------------[ cut here ]------------ btrfs_abort_should_print_stack(__error) WARNING: fs/btrfs/extent-tree.c:3425 at __btrfs_free_extent+0x1eff/0x38a0 fs/btrfs/extent-tree.c:3425, CPU#0: kworker/u4:5/79 Modules linked in: CPU: 0 UID: 0 PID: 79 Comm: kworker/u4:5 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: btrfs-qgroup-rescan btrfs_work_helper RIP: 0010:__btrfs_free_extent+0x1eff/0x38a0 fs/btrfs/extent-tree.c:3425 Code: e5 a4 fd 45 85 f6 0f 85 d6 05 00 00 e8 ba e0 a4 fd e9 3d 09 00 00 e8 b0 e0 a4 fd eb 10 e8 a9 e0 a4 fd eb 09 e8 a2 e0 a4 fd 90 <0f> 0b 90 4c 8b 7c 24 08 44 89 f1 f7 d9 e9 57 e8 ff ff e8 da 1b e3 RSP: 0018:ffffc90000e96fa0 EFLAGS: 00010293 RAX: ffffffff84243ffe RBX: ffff888054408001 RCX: ffff88803349a580 RDX: 0000000000000000 RSI: ffffffff907e38c0 RDI: 00000000ffffffe4 RBP: ffffc90000e97150 R08: ffff88803349a580 R09: 0000000000000003 R10: 00000000fffffffb R11: 0000000000000000 R12: dffffc0000000000 R13: ffff8880457a5318 R14: 00000000ffffffe4 R15: 00000000ffffffe4 FS: 0000000000000000(0000) GS:ffff88808a9fe000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000557b84d205f8 CR3: 000000000ff48000 CR4: 0000000000352ef0 Call Trace: run_delayed_tree_ref fs/btrfs/extent-tree.c:1824 [inline] run_one_delayed_ref fs/btrfs/extent-tree.c:1851 [inline] btrfs_run_delayed_refs_for_head fs/btrfs/extent-tree.c:2058 [inline] __btrfs_run_delayed_refs+0x1669/0x43a0 fs/btrfs/extent-tree.c:2134 btrfs_run_delayed_refs+0xdc/0x2a0 fs/btrfs/extent-tree.c:2246 btrfs_commit_transaction+0x287/0x3010 fs/btrfs/transaction.c:2283 btrfs_qgroup_rescan_worker+0x19cd/0x2410 fs/btrfs/qgroup.c:3930 btrfs_work_helper+0x3a2/0xc50 fs/btrfs/async-thread.c:312 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245