syzbot


BUG: corrupted list in btrfs_free_compr_folio

Status: upstream: reported on 2026/03/16 13:40
Subsystems: btrfs
[Documentation on labels]
Reported-by: syzbot+3c4d8371d65230f852a2@syzkaller.appspotmail.com
Fix commit: 0dcabcb920a5 btrfs: zlib: handle page aligned compressed size correctly
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm ci-upstream-gce-arm64]
First crash: 49d, last: 32d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [btrfs?] BUG: corrupted list in btrfs_free_compr_folio 2 (3) 2026/03/18 22:05

Sample crash report:
list_add double add: new=ffffea00010fe848, prev=ffffffff9a443a08, next=ffffea00010fe848.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:37!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 44 Comm: kworker/u4:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: btrfs-delalloc btrfs_work_helper
RIP: 0010:__list_add_valid_or_report+0xa5/0x130 lib/list_debug.c:35
Code: 74 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d e9 d2 27 f9 06 cc 48 c7 c7 e0 e8 27 8c 4c 89 fe 4c 89 f2 48 89 d9 e8 1c db 6c fc 90 <0f> 0b 48 c7 c7 c0 e6 27 8c e8 0d db 6c fc 90 0f 0b 48 c7 c7 80 e7
RSP: 0018:ffffc90000467800 EFLAGS: 00010246
RAX: 0000000000000058 RBX: ffffea00010fe848 RCX: 9835873b97162a00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 1ffffd400021fd0a R08: ffffc90000467587 R09: 1ffff9200008ceb0
R10: dffffc0000000000 R11: fffff5200008ceb1 R12: 1ffffffff3488741
R13: dffffc0000000000 R14: ffffffff9a443a08 R15: ffffea00010fe848
FS:  0000000000000000(0000) GS:ffff88808ca4c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0b0818dfe8 CR3: 00000000443a3000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 __list_add_valid include/linux/list.h:96 [inline]
 __list_add include/linux/list.h:158 [inline]
 list_add include/linux/list.h:177 [inline]
 btrfs_free_compr_folio+0x1e1/0x340 fs/btrfs/compression.c:218
 cleanup_compressed_bio fs/btrfs/compression.h:150 [inline]
 btrfs_compress_bio+0x35a/0x6b0 fs/btrfs/compression.c:1052
 compress_file_range+0x8df/0x19b0 fs/btrfs/inode.c:1023
 btrfs_work_helper+0x38c/0xc80 fs/btrfs/async-thread.c:312
 process_one_work kernel/workqueue.c:3276 [inline]
 process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report+0xa5/0x130 lib/list_debug.c:35
Code: 74 12 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d e9 d2 27 f9 06 cc 48 c7 c7 e0 e8 27 8c 4c 89 fe 4c 89 f2 48 89 d9 e8 1c db 6c fc 90 <0f> 0b 48 c7 c7 c0 e6 27 8c e8 0d db 6c fc 90 0f 0b 48 c7 c7 80 e7
RSP: 0018:ffffc90000467800 EFLAGS: 00010246
RAX: 0000000000000058 RBX: ffffea00010fe848 RCX: 9835873b97162a00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 1ffffd400021fd0a R08: ffffc90000467587 R09: 1ffff9200008ceb0
R10: dffffc0000000000 R11: fffff5200008ceb1 R12: 1ffffffff3488741
R13: dffffc0000000000 R14: ffffffff9a443a08 R15: ffffea00010fe848
FS:  0000000000000000(0000) GS:ffff88808ca4c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0b0818dfe8 CR3: 00000000443a3000 CR4: 0000000000352ef0

Crashes (21):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/29 16:11 upstream cbfffcca2bf0 dcaebc52 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/28 07:34 upstream 7df48e363130 f9ef2ec1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/27 03:48 upstream 46b513250491 50cdcaa1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/26 15:54 upstream 0138af2472df 4b3d9a38 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/25 22:58 upstream bbeb83d3182a 4367a094 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/25 06:52 upstream 24f9515de877 35e4ff71 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/25 03:15 upstream 24f9515de877 35e4ff71 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/23 02:22 upstream 8d8bd2a5aa98 5b92003d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/19 13:47 upstream 8a30aeb0d1b4 0291cd06 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/18 00:58 upstream f0caa1d49cc0 c8810548 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/17 12:24 upstream 2d1373e4246d c01bca74 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/17 10:53 upstream 2d1373e4246d c01bca74 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/17 10:13 upstream 2d1373e4246d c01bca74 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/17 10:10 upstream 2d1373e4246d c01bca74 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/16 11:22 upstream f338e7738378 64e21424 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/15 11:49 upstream 267594792a71 ee8d34d6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/15 10:59 upstream 267594792a71 ee8d34d6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/15 10:55 upstream 267594792a71 ee8d34d6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/14 05:40 upstream 1c9982b49613 ee8d34d6 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/13 17:19 upstream 0257f64bdac7 351cb5cf .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
2026/03/12 13:35 upstream 80234b5ab240 4efadf07 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root BUG: corrupted list in btrfs_free_compr_folio
* Struck through repros no longer work on HEAD.