffff88808c821000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000180 CR3: 0000000011c56000 CR4: 0000000000352ef0

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/23 16:57 upstream 502d801f0ab0 4b1d8f01 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/23 14:43 upstream 502d801f0ab0 4b1d8f01 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/22 14:01 upstream ef0c9f75a195 ab2703f0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/21 04:56 upstream 1a3746ccbb0a 43bfcdb0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/20 09:23 upstream a975094bf98c 43bfcdb0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/19 15:09 upstream 9ecfb2f7287a 023e42b5 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/18 21:05 upstream e771677c937d a776b0d0 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
2026/06/18 06:15 upstream e771677c937d b62b3ded .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root kernel BUG in extent_writepage_io
* Struck through repros no longer work on HEAD.