syzbot
WARNING in btrfs_add_delayed_iput (3)
Status:
upstream: reported on 2026/06/02 14:13
Subsystems:
btrfs
Labels:
prio:low
[Documentation on labels]
Reported-by: syzbot+6a843bf8604711c8fab0@syzkaller.appspotmail.com
Fix commit:
btrfs: fix pending delayed iputs when using autodefrag
Patched on: [ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 77d, last: 4d09h
Sample crash report:
------------[ cut here ]------------
test_bit(BTRFS_FS_STATE_NO_DELAYED_IPUT, &fs_info->fs_state)
WARNING: fs/btrfs/inode.c:3593 at btrfs_add_delayed_iput+0x2e0/0x340 fs/btrfs/inode.c:3593, CPU#1: kworker/u8:8/21723
Modules linked in:
CPU: 1 UID: 0 PID: 21723 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: btrfs-endio-write btrfs_work_helper
RIP: 0010:btrfs_add_delayed_iput+0x2e0/0x340 fs/btrfs/inode.c:3593
Code: 16 32 28 fe 48 8b 3b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d e9 00 42 8d fd e8 7b bb be fd e9 f8 fd ff ff e8 71 bb be fd 90 <0f> 0b 90 e9 52 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 84
RSP: 0018:ffffc9000466f808 EFLAGS: 00010293
RAX: ffffffff84070cbf RBX: ffff88805e7b0000 RCX: ffff888012079f00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100bcf64a7 R12: 0000000000000001
R13: dffffc0000000000 R14: ffff888040398a38 R15: 0000000000000200
FS: 0000000000000000(0000) GS:ffff888125d46000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe67402e5de CR3: 000000000dfb0000 CR4: 00000000003526f0
Call Trace:
<TASK>
btrfs_put_ordered_extent+0x18a/0x420 fs/btrfs/ordered-data.c:642
btrfs_finish_one_ordered+0xf7f/0x1f00 fs/btrfs/inode.c:3430
btrfs_work_helper+0x338/0xc30 fs/btrfs/async-thread.c:312
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
* Struck through repros no longer work on HEAD.